# Encrypted Google Drive in Workdesk

Desktop 0.11.0 (Debian 13 and Windows) and Android 2.5.0 include Google connection configuration. Open **Google Drive / Drive → Connect Drive / Connect Google Drive**, choose your account and approve Drive access. No user JSON import is needed. Drive can use a different account from Gmail. Existing desktop client overrides, refresh tokens and keyrings are preserved.

## Project owner configuration

Enable Google Drive API in the existing Google Cloud project and configure the full `https://www.googleapis.com/auth/drive` scope. Full scope is needed to browse and manage existing files/folders; `drive.file` would only cover files selected/created for this app. Google's testing audience and restricted-scope publication/verification requirements still apply. Android uses native Play services AuthorizationClient with the existing package/signing-certificate registration, not Desktop loopback OAuth or a shipped client secret. Gmail permission does not by itself grant Drive permission.

Official references:
- https://developer.android.com/identity/authorization
- https://developers.google.com/workspace/drive/api/guides/api-specific-auth
- https://developers.google.com/workspace/drive/api/guides/manage-uploads
- https://developers.google.com/workspace/drive/api/guides/properties

## First encryption setup

For a new encrypted Drive, generate the local PGP key pair and optionally set a private-key passphrase. Acknowledge that key/passphrase loss makes files unreadable and downloaded cache copies are plaintext. Keys use Linux Secret Service, Windows OS-protected storage, or a separate Android Keystore-encrypted, backup-excluded Drive vault. Private keys and passphrases never go to the Google APIs. Unlock keys after restarting the app; passphrases are only held in process memory and cleared by Lock/disconnect/process exit.

If Workdesk-encrypted files already exist, generating unrelated keys is blocked. Import the original offline key backup instead. A phone does not automatically possess the desktop's private keys merely because the same Google account signs in.

### Use the same encrypted Drive on desktop and phone

1. On the device with the original keys, open **Encryption & keys → Export offline key backup**. Choose a separate backup passphrase of at least 12 characters and confirm it.
2. Save to **local, non-synced storage**. Never use Google Drive, Gmail, cloud-synced folders or another cloud provider for private-key backups, even encrypted ones. Android blocks cloud document providers for key import/export; desktop file dialogs cannot detect every sync client, so select the destination deliberately.
3. Transfer the encrypted `.pgp` backup directly using a USB cable or other offline medium. Keep a safe offline backup.
4. Connect the same Drive account on the other device. Choose **Import original offline key backup** (Android: Import offline key backup), enter the backup passphrase, and choose the local file. The account identifier is checked before saving anything.
5. Unlock the imported key with its **original key passphrase**, not the backup passphrase. Compare the full active fingerprint on both devices.

Importing an updated backup selects that backup's active key, adds missing keys, and retains existing private keys/passphrases. It does not erase historical keys. Use the most recently exported backup; an old backup can select an old encryption key. Imports during a local pending rotation are blocked. Do not share backups through Workdesk's normal upload function: these backups belong offline.

## File operations

Browse folders, search within a folder, load more results, create folders, upload/encrypt files, download/decrypt files, rename, move, trash and restore. Trash is reversible. Workdesk does not permanently purge files. Uploads are standard binary public-key-encrypted OpenPGP, MIME `application/pgp-encrypted`, `.pgp` names, and the same `workdeskPgp` / `keyFingerprint` app properties across clients. Uploads reject recognizable private-key files. Plain existing Drive files are labelled Plain and can also be downloaded. Google-native documents need export to an ordinary file in Google Drive first.

The current per-file limit is 64 MiB, processed one file at a time. Android's document picker selects upload sources and download destinations. After a successful authenticated decryption, a plaintext copy stays in app-private local cache even if saving/exporting is cancelled or fails. Clear it with **Clear local cache**. Saving a decrypted file to a cloud document provider explicitly creates a plaintext copy there; choose a local destination when that is not intended. Google can see file names, folder structure, sizes and metadata. Only file contents are PGP encrypted.

Disconnect retains keys and cache for later reconnection and allows a different Drive account. Other features' accounts and keys are separate. Uninstalling/clearing Android app data destroys its Keystore access; keep the offline key backup before doing either.

## Passphrases and key rotation

Change passphrases without changing fingerprints. Changing a passphrase on one device does not change another device's local copy. Unlock any older keys required by existing files before starting rotation. Enter the active key's current passphrase and the replacement key's new passphrase. Both keys are durably saved **before** rewriting any files.

Rotation covers all currently visible Workdesk-encrypted files, including trash. Each is downloaded, decrypted locally, encrypted to the replacement key, conditionally reuploaded and downloaded again for byte-for-byte verification. A final pass verifies every current encrypted file with the replacement private key before it becomes active. Old keys remain available for historical revisions and other copies. Cloud revision history is not rewritten.

Pause stops after the current file. Network failure/process death leaves both keys and the pending rotation record; resume with the same old and replacement passphrases. Keep Android foreground during lengthy transfers; there is no permanent background transfer service. Do not edit/upload from other devices during rotation. After completion, export the updated offline key backup and import it on every other device **before uploading there**. Retiring an old key checks current files with remaining unlocked keys but cannot cover historical cloud revisions, external copies or offline copies; retain it if any might be needed.

## Reproducible checks

```
npm run typecheck
npm test
npm run build
npm run test:drive-ui
node scripts/drive-crypto-compat.mjs prepare
.toolchains/gradle-8.11.1/bin/gradle -p android :app:testDebugUnitTest :app:assembleDebug \
  -PworkdeskDriveFixtureDir="$PWD/.test-build/drive-interop" --no-daemon --max-workers=2
node scripts/drive-crypto-compat.mjs verify
```

The fixtures generate synthetic keys, prove exact binary OpenPGP reconstruction and password-encrypted key-backup interoperability in both directions, and never access personal profiles. HTTP tests check query escaping, token refresh, conditional-update conflicts, upload destination validation and ciphertext-only media. Existing desktop tests exercise interrupted/resumed rotation, keyring failure, plaintext cache and folder-cycle handling.

On real devices, connect a test Drive account, generate/export/import keys as above, upload a known binary file on each platform and download it on the other. Compare `sha256sum` / Windows `Get-FileHash`. Test wrong passphrases, lock/unlock, rename/move/trash/restore, change passphrase, and interrupt/resume rotation with test files. Confirm the replacement fingerprint agrees after offline key transfer. Builds and fixtures do not prove actual Google consent, phone hardware or live-account transfers; those require a user-authorized real-device check.