[supply] added support for refresh tokens as an authentication method #16414

moly · 2020-05-01T14:48:54Z

Checklist

I've run bundle exec rspec from the root directory to see all new and existing tests pass
I've followed the fastlane code style and run bundle exec rubocop -a to ensure the code style is valid
I've read the Contribution Guidelines
I've updated the documentation if necessary.

Motivation and Context

Resolves issue #16352. In some corporate setups the play store page is not owned/managed internally, which can make it difficult to get access to the service account. Adding support for alternative authentication methods would make fastlane more useful in these situations.

Description

Adds two new parameters to the supply action, json_token and json_token_data. The former allows the user to provide a path to a json file containing the refresh token data, while the latter allows specifying the raw refresh token string directly. If either of these parameters are present, the supply client will use Google::Auth::UserRefreshCredentials.make_creds() to authenticate with the play store api.

Testing Steps

Generate a refresh token using the steps here: https://developers.google.com/android-publisher/authorization#generating_a_refresh_token

Create a json file with the following format:

{
  "grant_type" : "refresh_token",
  "client_id" : <the client ID token created in the APIs Console>,
  "client_secret" : <the client secret corresponding to the client ID>,
  "refresh_token" : <the refresh token from the previous step>
}

Run: bundle exec fastlane supply --json-token /path/to/json

You can also specify the parameter using the SUPPLY_JSON_TOKEN environment variable or by setting json_token_file in your AppFile.

…fastlane#16352)

googlebot · 2020-05-01T14:48:58Z

Thanks for your pull request. It looks like this may be your first contribution to a Google open source project (if not, look below for help). Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

📝 Please visit https://cla.developers.google.com/ to sign.

Once you've signed (or fixed any issues), please reply here with @googlebot I signed it! and we'll verify it.

What to do if you already signed the CLA

Individual signers

It's possible we don't have your GitHub username or you're using a different email address on your commit. Check your existing CLA data and verify that your email is set on your git commits.

Corporate signers

Your company has a Point of Contact who decides which employees are authorized to participate. Ask your POC to be added to the group of authorized contributors. If you don't know who your Point of Contact is, direct the Google project maintainer to go/cla#troubleshoot (Public version).
The email used to register you as an authorized contributor must be the email used for the Git commit. Check your existing CLA data and verify that your email is set on your git commits.
The email used to register you as an authorized contributor must also be attached to your GitHub account.

ℹ️ Googlers: Go here for more info.

moly · 2020-05-01T14:50:58Z

@googlebot I signed it!

googlebot · 2020-05-01T14:51:00Z

CLAs look good, thanks!

ℹ️ Googlers: Go here for more info.

janpio · 2020-05-02T20:15:37Z

Nice.

Is json_token the right name for this?

moly · 2020-05-02T20:36:19Z

I named it json_token to keep in line with the existing json_key parameter. I'm happy to change it if you have any suggestions?

joshdholtz

This is super cool! I wasn’t able to get this to work tonight. I got an error of [!] Google Api Error: forbidden: The caller does not have permission - The caller does not have permission. So that is probably on me somehow but I’m not sure exactly what yet. But I did leave some questions and requested some changes 😊

Thanks for all the work on this!

joshdholtz · 2020-05-12T02:31:01Z

supply/lib/supply/options.rb

@@ -116,6 +117,35 @@ def self.available_options
                                         UI.user_error!("Could not parse service account json  JSON::ParseError")
                                       end
                                     end),
+        FastlaneCore::ConfigItem.new(key: :json_token,


I think it make sense to call this refresh_token. json_token is a bit to similar to json_key and I think it would cause some confusion 😊

joshdholtz · 2020-05-12T02:31:18Z

supply/lib/supply/options.rb

+                                       UI.user_error!("Could not find refresh token json file at path '#{File.expand_path(value)}'") unless File.exist?(File.expand_path(value))
+                                       UI.user_error!("'#{value}' doesn't seem to be a JSON file") unless FastlaneCore::Helper.json_file?(File.expand_path(value))
+                                     end),
+        FastlaneCore::ConfigItem.new(key: :json_token_data,


And this be refresh_token_data

joshdholtz · 2020-05-12T02:31:56Z

supply/lib/supply/options.rb

+                                     optional: true,
+                                     description: "The path to a file containing refresh token JSON, used to authenticate with Google",
+                                     code_gen_sensitive: true,
+                                     default_value: CredentialsManager::AppfileConfig.try_fetch_value(:json_token_file),


This should look for same name as the option so refresh_token

joshdholtz · 2020-05-12T02:32:08Z

supply/lib/supply/options.rb

+                                     optional: true,
+                                     description: "The raw refresh token JSON data used to authenticate with Google",
+                                     code_gen_sensitive: true,
+                                     default_value: CredentialsManager::AppfileConfig.try_fetch_value(:json_token_data_raw),


And this refresh_token_data

joshdholtz · 2020-05-12T02:32:31Z

credentials_manager/lib/credentials_manager/appfile_config.rb

@@ -132,6 +132,14 @@ def json_key_data_raw(*args, &block)
      setter(:json_key_data_raw, *args, &block)
    end

+    def json_token_file(*args, &block)


refresh_token

joshdholtz · 2020-05-12T02:32:39Z

credentials_manager/lib/credentials_manager/appfile_config.rb

+      setter(:json_token_file, *args, &block)
+    end
+
+    def json_token_data_raw(*args, &block)


refresh_token_data

joshdholtz · 2020-05-12T02:34:15Z

supply/lib/supply/client.rb

+      if params[:json_token] || params[:json_token_data]
+        auth_client = Google::Auth::UserRefreshCredentials.make_creds(json_key_io: service_account_json, scope: self.class::SCOPE)
+      else
+        auth_client = Google::Auth::ServiceAccountCredentials.make_creds(json_key_io: service_account_json, scope: self.class::SCOPE)


This method is now failing for with NoMethodError: [!] undefined method gsub' for nil:NilClass `. Did this break for you?

Good catch, I'd accidentally caused service_account_authentication to return nil when using a json key. Should be fixed now.

moly · 2020-05-12T17:54:04Z

Renamed all instances of json_token and json_token_data to refresh_token and refresh_token_data` as requested.

joshdholtz · 2020-05-12T18:58:30Z

@moly Thanks for making those changes! Do you have any idea what could be causing my permission issue I mentioned above? 😇 I’m stumped lol

moly · 2020-05-12T20:12:15Z

@joshdholtz does your Google account have the right permissions for the android project you're using? It might need to have the "release manager" role or higher. I'll check my setup tomorrow and provide better step by step instructions.

moly · 2020-05-13T11:11:13Z

@joshdholtz I set up a new app today and couldn't reproduce your permission issue. Based on the error message, the only things I could think of is that either the google account you're using doesn't have the right permissions for the play store app you're targeting, or you didn't allow access to the api project on the oauth consent screen correctly. Here's the steps I used, my google account is the owner of the play store app.

Go to https://play.google.com/apps/publish/#ApiAccessPlace. Click "Create OAuthClient"
If you haven't before you may need to create an oauth consent screen. You can give it a name but leave everything else as it is and click save.
https://play.google.com/apps/publish/#ApiAccessPlace should now show "Google Play Android Developer" under linked projects and a new client under "OAuth Clients". Under "OAuth Clients" click "view in Google Developers Console", then click "Google Play Android Developer" under "OAuth 2.0 Client IDs". You should be able to see the client ID and client secret.
Go to the following url, replacing YOUR_CLIENT_ID with the client ID from the last step: https://accounts.google.com/o/oauth2/auth?scope=https://www.googleapis.com/auth/androidpublisher&response_type=code&access_type=offline&redirect_uri=urn:ietf:wg:oauth:2.0:oob&client_id=YOUR_CLIENT_ID
Click to allow the Google Play Android Developer project permission to manage your android apps.
You should get redirected to a page with an authorisation code. Run the following command:
curl -s -d "grant_type=authorization_code&code=YOUR_AUTHORISATION_CODE&client_id=YOUR_CLIENT_ID&client_secret=YOUR_CLIENT_SECRET&redirect_uri=urn:ietf:wg:oauth:2.0:oob" -X POST https://accounts.google.com/o/oauth2/token
The response should contain your refresh token. Create a json file with the following format:
{ "grant_type" : "refresh_token", "client_id" : "YOUR_CLIENT_ID", "client_secret" : "YOUR_CLIENT_SECRET", "refresh_token" : "YOUR_REFRESH_TOKEN" }
Save the json somewhere in the project directory, then run fastlane supply init --refresh-token path/to/refresh_token.json.

moly · 2020-05-13T17:06:21Z

Refactored a little to fix some failing tests

…vided

[supply] added support for refresh tokens as an authentication method (…

4262381

…fastlane#16352)

googlebot added the cla: no label May 1, 2020

googlebot added cla: yes and removed cla: no labels May 1, 2020

[supply] fixed rubocop error

2e60af8

janpio added the tool: supply upload_to_playstore label May 2, 2020

janpio changed the title ~~[supply] added support for refresh tokens as an authentication method (#16352)~~ [supply] added support for refresh tokens as an authentication method May 2, 2020

joshdholtz requested changes May 12, 2020

View reviewed changes

moly added 3 commits May 12, 2020 18:00

renamed json_token to refresh_token in supply

1c9fa04

fixed exception when using json_key with supply

2b254f3

removed empty line at method body end

26ba39d

moly added 2 commits May 13, 2020 15:51

fixed exception when Client is created without any supply parameters

f810006

refactored refresh_token supply code to fix failing tests

3277fbf

fixed error message not showing when no authentication parameters pro…

4167a1f

…vided

fastlane-bot added the status: needs-attention label May 15, 2020

Merge branch 'master' into json_token

28d82aa

nrbrook mentioned this pull request Jun 5, 2020

fastlane sigh repair doesn't work #16573

Closed

4 tasks

perfectdim mentioned this pull request Apr 13, 2022

update_project_provisioning failed #20172

Closed

4 tasks

saifudheenvk mentioned this pull request Apr 27, 2023

upload': \e[31m[!] undefined method first' for nil:NilClass\e[0m (NoMethodError) on fastlane version 2.212.2 #21236

Open

mapierce mentioned this pull request Aug 22, 2023

Trainer not working with Xcode 15 beta 6 #21475

Closed

4 tasks

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[supply] added support for refresh tokens as an authentication method #16414

[supply] added support for refresh tokens as an authentication method #16414

moly commented May 1, 2020

googlebot commented May 1, 2020

moly commented May 1, 2020

googlebot commented May 1, 2020

janpio commented May 2, 2020

moly commented May 2, 2020

joshdholtz left a comment

joshdholtz May 12, 2020

joshdholtz May 12, 2020

joshdholtz May 12, 2020

joshdholtz May 12, 2020

joshdholtz May 12, 2020

joshdholtz May 12, 2020

joshdholtz May 12, 2020

moly May 12, 2020

moly commented May 12, 2020

joshdholtz commented May 12, 2020

moly commented May 12, 2020

moly commented May 13, 2020

moly commented May 13, 2020

[supply] added support for refresh tokens as an authentication method #16414

Are you sure you want to change the base?

[supply] added support for refresh tokens as an authentication method #16414

Conversation

moly commented May 1, 2020

Checklist

Motivation and Context

Description

Testing Steps

googlebot commented May 1, 2020

What to do if you already signed the CLA

Individual signers

Corporate signers

moly commented May 1, 2020

googlebot commented May 1, 2020

janpio commented May 2, 2020

moly commented May 2, 2020

joshdholtz left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

moly commented May 12, 2020

joshdholtz commented May 12, 2020

moly commented May 12, 2020

moly commented May 13, 2020

moly commented May 13, 2020