Flutter Google API认证插件googleapis_auth的使用

注意事项

注意: 不要在Flutter应用中直接使用package:googleapis_auth。请改用extension_google_sign_in_as_googleapis_auth包。

使用此包

使用googleapis_auth包需要创建一个Google Cloud Project并为特定的应用程序类型获取应用程序凭据。所需步骤如下：

1. 在Google Developers Console上创建一个新的Google Cloud Project。
2. 在Google Developers Console上启用应用程序将要使用的所有API（在DevConsole -> Project -> APIs & auth -> APIs下）。
3. 在Google Developers Console上为特定的应用程序类型获取应用程序凭据（在DevConsole -> Project -> APIs & auth -> Credentials下）。
4. 使用googleapis_auth包来获取访问凭据或获取已验证的HTTP客户端。

根据应用程序类型，有不同方式实现第三步和第四步。以下是支持的OAuth2流程列表及其描述。

客户端Web应用程序

对于仅限客户端的Web应用程序，需要创建一个“Client ID”（在DevConsole -> Project -> APIs & auth -> Credentials下）。创建新的Client ID时，选择“Web application”类型。对于仅限客户端的应用程序，不需要设置Redirect URIs。Javascript Origins设置必须设置为应用程序将服务的所有URL（例如本地测试的http://localhost:8080）。

import 'package:googleapis_auth/auth_browser.dart';

// Initialize the browser oauth2 flow functionality then use it to obtain credentials.
Future<AccessCredentials> obtainCredentials() async {
  final flow = await createImplicitBrowserFlow(
    ClientId('....apps.googleusercontent.com'),
    ['scope1', 'scope2'],
  );

  try {
    return await flow.obtainAccessCredentialsViaUserConsent();
  } finally {
    flow.close();
  }
}

或者通过以下方法获取已验证的HTTP客户端：

import 'package:googleapis_auth/auth_browser.dart';

// Initialize the browser oauth2 flow functionality then use it to
// get an authenticated and auto refreshing client.
Future<AuthClient> obtainAuthenticatedClient() async {
  final flow = await createImplicitBrowserFlow(
    ClientId('....apps.googleusercontent.com'),
    ['scope1', 'scope2'],
  );

  try {
    return await flow.clientViaUserConsent();
  } finally {
    flow.close();
  }
}

为了防止弹出窗口阻止程序阻止用户授权对话框，最好只在事件处理程序内部调用obtainAccessCredentialsViaUserConsent和clientViaUserConsent方法，因为大多数浏览器不会阻止响应用户交互创建的弹出窗口。

已安装/控制台应用程序

对于已安装/控制台应用程序，需要创建一个“Client ID”（在DevConsole -> Project -> APIs & auth -> Credentials下）。创建新的Client ID时，选择“Installed application -> Other”类型。

import 'package:googleapis_auth/auth_io.dart';
import 'package:http/http.dart' as http;

// Use the oauth2 authentication code flow functionality to obtain
// credentials. [prompt] is used for directing the user to a URI.
Future<AccessCredentials> obtainCredentials() async {
  final client = http.Client();

  try {
    return await obtainAccessCredentialsViaUserConsent(
      ClientId('....apps.googleusercontent.com', '...'),
      ['scope1', 'scope2'],
      client,
      _prompt,
    );
  } finally {
    client.close();
  }
}

void _prompt(String url) {
  print('Please go to the following URL and grant access:');
  print('  => $url');
  print('');
}

或者通过以下方法获取已验证的HTTP客户端：

import 'package:googleapis_auth/auth_io.dart';

// Use the oauth2 code grant server flow functionality to
// get an authenticated and auto refreshing client.
Future<AuthClient> obtainCredentials() async => await clientViaUserConsent(
  ClientId('....apps.googleusercontent.com', '...'),
  ['scope1', 'scope2'],
  _prompt,
);

void _prompt(String url) {
  print('Please go to the following URL and grant access:');
  print('  => $url');
  print('');
}

自主应用程序/服务账户

如果应用程序希望自主运行并访问例如来自Google Cloud Project的数据，则可以创建一个服务账户。在这种情况下，不需要用户授权。

import "package:googleapis_auth/auth_io.dart";
import "package:http/http.dart" as http;

// Use service account credentials to obtain oauth credentials.
Future<AccessCredentials> obtainCredentials() async {
  var accountCredentials = ServiceAccountCredentials.fromJson({
    "private_key_id": "<please fill in>",
    "private_key": "<please fill in>",
    "client_email": "<please fill in>@developer.gserviceaccount.com",
    "client_id": "<please fill in>.apps.googleusercontent.com",
    "type": "service_account"
  });
  var scopes = [...];

  var client = http.Client();
  AccessCredentials credentials =
    await obtainAccessCredentialsViaServiceAccount(accountCredentials, scopes, client);

  client.close();
  return credentials;
}

或者通过以下方法获取已验证的HTTP客户端：

import "package:googleapis_auth/auth_io.dart";

// Use service account credentials to get an authenticated and auto refreshing client.
Future<AuthClient> obtainAuthenticatedClient() async {
  final accountCredentials = ServiceAccountCredentials.fromJson({
    "private_key_id": "<please fill in>",
    "private_key": "<please fill in>",
    "client_email": "<please fill in>@developer.gserviceaccount.com",
    "client_id": "<please fill in>.apps.googleusercontent.com",
    "type": "service_account"
  });
  var scopes = [...];

  AuthClient client = await clientViaServiceAccount(accountCredentials, scopes);

  return client; // Remember to close the client when you are finished with it.
}

自主应用程序/计算引擎使用元数据服务

如果应用程序希望自主运行并访问例如来自Google Cloud Project的数据，并且该应用程序正在ComputeEngine VM上运行，则可以使用服务账户。在这种情况下，可以通过元数据服务获取访问凭据。

import "package:googleapis_auth/auth_io.dart";
import "package:http/http.dart" as http;

// Use the metadata service to obtain oauth credentials.
Future<AccessCredentials> obtainCredentials() async {
  var client = http.Client();

  AccessCredentials credentials =
      await obtainAccessCredentialsViaMetadataServer(client);

  client.close();
  return credentials;
}

或者通过以下方法获取已验证的HTTP客户端：

import "package:googleapis_auth/auth_io.dart";

// Use the metadata service to get an authenticated and auto refreshing client.
Future<AuthClient> obtainAuthenticatedClient() async {

  AuthClient client = await clientViaMetadataServer();

  return client; // Remember to close the client when you are finished with it.
}

使用API密钥访问公共数据

可以通过仅使用API密钥而无需OAuth2访问某些API。

import "package:googleapis_auth/auth_io.dart";

var client = clientViaApiKey('<api-key-from-devconsole>');
// [client] can now be used to make REST calls to Google APIs.

...

client.close();

更多信息

更多信息可以从官方Google Developers文档获得：

• OAuth2以访问Google API
• OAuth2 Playground