http wrapper to automatically refresh token when talking to google #522

scottburch · 2012-12-04T06:49:39Z

Example use:

   Accounts.oauth2.http.get(Accounts.oauth2.http.GOOGLE, url, {});

scottburch · 2012-12-04T23:53:56Z

The way this works is that it makes the request, if it receives a 401 back it then refreshes the token and resends the request. There was a suggestion that we use the seconds given when we receive the token, but I thought this was more reliable than assuming that the token was good or bad. Google sends the 401 if it is bad and that way it is caught no matter why it is bad (revoked auth...)

joscha · 2012-12-05T03:23:05Z

@avital @scottburch When authenticating against Google, together with the accessToken, a number of seconds is given when the accessToken expires - is the resulting time (now + timeoutSeconds) saved somewhere? Because the refreshToken does only need to be used once the accesToken is not valid any more, hence when requests are made while it is still valid, numerous requests to get a new accessToken through the refreshToken can be saved.

scottburch · 2012-12-05T04:41:17Z

I'm not convinced that this is true. I only get a new accessToken if I receive a 401. Otherwise, i return the response from google.

scottburch · 2012-12-05T04:42:20Z

If I use the timeout, then what happens if authorization gets revoked for some other reason. The code would break.

joscha · 2012-12-05T05:02:02Z

@scottburch are these answers targeted at my comment? If yes, I don't get them - my comment is talking about when the refreshToken needs to be used. The piece of code that determines whether the accessToken needs to be refreshed would also get a new accessToken if the token has been otherwise revoked. The only reason the time is needed is, to determine whether it even makes sense to try and use the accesToken at all.

scottburch · 2012-12-05T05:12:24Z

Yes, my comment is regarding your comment. What am I missing? I guess I was confused by your comment. How does the accessToken timeout affect the requests that are made? Is this just a requirement for your code? How does it affect THIS pull request?

joscha · 2012-12-05T10:15:46Z

@scottburch sorry for the confusion, @avital told me to carry this comment over from #464, which has been closed already.

joscha · 2012-12-05T10:19:35Z

And to clarify - the current pull request is always making a request, right? In X% of the cases this might not be necessary though (exactly, when we are still within time X and X+deltaValiditySeconds) because the accessToken does not need to be updated, because it is still valid. Only if its not valid any more (after X+deltaValiditySeconds) it needs to be refreshed. So storing the delta somewhere would not only make sense for my use case, but also for this pull request here. It would be an optimization.

scottburch · 2012-12-05T10:25:52Z

Read my comments. I don't think the code works that way. It is not 2X. It only updates the token when it is needed.

joscha · 2012-12-05T10:30:30Z

I read your comments. I just don't think its a good idea to make that initial request. The lifetime is given for a reason. It is given so you don't need to make that first request. Requests are expensive, if there is a way save the overhead doing one, it should be done in my eyes.

joscha · 2012-12-05T10:39:03Z

Sorry, I think I am the one that is causing confusion here here. The pull request is perfectly valid. It just makes the request whenever a 401 came back.

My initial comment was added because I want to use the accessToken to access a GMail account with it. It has nothing to do with an HTTP request. Therefore I need to know the time when the accessToken expires, hence I want the lifetime (or more specifically now()+liefetime) to be saved, so I can just use the accessToken and only refresh it if its expired before accessing GMail via IMAP. I don't think this pull request is the right place for this. Sorry again.

scottburch · 2012-12-05T10:44:50Z

No problem. Glad it is clear.

I'm doing the same thing with IMAP. I don't think that the OAUTH token is necessary for IMAP. I have not had any problems with that.

joscha · 2012-12-05T10:56:08Z

@scottburch Sorry, for this slight offtopic question, but how are you generating the XOAuth2 token to pass on to GMail xoauth2 if not with the accessToken or refreshToken?

kenyee · 2013-04-05T03:10:35Z

I think we need more than this.

Use case is: I want to use Google or Facebook APIs but let this package manage the logins.
So what I want is a blocking method named getAccessToken on the user service.
e.g., userobj.services['google'].getAccessToken()
so I can use it for calls into the API. Ideally, this would refresh the token for me (and block until it finishes) or return null if it fails.

I'm doing this now, but managing the refresh in my code that uses Google APIs...but OAuth is supposed to make the tokens expire automatically for any service...

kynan · 2013-09-29T07:41:06Z

Is there anything blocking this being merged? I think this is a crucial missing feature and I always use @scottburch's code in my meteor apps to refresh tokens. Would be great if this was built in.

ninajlu · 2013-10-15T19:36:35Z

I would also like this to be merged. @scottburch @kynan Since this isn't merged yet, do I have to download the source code for meteor and replace packages/accounts-oauth2-helper/oauth2_server.js with Scott's code in order to use it?

kynan · 2013-10-16T09:57:21Z

@ninajlu You can also integrate the relevant bits of @scottburch's code into your app. That's what I've been doing.

ryw · 2013-10-20T14:14:26Z

@kynan are you integrating this with recent version of meteor? if so, have gist?

A while back, Avital referenced this PR on meteor-talk - looking for an updated PR https://groups.google.com/d/msg/meteor-talk/fyFy3hsZVA4/zABQUDo_aGQJ

I've got an app with problem with expired token accessing Google API, so I'm looking for solution on this to get into Meteor, or a package for now that adds the functionality.

kynan · 2013-10-20T15:23:00Z

@ryw I've been using Meteor 0.6.5 but I'm not on the Meteor team and have no say on what gets integrated and what doesn't. I'm only lobbying for this to get merged since I think it's a really useful feature.

I'm using the last 4 functions from @scottburch's pull request and whenever a Google OAuth call fails I check for a 401. If I get one, I call getNewAccessToken to get a new token, update it in the user document and repeat the call. I can try to extract the relevant bits from my code and boil it down to a gist.

ryw · 2013-10-21T02:34:42Z

@kynan ah so you are handling the 401 within your app?

Here's the code I use to read future events from Google Calendar + create objects in my project — would love to see how your code could handle the 401 + refresh token.

Meteor.startup ->
  Meteor.methods

    importGoogleEvents: (userId) ->
      email = Meteor.user().services.google.email
      token = Meteor.user().services.google.accessToken
      date = (new Date()).toISOString()

      url = "https://www.googleapis.com/calendar/v3/calendars/"
      url += "#{email}/events?timeMin=#{date}&access_token=#{token}"

      Meteor.http.get url, (err, res) ->
        params = {}
        if err
          console.log err
        else
          console.log "imported events for " + userId
          Events.remove userId: userId
          _.each res.data.items, (element, index, events) ->
            params.googleId = element.id
            params.status = element.status
            params.location = element.location
            params.start = element.start.dateTime
            params.end = element.end.dateTime
            params.url = element.htmlLink
            params.title = element.summary
            params.attendees = element.attendees
            params.allDay = false
            params.userId = userId
            Events.insert params

kynan · 2013-10-22T00:33:30Z

@ryw Like this:

Meteor.startup ->
  Meteor.methods

    refreshOAuthToken: (service) ->
      getNewAccessToken = (service) ->
        result = Meteor.http.post(service.url, {headers: {'Content-Type': 'application/x-www-form-urlencoded'}, content: oAuthRefreshBody(service)})
        return result.data?.access_token
      oAuthRefreshBody = (service) ->
        loginServiceConfig = Accounts.loginServiceConfiguration.findOne({service: service.name});
        return 'refresh_token=' + Meteor.user().services[service.name].refreshToken +
            '&client_id=' + loginServiceConfig.clientId +
            '&client_secret=' + loginServiceConfig.secret +
            '&grant_type=refresh_token'
      storeNewAccessToken = (service, newAccessToken) ->
        o = {}
        o['services.' + service.name + '.accessToken'] = newAccessToken
        Meteor.users.update Meteor.userId(), {$set: o}
      token = getNewAccessToken service
      console.log "Got new access token #{token} for", service
      storeNewAccessToken service, token
      return token

    importGoogleEvents: (userId, token) ->
      email = Meteor.user().services.google.email
      token = Meteor.user().services.google.accessToken
      date = (new Date()).toISOString()

      url = "https://www.googleapis.com/calendar/v3/calendars/"
      url += "#{email}/events?timeMin=#{date}&access_token=#{token}"

      Meteor.http.get url, (err, res) ->
        params = {}
        if !err
          console.log "imported events for " + userId
          Events.remove userId: userId
          _.each res.data.items, (element, index, events) ->
            params.googleId = element.id
            params.status = element.status
            params.location = element.location
            params.start = element.start.dateTime
            params.end = element.end.dateTime
            params.url = element.htmlLink
            params.title = element.summary
            params.attendees = element.attendees
            params.allDay = false
            params.userId = userId
            Events.insert params
        else if err.response.statusCode == 401
          # Refresh OAuth token if it has expired. Simplified version of
          # https://github.com/meteor/meteor/pull/522
          Meteor.call 'refreshOAuthToken',
            {name: 'google', url: 'https://accounts.google.com/o/oauth2/token'},
            (err, token) ->
              importGoogleEvents userId, token if !err
              console.log err if err
        else
          console.log err

ryw · 2013-10-26T17:54:26Z

@kynan thanks Florian - just implemented the code, need to wait for an expiration :)

ryw · 2013-10-28T15:33:56Z

Not working for me yet... see invalid_grant error before @kynan?

Error:

Exception in callback of Meteor.http.call Error: failed [400] {   "error" : "invalid_grant" }
    at Object.Future.wait (/mnt/data/2/node_modules/fibers/future.js:322:15)
    at Object.Meteor.http.call (app/packages/http/httpcall_server.js:125:16)
    at Object.Meteor.http.post (app/packages/http/httpcall_common.js:78:27)
    at getNewAccessToken (app/server/user/importGoogleEvents.coffee.js:12:32)
    at refreshOAuthToken (app/server/user/importGoogleEvents.coffee.js:37:17)
    at app/server/user/importGoogleEvents.coffee.js:71:20
    at Meteor.bindEnvironment.runWithEnvironment (app/packages/meteor/dynamics_nodejs.js:68:24)
    - - - - -
    at Object.Meteor.http._makeErrorByStatus (app/packages/http/httpcall_common.js:15:10)
    at Request.Meteor.http.call [as _callback] (app/packages/http/httpcall_server.js:116:29)
    at Request.init.self.callback (/mnt/data/2/node_modules/request/main.js:122:22)
    at Request.EventEmitter.emit (events.js:99:17)
    at Request.<anonymous> (/mnt/data/2/node_modules/request/main.js:661:16)
    at Request.EventEmitter.emit (events.js:126:20)
    at IncomingMessage.Request.start.self.req.self.httpModule.request.buffer (/mnt/data/2/node_modules/request/main.js:623:14)
    at IncomingMessage.EventEmitter.emit (events.js:126:20)
    at IncomingMessage._emitEnd (http.js:367:10)
    at HTTPParser.parserOnMessageComplete [as onMessageComplete] (http.js:149:23)

My code:

Meteor.startup ->
  Meteor.methods

    importGoogleEvents: (userId, token) ->
      refreshOAuthToken = (service) ->
        getNewAccessToken = (service) ->
          result = Meteor.http.post(service.url, {headers: {'Content-Type': 'application/x-www-form-urlencoded'}, content: oAuthRefreshBody(service)})
          return result.data?.access_token
        oAuthRefreshBody = (service) ->
          loginServiceConfig = Accounts.loginServiceConfiguration.findOne({service: service.name});
          return 'refresh_token=' + Meteor.user().services[service.name].refreshToken +
              '&client_id=' + loginServiceConfig.clientId +
              '&client_secret=' + loginServiceConfig.secret +
              '&grant_type=refresh_token'
        storeNewAccessToken = (service, newAccessToken) ->
          o = {}
          o['services.' + service.name + '.accessToken'] = newAccessToken
          Meteor.users.update Meteor.userId(), {$set: o}
        token = getNewAccessToken service
        console.log "Got new access token #{token} for", service
        storeNewAccessToken service, token
        return token

      email = Meteor.user().services.google.email
      token = Meteor.user().services.google.accessToken
      date = (new Date()).toISOString()

      url = "https://www.googleapis.com/calendar/v3/calendars/"
      url += "#{email}/events?timeMin=#{date}&access_token=#{token}"

      Meteor.http.get url, (err, res) ->
        params = {}
        if !err
          console.log "imported events for " + userId
          Events.remove userId: userId
          _.each res.data.items, (element, index, events) ->
            params.googleId = element.id
            params.status = element.status
            params.location = element.location
            params.start = element.start.dateTime
            params.end = element.end.dateTime
            params.url = element.htmlLink
            params.title = element.summary
            params.attendees = element.attendees
            params.allDay = false
            params.userId = userId
            Events.insert params
        else
          if err.response.statusCode is 401
            # Refresh OAuth token if it has expired. Simplified version of
            # https://github.com/meteor/meteor/pull/522
            refreshOAuthToken
              name: 'google'
              url: 'https://accounts.google.com/o/oauth2/token'
              (err, token) ->
                importGoogleEvents userId, token if !err
                console.log err if err
          else
            console.log err

/cc cfly15

kynan · 2013-10-29T08:32:41Z

@ryw Haven't seen this one before, but maybe you haven't requested the offline permission for your app? That's required for being able to use refresh tokens.

ryw · 2013-10-30T14:34:07Z

Yay!

Got new access token ya29.AHES6ZTIXKx4eT4Qka7B1w6redactedANpa__B_vkXeklOXP for { name: 'google',
  url: 'https://accounts.google.com/o/oauth2/token' }

Trick was to set requestOfflineToken to true in Accounts.ui.config

Accounts.ui.config
  requestPermissions:
    google: ['openid email https://www.googleapis.com/auth/calendar']
  requestOfflineToken:
    google: true

robertpitt · 2015-01-19T11:15:23Z

Is this still on the agenda to be merged?

glasser · 2015-02-20T20:34:44Z

Well, the PR appears to be out of date, for one (it doesn't merge cleanly).

kynan · 2015-02-21T12:58:14Z

@glasser no surprise after more than 2 years!

stubailo · 2015-10-13T17:53:34Z

I don't think this is likely to be merged, and seems like something that could easily be a package anyway.

robertpitt · 2015-10-15T15:02:42Z

As an FYI on this, my solution was to create a package that managed the access tokens of various providers.

https://gist.github.com/robertpitt/5f0a9286a1a52d58bb18

…g-2.14.0 Update validate-commit-msg to the latest version 🚀

http wrapper to automatically refresh token when talking to google

500b674

scottburch mentioned this pull request Dec 4, 2012

Oauth refresh token #495

Closed

avital mentioned this pull request Dec 4, 2012

Google offline #464

Closed

joscha mentioned this pull request Dec 5, 2012

Store the accessToken expiration #525

Closed

Slava force-pushed the devel branch from dc8bbc3 to e5104bf Compare October 1, 2014 05:26

Slava force-pushed the devel branch from e5104bf to 81565b1 Compare October 1, 2014 05:28

benjamn force-pushed the devel branch from 893e4b4 to 368cd01 Compare October 13, 2014 18:25

glasser added Project:Accounts:OAuth Type:Feature labels Jan 30, 2015

hipstersmoothie mentioned this pull request Jun 2, 2015

Google idle Account hipstersmoothie/kikbak.tv-v2#1

Closed

stubailo closed this Oct 13, 2015

snyk-bot mentioned this pull request Jul 15, 2021

[Snyk] Upgrade xml2js from 0.4.19 to 0.4.23 ekmixon/meteor#2

Open

StorytellerCZ pushed a commit that referenced this pull request Sep 18, 2021

Merge pull request #522 from dferber90/greenkeeper/validate-commit-ms…

3df2988

…g-2.14.0 Update validate-commit-msg to the latest version 🚀

StorytellerCZ pushed a commit that referenced this pull request Oct 1, 2021

Typo # instead of . (#522)

083a331

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

http wrapper to automatically refresh token when talking to google #522

http wrapper to automatically refresh token when talking to google #522

scottburch commented Dec 4, 2012

scottburch commented Dec 4, 2012

joscha commented Dec 5, 2012

scottburch commented Dec 5, 2012

scottburch commented Dec 5, 2012

joscha commented Dec 5, 2012

scottburch commented Dec 5, 2012

joscha commented Dec 5, 2012

joscha commented Dec 5, 2012

scottburch commented Dec 5, 2012

joscha commented Dec 5, 2012

joscha commented Dec 5, 2012

scottburch commented Dec 5, 2012

joscha commented Dec 5, 2012

kenyee commented Apr 5, 2013

kynan commented Sep 29, 2013

ninajlu commented Oct 15, 2013

kynan commented Oct 16, 2013

ryw commented Oct 20, 2013

kynan commented Oct 20, 2013

ryw commented Oct 21, 2013

kynan commented Oct 22, 2013

ryw commented Oct 26, 2013

ryw commented Oct 28, 2013

kynan commented Oct 29, 2013

ryw commented Oct 30, 2013

robertpitt commented Jan 19, 2015

glasser commented Feb 20, 2015

kynan commented Feb 21, 2015

stubailo commented Oct 13, 2015

robertpitt commented Oct 15, 2015

http wrapper to automatically refresh token when talking to google #522

http wrapper to automatically refresh token when talking to google #522

Conversation

scottburch commented Dec 4, 2012

scottburch commented Dec 4, 2012

joscha commented Dec 5, 2012

scottburch commented Dec 5, 2012

scottburch commented Dec 5, 2012

joscha commented Dec 5, 2012

scottburch commented Dec 5, 2012

joscha commented Dec 5, 2012

joscha commented Dec 5, 2012

scottburch commented Dec 5, 2012

joscha commented Dec 5, 2012

joscha commented Dec 5, 2012

scottburch commented Dec 5, 2012

joscha commented Dec 5, 2012

kenyee commented Apr 5, 2013

kynan commented Sep 29, 2013

ninajlu commented Oct 15, 2013

kynan commented Oct 16, 2013

ryw commented Oct 20, 2013

kynan commented Oct 20, 2013

ryw commented Oct 21, 2013

kynan commented Oct 22, 2013

ryw commented Oct 26, 2013

ryw commented Oct 28, 2013

kynan commented Oct 29, 2013

ryw commented Oct 30, 2013

robertpitt commented Jan 19, 2015

glasser commented Feb 20, 2015

kynan commented Feb 21, 2015

stubailo commented Oct 13, 2015

robertpitt commented Oct 15, 2015