Exception: Invalid argument: key

[aksm]

function getFirebaseService() {
  var scriptProperties = PropertiesService.getScriptProperties();
  var PRIVATE_KEY = scriptProperties.getProperty('FB_PRIVATE_KEY');
  var CLIENT_EMAIL = scriptProperties.getProperty('FB_CLIENT_EMAIL');

  return OAuth2.createService('Firebase')
    .setTokenUrl('https://accounts.google.com/o/oauth2/token')
    .setPrivateKey(PRIVATE_KEY)
    .setIssuer(CLIENT_EMAIL)
    .setPropertyStore(scriptProperties)
    .setScope('https://www.googleapis.com/auth/userinfo.email 
      https://www.googleapis.com/auth/firebase.database');
}

function updateFBase() {
  var service = getFirebaseService();
  service.reset();
  Logger.log(service.hasAccess());
  if (service.hasAccess()) {
    var fb = FirebaseApp.getDatabaseByUrl("https://wsy-calendar.firebaseio.com/", service.getAccessToken());
    fb.setData("users/" + "test", "testdata");  
  } else {
    Logger.log(service.getLastError());
  }

Using a service account for Firebase and following the sample, when I call service.hasAccess() I get false. service.getLastError() shows Exception: Invalid argument: key. The credentials are valid as I'm already successfully using them in a node application. Any thoughts on where I might be going wrong?

[erickoledadevrel]

I tried to reproduce this error, but I wasn't able to. I published a sample that works for me:

https://github.com/gsuitedevs/apps-script-oauth2/blob/master/samples/FirebaseDB.gs

It looks almost the same as what you have though, so I'm not sure what the problem would be.

[aksm]

@erickoledadevrel
I switched my code to match the linked sample more closely, and I'm no longer getting the Exception: Invalid argument: key, but I still get false for service.hasAccess() and the last error is undefined.

[erickoledadevrel]

It might be worth trying the code sample I linked to as-is, only using your keys. You can also look into downloading a copy of the library from the dist directory and using that in your script, so that you can insert additional logging statements to find out what's doing on.

[aksm]

@erickoledadevrel
Huh, maybe I had a typo somewhere. I used the sample as-is, and it worked. Thanks!

[jpvanoosten]

In case anyone else is experiencing this issue and spent days trying to solve it like me, I have some advice:

If you are using the PropertiesService to store the private key (with included new-line characters \n, then you must convert the \n characters in the key to the symbolic new-line character as shown in the snippet below:

var PRIVATE_KEY = PropertiesService.getScriptProperties().getProperty('private_key').replace(/\\n/g, '\n');

Notice the regular expression at the end to globally replace the characters \n into a valid new-line character.

After converting the \n character sequence to the symbolic newline character, the Utilities.computeRsaSha256Signature method was finally able to correctly generate the signature!

@erickoledadevrel Maybe it is a good addition to perform this regex on the private key in the Service_.setPrivateKey method? If the key doesn't contain the \n character sequence, the key should be unchanged but it will save a tonne of time for people using the PropertiesService to store the private key.

[erickoledadevrel]

Couldn't / shouldn't you just store the key with the newline characters, rather than do the replacement every time?

…

On Mon, Jul 1, 2019, 5:41 PM Jeremiah van Oosten ***@***.***> wrote: In case anyone else is experiencing this issue and spent days trying to solve it like me, I have some advice: If you are using the PropertiesService to store the private key (with included new-line characters \n, then you must convert the \n characters in the key to the symbolic new-line character as shown in the snippet below: var PRIVATE_KEY = PropertiesService.getScriptProperties().getProperty("private_key").replace(/\\n/g, "\n"); Notice the regular expression at the end to globally replace the characters \n into a valid new-line character. After converting the \n character sequence to the symbolic newline character, the Utilities.computeRsaSha256Signature method was finally able to correctly generate the signature! @erickoledadevrel <https://github.com/erickoledadevrel> Maybe it is a good addition to perform this regex on the private key in the Service_.setPrivateKey method? If the key doesn't contain the \n character sequence, the key should be unchanged but it will save a tonne of time for people using the PropertiesService to store the private key. — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#122>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AAHSBGASGFR53J4IF65UBLDP5J2YHANCNFSM4E6FVXGA> .

[jpvanoosten]

Apparently not. I kept getting the Invalid argument: key exception no matter what I did (no matter how many keys I generated).

When using literal strings, yes. You need the "\n" in the key string, but when using the PropertiesService, the \n character sequence gets converted to the literal character sequence \ + n which is an invalid character sequence in a private key. In order to convert the character sequence to a newline character, I needed to replace the \n with the new line character which is what the string.replace(/\\n/g, '\n') function does.

[erickoledadevrel]

How were you setting the property? If you via the Script Editor dialog, then you should change the \n to a newline character before you paste it into the dialog. If via code, then the \n should be converted for you.

[jpvanoosten]

I'm setting the property using the web based Google Apps Script editor:
File > Project properties > Script properties
Then I create a new row (using the "+ Add row" link) then I copy-paste the key from the private_key field from file generated key file for the Service account in the Google Cloud Platform project. If the key is copied as-is (with the \n characters) then the key is considered invalid. If I replace the \n character sequence with new lines from the key before pasting it into the Script properties dialog box, then I have the same issue (Exception: Invalid argument: key) most likely because the PropertyService removes the newline characters, or they are removed when saving the script properties. If I replace the \n character sequence with a new line character (using the regular expression as outlined in my initial comment) then it works perfectly.

Is this more clear now?

[erickoledadevrel]

Yes. The key in the JSON file you download is JSON-encoded, since you can't put a real newline character in the middle of a string value. You'd want to JSON-decode the value if copying and pasting it into the properties dialog, which is expecting a string that doesn't have any encoding.

How to deal with encodings and the script editor dialog is a bit outside the scope of this library, so I'll leave it out of the README, but hopefully this GitHub issue will help anyone else that runs across this issue.

[jpvanoosten]

I'm still relatively new to JavaScript programming. Can you suggest a better solution to handling the key value than what I previously suggested with the regular expression?

I'm not sure what you mean with:

You'd want to JSON-decode the value

I've tried replacing the \n character sequence with new line character before copying the value in the script properties dialog, but this caused the same Invalid argument: key issue as before. How else should I JSON-decode the string? (Or am I missing something. I'm still learning JavaScript).

[rahul101001000]

FWIW - Worked by adding the entire JSON from Firebase console as a Script Property called FIREBASE_SERVICE_ACCOUNT.

Value = {
  "type": "service_account",
  "project_id": "firebase-...",
  "private_key_id": "...",
  "private_key": "-----BEGIN PRIVATE KEY-----\n...\n-----END PRIVATE KEY-----\n",
  "client_email": "...@firebase-....iam.gserviceaccount.com",
  "client_id": "...",
  "auth_uri": "https://accounts.google.com/o/oauth2/auth",
  "token_uri": "https://oauth2.googleapis.com/token",
  "auth_provider_x509_cert_url": "https://www.googleapis.com/oauth2/v1/certs",
  "client_x509_cert_url": "..."
}

and then calling it as follows -
PropertiesService.getScriptProperties().getProperty('FIREBASE_SERVICE_ACCOUNT') const rsaKeyFromJson = serviceAccountData.private_key;

Here is the full code that works -

var CLIENT_EMAIL = '...@firebase-....iam.gserviceaccount.com';

const serviceAccountData = JSON.parse(
  PropertiesService.getScriptProperties().getProperty('FIREBASE_SERVICE_ACCOUNT')
)
const rsaKeyFromJson = serviceAccountData.private_key;

/**
 * Authorizes and makes a request to a Firebase Database.
 */
function run() {
  var service = getService_();
  if (service.hasAccess()) {
    var url = 'https://' + PROJECT_ID + '.firebaseio.com/.json?shallow=true';
    var response = UrlFetchApp.fetch(url, {
      headers: {
        Authorization: 'Bearer ' + service.getAccessToken()
      }
    });
    var result = JSON.parse(response.getContentText());
    Logger.log(JSON.stringify(result, null, 2));
  } else {
    Logger.log(service.getLastError());
  }
}

/**
 * Reset the authorization state, so that it can be re-tested.
 */
function reset() {
  var service = getService_();
  service.reset();
}

/**
 * Configures the service.
 */
function getService_() {
  return OAuth2.createService('FirebaseDB')
      // Set the endpoint URL.
      .setTokenUrl('https://accounts.google.com/o/oauth2/token')

      // Set the private key and issuer.
      .setPrivateKey(rsaKeyFromJson)
      .setIssuer(CLIENT_EMAIL)

      // Set the property store where authorized tokens should be persisted.
      .setPropertyStore(PropertiesService.getScriptProperties())

      // Set the scope and additional Google-specific parameters.
      .setScope([
        'https://www.googleapis.com/auth/userinfo.email',
        'https://www.googleapis.com/auth/firebase.database'
      ]);
}