Internal Google OAuth library crashing with account link

0
votes

I'm using Actions Builder + OAuth implicit account linking + inline webhook fulfillment. Account linking is working. Here's the flow:

  1. Invocation
  2. Open sign in web page for oAuth authorization
  3. Redirect to https://oauth-redirect.googleusercontent.com/r/... with token
  4. Account is now linked; all fulfillment webhook requests have the token attached
  5. All fulfillment requests fail with Google oAuth library crash

Regardless of the format of access token I generate, a simple string, or a JWT, every subsequent request to the fulfillment webhook with the access token passed fails automatically:

Error: Wrong number of segments in token: Bearer 12345abcde
    at OAuth2Client.verifySignedJwtWithCertsAsync (/workspace/node_modules/google-auth-library/build/src/auth/oauth2client.js:535:19)
    at OAuth2Client.verifyIdTokenAsync (/workspace/node_modules/google-auth-library/build/src/auth/oauth2client.js:401:34)
    at process._tickCallback (internal/process/next_tick.js:68:7)

With JWT formatted token:

SyntaxError: Can't parse token envelope: Bearer 12345abcdeJWTtoken: Unexpected token  in JSON at position 0
    at JSON.parse (<anonymous>)
    at OAuth2Client.verifySignedJwtWithCertsAsync (/workspace/node_modules/google-auth-library/build/src/auth/oauth2client.js:542:29)

Example "webhookResponse" value in the Actions test console:

Unsuccessful webhook call due to client issue: Error querying agent endpoint. State: URL_UNREACHABLE, reason: UNREACHABLE_5xx.

{
  "responseJson": {
    "error": "Wrong number of segments in token: Bearer abcde12345"
  }
}

package.json:

{
  "name": "ActionsOnGoogleFulfillment",
  "version": "0.0.0",
  "private": true,
  "description": "Actions on Google fulfillment",
  "engines": {
    "node": "10"
  },
  "main": "index.js",
  "dependencies": {
    "@assistant/conversation": "^3.0.1",
    "firebase-admin": "^8.13.0",
    "firebase-functions": "^3.7.0"
  }
}

What are you supposed to do here?

1
actions-on-googlegoogle-assistant-sdk

1 Answers

1
votes

Found the problem.

Including clientId in the constructor, e.g. const app = conversation({clientId: CLIENT_ID}) makes the Google auth processor treat the Authorization header as a GSI token no matter what, so the parsing fails.

Removing clientId from the constructor fixed it.