无法在Rails应用中刷新Google API令牌

Question

I am trying to work with the Google Calendar API in my Rails(5.2.1) app but am having real trouble with the refresh token--my understanding of which is tenuous at best, even after having gone through quite a bit of documentation.

Here is my code:

          class CalendarsController < ApplicationController

              def authorize
                client = Signet::OAuth2::Client.new(client_options)
                redirect_to client.authorization_uri.to_s
              end

              def callback
                client = Signet::OAuth2::Client.new(client_options)
                client.code = params[:code]

                response = client.fetch_access_token!

                session[:authorization] = response

                redirect_to root_url
              end

              def get_calendars
                client = Signet::OAuth2::Client.new(client_options)
                client.update!(session[:authorization])
                client.update!(
  additional_parameters: {
    access_type: 'offline',
    prompt: 'consent'
  }
)
                service = Google::Apis::CalendarV3::CalendarService.new
                service.authorization = client
                # here is my attempt to refresh
                begin
                  service.list_calendar_lists
                    rescue Google::Apis::AuthorizationError
                      response = client.refresh!
                      session[:authorization] = session[:authorization].merge(response)
                      retry
                end
              end

              def new
                all_calendars = get_calendars.items
                @calendar_list = all_calendars.select {|calendar| calendar.access_role=="owner"}
           end

          def client_options
            {
              client_id: Rails.application.credentials.web[:client_id],
              client_secret: Rails.application.credentials.web[:client_secret],
              authorization_uri: 'https://accounts.google.com/o/oauth2/auth?access_type=offline&prompt=consent',
              token_credential_uri: 'https://accounts.google.com/o/oauth2/token',
              scope: Google::Apis::CalendarV3::AUTH_CALENDAR,
              redirect_uri: callback_url
            }
          end
    end

If I go to the URL that leads to #authorize I am directed to an OAuth screen and asked for permission to access my calendars. Once granted, the app works as expected. After an hour, the token expires and I can't get it to refresh. You can see my attempt above: Without that attempt, I get a Google::Apis::AuthorizationError . With it, I get "Missing authorization code." I'm totally lost and am having trouble following the documentation.

Answer 1

The documentation is quite challenging, and the error messages don't help much!

You're not showing the client_options that are being passed in, and since everything else looks correct - I'm guessing this is where the problem lies. Are you setting the access_type parameter for offline access, so that you can actually refresh the token without the user having to re-authenticate?

From the documentation :

Set the value to offline if your application needs to refresh access tokens when the user is not present at the browser. This is the method of refreshing access tokens described later in this document. This value instructs the Google authorization server to return a refresh token and an access token the first time that your application exchanges an authorization code for tokens.

You can do this in the authorization_uri . For example:

client = Signet::OAuth2::Client.new({
  client_id: ...,
  client_secret: ...,
  authorization_uri: "https://accounts.google.com/o/oauth2/auth?access_type=offline&prompt=consent",
  scope: Google::Apis::CalendarV3::AUTH_CALENDAR,
  redirect_uri: callback_url
})

Or when calling update! :

client.update!(
  additional_parameters: {
    access_type: 'offline',
    prompt: 'consent'
  }
)