[google_sign_in] Add server auth code retrieval to gis_client

[T-P-F]

Adds the ability for a Flutter web app to request a server auth code via gis through a web-only method.

Reference docs:

• https://developers.google.com/identity/oauth2/web/guides/use-code-model
• https://developers.google.com/identity/oauth2/web/reference/js-reference#google.accounts.oauth2.initCodeClient

Also: adds a web_only.dart library that allows programmers to call web-only methods conveniently, without having to dive into the Platform.instance (which has a ton of methods that we don't want users to call for sure!), like this:

import 'package:google_sign_in_web/web_only.dart' as web;

/// Renders a web-only Sign-In button.
Widget buildSignInButton({HandleSignInFn? _}) {
  return web.renderButton();
}

Instead of:

packages/packages/google_sign_in/google_sign_in/example/lib/src/sign_in_button/web.dart

Lines 12 to 15 in a682189

	Widget buildSignInButton({HandleSignInFn? onPressed}) {
	return (GoogleSignInPlatform.instance as web.GoogleSignInPlugin)
	.renderButton();
	}

Issues

• Fixes Google Sign In 4.5.1 - ServerAuthCode returns null value for Web flutter#62474

Tests

• Added tests to ensure plugin calls hit the GIS API when appropriate.

Pre-launch Checklist

• I read the [Contributor Guide] and followed the process outlined there for submitting PRs.
• I read the [Tree Hygiene] wiki page, which explains my responsibilities.
• I read and followed the [relevant style guides] and ran the auto-formatter. (Unlike the flutter/flutter repo, the flutter/packages repo does use dart format.)
• I signed the [CLA].
• The title of the PR starts with the name of the package surrounded by square brackets, e.g. [shared_preferences]
• I listed at least one issue that this PR fixes in the description above.
• I updated pubspec.yaml with an appropriate new version according to the [pub versioning philosophy], or this PR is [exempt from version changes].
• I updated CHANGELOG.md to add a description of the change, [following repository CHANGELOG style].
• I updated/added relevant documentation (doc comments with ///).
• I added new tests to check the change I am making, or this PR is [test-exempt].
• All existing and new tests are passing.

[flutter-dashboard]

It looks like this pull request may not have tests. Please make sure to add tests before merging. If you need an exemption to this rule, contact Hixie or stuartmorgan on the #hackers channel in Chat (don't just cc them here, they won't see it! Use Discord!).

If you are not sure if you need tests, consider this rule of thumb: the purpose of a test is to make sure someone doesn't accidentally revert the fix. Ask yourself, is there anything in your PR that you feel it is important we not accidentally revert back to how it was before your fix?

Reviewers: Read the Tree Hygiene page and make sure this patch meets those guidelines before LGTMing.

[ditman]

Thanks for solving the conflicts with the latest main!

[ditman]

We'll need 2 reviewers, since this is @T-P-F's first contribution. Pinging @stuartmorgan for when he has a minute!

[T-P-F]

@ditman thanks for the additions to the PR 🙏

[stuartmorgan]

We'll need 2 reviewers, since this is @T-P-F's first contribution.

FYI this is true for all PRs from contributors who are not Flutter team members (i.e., people with commit access), regardless of whether it's the first PR.

(I'll add this to my review queue.)

[ditman]

LGTM on my end!

(We could add a small section to the README on how to use the web_only library maybe? I'm planning on updating the example app regardless.)

[T-P-F]

@ditman @stuartmorgan what's a realistic timeline for finishing review of this PR?

[stuartmorgan]

LGTM

[kevmoo]

Great fix @T-P-F !! 👏👏👏

[ditman]

Yay! I need to update the example to use the new user-facing web-only API!

[wreppun]

Looks like there's no way (AFAIK) to modify the scopes for serverAuthCode retrieval (to allow incremental authorization)?

Once the scopes are set in initWithParams, there isn't even a way to change them by re-initializing the entire _gisClient (because there's no way to re-initialize the _gisClient in google_sign_in_web).

Is incremental authorization possible at this moment?

Would the preferred approach be to accept an optional list of scopes in requestServerAuthCode and to then re-init the _codeClient within that method (if scopes are present)?

Use case:

• User signs in, with no required scopes (authentication only)
• User wants to use a feature which requires a serverAuthCode
• User is prompted for authorization for that specific service/permissions (currently not possible, AFAIK)

Happy to split this out into a bug report; just not sure if I'm missing something here.

[wreppun]

Whoops, just found this: flutter/flutter#139406