Google calendar API key needed in nodejs.dev

[benhalverson]

Can someone add a GCal api key for the nodejs.dev repo to the Github secrets?

It's the last thing needed for this open PR.nodejs/nodejs.dev#1713

The current key belongs to the dev that was working on this feature for demo purposes.

[bnb]

cc @mhdawson maybe?

[mhdawson]

I'll need a bit more context in terms of the steps needed to get a GCal api key and how it where/how it needs to be added.

[lancemccluskey]

Initially, I thought adding it as a GitHub secret would work. I realized it would still expose the api key tho because we’re making the call from the client side. What if we utilized a firebase function and stored the key in fire store ? Kinda like the answer to this stack overflow

also, I think @brianwarner has the api key we’re looking for.

[lancemccluskey]

Expanding upon my idea, im thinking steps could be:

1. Create a firestore database holding the API key
2. Write a firebase function calling the Google calendar API and returning the events
3. Call the firebase function from the nodejs.dev repo

This gives us the advantages of not exposing the API key in a prod environment, its not stored in github at all, and if we add in more api calls that require authentication we can add them in as firebase functions.

@benhalverson @bnb @mhdawson thoughts?

Links:

• firebase functions
• firestore

In the future, this could be automated too using the APIs for firebase. We could update the firestore and firebase functions in a GitHub action for example. Maybe even store the firebase functions in the nodejs.dev repo. Then the only manual part would be adding API keys to firestore as we need to.

[mhdawson]

I'm not sure how the existing calendar works on nodejs.org, but do you even need any private information? In google calendar I can add the Node.js calendar to my regular view and then see all the Node.js items on my Calendar. This makes me think we don't need anything private. If we just created a new gmail, add the Node.js calendar to that user's calendar then from the user you should be able to get all of the calendar data? That may still need a gmail login, but for a user for which the only purpose is getting the calendar which limits the risk if the secrets are compromized.

[benhalverson]

nodejs.org uses an iframe to load a Google calendar. see https://support.google.com/calendar/answer/41207?hl=en#
We moved away from that approach because a white calendar in dark mode looks terrible and we have no way to style an iframe on another domain. An attempt was made here.

We don't need any private info but to access any Google API requires a client API key. Docs

https://github.com/nodejs/nodejs.dev/pull/1713/files#diff-a1c19f3a31d5257820088c00fffd27fa4f5be820f4f9bdb71e057c86bbef3e35R37-R40

export async function getEvents(
  calendarId: string,
  maxResults = 1000
): Promise<GCalResponse> {
  return gapi.client.calendar.events.list({
    calendarId,
    maxResults,
  });
}

This code is getting the calendar list specifically for nodejs.org_nr77ama8p7d7f9ajrpnu506c98@group.calendar.google.com which is the public calendar email from nodejs.org/calendar you can see this in the url.

This new way doesn't use an iframe and instead uses the Google calendar API directly with our own components.
This allows us to make the calendar match the rest of the design in both light and dark mode.

[mhdawson]

We don't need any private info but to access any Google API requires a client API key. Docs

Understood, my question is why we need an API key tied to the the Node.js calendar. Can we just create a new gmail account, create an API key for that user and then use that to get the public calendar info? I agree we'd likely need to share/store the info/login for that user somewhere.

[brianwarner]

Hey Ben and Michael, I have the API key here if you want it. Sorry I missed these notifications, but it sounds like a secret isn't the right way to do it anyhow. Ben, maybe I should just email it directly to you.

…

On Tue, Sep 14, 2021 at 10:39 AM Michael Dawson ***@***.***> wrote: We don't need any private info but to access any Google API requires a client API key. Docs Understood, my question is why we need an API key tied to the the Node.js calendar. Can we just create a new gmail account, create an API key for that user and then use that to get the public calendar info? I agree we'd likely need to share/store the info/login for that user somewhere. — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#628 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AAOVQJRCWBJMQM2EKJS3BCTUB5NBLANCNFSM5DS6473A> . Triage notifications on the go with GitHub Mobile for iOS <https://apps.apple.com/app/apple-store/id1477376905?ct=notification-email&mt=8&pt=524675> or Android <https://play.google.com/store/apps/details?id=com.github.android&referrer=utm_campaign%3Dnotification-email%26utm_medium%3Demail%26utm_source%3Dgithub>.

-- *Brian Warner* The Linux Foundation ***@***.*** +1 724 301-6171

[mhdawson]

@brianwarner what all does that API key give access to?

[brianwarner]

It appears to be scoped just to the Google Calendar API. I had to create it separately via GCP, but I'll be honest I don't know much more about how it will be used.

…

On Tue, Sep 14, 2021 at 10:47 AM Michael Dawson ***@***.***> wrote: @brianwarner <https://github.com/brianwarner> what all does that API key give access to? — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#628 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AAOVQJUGBFSNLFR3CXWUPRDUB5N6PANCNFSM5DS6473A> . Triage notifications on the go with GitHub Mobile for iOS <https://apps.apple.com/app/apple-store/id1477376905?ct=notification-email&mt=8&pt=524675> or Android <https://play.google.com/store/apps/details?id=com.github.android&referrer=utm_campaign%3Dnotification-email%26utm_medium%3Demail%26utm_source%3Dgithub>.

-- *Brian Warner* The Linux Foundation ***@***.*** +1 724 301-6171

[mhdawson]

My key question is will it let you manipulate the calendar, I'm not sure we need to expose/store a key that does that versus just reading the calendar which I'm wondering should be possible without a API key tied to the account.

[brianwarner]

I found the Google Calendar API docs. From a quick skim it seems to be read/write: https://developers.google.com/calendar/api/v3/reference

…

On Tue, Sep 14, 2021 at 1:35 PM Michael Dawson ***@***.***> wrote: My key question is will it let you manipulate the calendar, I'm not sure we need to expose/store a key that does that versus just reading the calendar which I'm wondering should be possible without a API key tied to the account. — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#628 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AAOVQJUO6ZKDDCXGL4J5T33UB6BWTANCNFSM5DS6473A> . Triage notifications on the go with GitHub Mobile for iOS <https://apps.apple.com/app/apple-store/id1477376905?ct=notification-email&mt=8&pt=524675> or Android <https://play.google.com/store/apps/details?id=com.github.android&referrer=utm_campaign%3Dnotification-email%26utm_medium%3Demail%26utm_source%3Dgithub>.

-- *Brian Warner* The Linux Foundation ***@***.*** +1 724 301-6171

[lancemccluskey]

If we utilize a firebase function, then it doesnt matter what the API key has access to

[mhdawson]

@lancemccluskey I still don't understand why it needs to be one that will have a higher level of access than read, which we could get through an API key on any account right?

I don't want to block progress but I also think we should reduce the number of high level access keys that we have across the org, the recent Travis incident shows that what should be private sometimes is not.

[brianwarner]

From what I can tell, the API key can only be issued through GCP, and is specific to the application (here, the themeable calendar) rather than the Google account. I think the way it works is that you can either use the default embedded Google Calendar view that's available to any account with minimal customization, or you can provision an API key from GCP to allow an app to request access to an existing Google account. I haven't been able to find anything in the middle, unfortunately, aside from limiting the key to the Google Calendar APIs in general. I'm admittedly not that familiar with the GCP console though, so if someone else knows I'm happy to take a look.

…

On Thu, Sep 16, 2021 at 9:28 AM Michael Dawson ***@***.***> wrote: @lancemccluskey <https://github.com/lancemccluskey> I still don't understand why it needs to be one that will have a higher level of access than read, which we could get through an API key on any account right? I don't want to block progress but I also think we should reduce the number of high level access keys that we have across the org, the recent Travis incident shows that what should be private sometimes is not. — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#628 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AAOVQJT7SWT6YL6L5BIH5RLUCHWJFANCNFSM5DS6473A> . Triage notifications on the go with GitHub Mobile for iOS <https://apps.apple.com/app/apple-store/id1477376905?ct=notification-email&mt=8&pt=524675> or Android <https://play.google.com/store/apps/details?id=com.github.android&referrer=utm_campaign%3Dnotification-email%26utm_medium%3Demail%26utm_source%3Dgithub>.

-- *Brian Warner* The Linux Foundation ***@***.*** +1 724 301-6171