[google_sign_in_web] Migrate from Google Sign-In JavaScript Platform Library to Google Identity Services

Internal: b/233812803
Internal: b/259309242
Google Sign-In JavaScript Platform Library used by the google_sign_in web plugin will be discontinued on March 31, 2023.
It is being replaced by Google Identity Services
https://github.com/flutter/plugins/blob/b548ae18646d1725a8e1f004c26bf42e4d362aa8/packages/google_sign_in/google_sign_in_web/lib/google_sign_in_web.dart#L24
See also

https://github.com/flutter/flutter/issues/101004

\cc @ditman

See also #82980

Thanks for reporting! I'll take a look at this ASAP; apologies for the nagging emails, I wasn't aware that this migration was going to happen or that we'd send out emails to eeeevery user of the plugin  :)
Speaking of the email, here's the full text we all received (included for SEO purposes on this issue :P)

Google Developers
One or more of your web applications uses the legacy Google Sign-In JavaScript library. Please migrate your project(s) to the new Google Identity Services SDK before March 31, 2023.
Hello Google Developer,
As announced earlier this month, the legacy Google Sign-In web solution will no longer be supported after March 31, 2023. You are receiving this message because one or more of your web applications uses the legacy Google Sign-In web solution.
We’re writing to let you know that migration to the new Google Identity Services - our new family of Identity APIs that consolidate multiple identity offerings under one software development kit (SDK) - will be necessary to sign in users using their Google Account to your platform, after that date. The SDK will use the new Sign In With Google client library.
What do I need to know?
To help you find out which of your web apps or environments are affected, we’re sharing a list of your client ID(s) that use the legacy Google Sign-In web solution. This list should help you evaluate user impact and prioritize the migration work more efficiently:

App Name
client ID

Your App Name
00000000-y0urg00gl3s1gn1n4p1k3y.apps.googleusercontent.com

What do I need to do?
At your earliest convenience, migrate to the new Google Identity Services by following the migration guide.
How can I find more information or share feedback?
Be sure to read through the Sign-In With Google resources guide. If you have migration specific feedback to share, send an email to<EMAIL_ADDRESS>Sincerely,
The Google Identity Services team

Luckily we have until 2023 to get this done ;P
Since google_sign_in is federated, we can start a new package for web that uses the new SDK. People will be able to test the new plugin while it's being developed, and once the new plugin is ready and tested, we can just change the endorsement to the new one.
I am not sure if we want to use this opportunity to rewrite the core plugin (a completely new platform interface, etc...). Any ideas @jmagman @blasten @stuartmorgan ?

I am not sure if we want to use this opportunity to rewrite the core plugin (a completely new platform interface, etc...). Any ideas @jmagman @blasten @stuartmorgan ?

Is this using the new two-phase flow like the latest iOS SDK? If so, then we should seriously consider a set of breaking changes to all the interfaces across platforms to pick up that model. (We're waiting a bit to see what happens with the feedback that the new iOS SDK has received though in case anything changes as a result.)

@ditman looking forward to this update, got a rough eta?

Any update regarding Flutter Web, because the Google One-Tap Sign In package works only for Android.

@cybex-dev not yet, but I brought this up again to the team so it gets prioritized.
@Zujaj that package is developed by a third party and we don't support it. Find its repository here.

any news about this issue @ditman ?

No news, I'd personally would like to wrap this up by Q3 2022 so there's one Q for user testing/emergency fixes, and then we can release this at the end of Q4 2022 (right before the migration must happen)

See some interesting comments in the related ticket above:

@brdaugherty commented 4 days ago
...
Not mentioned in the above resources is the deprecation of the gapi.auth2 module found in the Google API Client Library for JavaScript. This module is shared with Google Sign-in platform.js library. The deprecation affects both. It is very likely you've reviewed the developer migration guides already, but for completeness: for user sign-in and for authorization.

We'll need a new JS-interop layer to go with the plugin.
Also, since this seems to only affect web, we'll try to implement the already existing plugin API with the new JS API. Docs. It seems that a migration to the new API with ux_mode=popup should be fairly straightforward.

/cc @kevmoo any chance we could use googleapis as the JS-interop layer for this new google.accounts JS API?

@ditman – perhaps? Tha browser auth code there is pretty old. I've done some cleanup there, but it's pretty old.
In general, fewer Dart implementations of this logic would be better!

Immediate next steps to mitigate:

Beginning April 30th, 2022 new applications must use the Google Identity Services library, existing apps may continue using the Platform Library until the deprecation date.

We'll do a small modification to the google_sign_in plugin suggested by @brdaugherty today so new applications can continue using the plugin after April 30th 2022.

We'll do a small modification to the google_sign_in plugin suggested by @brdaugherty today so new applications can continue using the plugin after April 30th 2022.

This has been published as package:google_sign_in_web v0.10.1.

@ditman I'm using google_sign_in: ^5.4.0 in my Flutter web app and checking pubspec.lock I see:
 google_sign_in_web:
    dependency: transitive
    description:
      name: google_sign_in_web
      url: "https://pub.dartlang.org"
    source: hosted
    version: "0.10.2"

But when I run my app I still see on the Debug console:
Your client application uses libraries for user authentication or authorization that will soon be deprecated. See the [Migration Guide](https://developers.google.com/identity/gsi/web/guides/gis-migration) for more information.

@maks that is correct. 0.10.2 is still using the deprecated library. We're working on a fix with the GIS team. (We have until March 2023 to resolve this, but I hope to be done much earlier so people have plenty of time to adopt and test the new library out)

Ah ok thanks @ditman , sorry I misunderstood: so the fix you mentioned previously to allow new applications to keep using the plugin after April is in 10.2 but it doesn't stop that deprecation message from showing.

I created a new client ID today using firebase for flutter web. I am using latest google_signin package, but the error message shows up and I am unable to use google login. Is there any workaround?

I created a new client ID today using firebase for flutter web. I am using latest google_signin package, but the error message shows up and I am unable to use google login. Is there any workaround?

I don't think there is right now. We still need to wait for the major upgrade in the library to support the Google Identity Services API. Hopefully this will be released somewhere in the final quarter of 2022 so there is still time to migrate.

I'm actively working in this migration right now. There's a few kinks that need to be ironed out, though; the new SDK has some changes that affect how this integrates with your apps, for example:

User sign-in status to their Google Account and your app are independent of each other, except during the sign-in moment itself when you know that the user has successfully authenticated and is signed into their Google Account. Users may remain signed-in, sign-out, or switch to a different Google Account while maintaining an active, signed-in session on your website.

These are the "migration guides" that I'm looking at to attempt to replicate the old behavior as much as possible to minimize changes:

Authentication: https://developers.google.com/identity/gsi/web/guides/migration#object_migration_reference_for_user_sign-in (old vs new code)
Authorization: https://developers.google.com/identity/oauth2/web/guides/migration-to-gis#library_quick_reference

Overall, I think this will make it much easier for Google Sign In to be used as an authentication/authorization provider by Firebase and others, but I'm not sure what's the impact in the case a user only used google authentication (and didn't manage their own users and sessions, those might need more work).
Docs.

I am introducing a Dart JS-Interop layer package in the PR above so we can implement the new API. If you've read the documentation, you may be aware of some of the shortcomings of the new API, like:

No token auto-renewal (tokens last 1h)
The SDK no longer returns both ID and access_token at the same time, now users are supposed to give permissions to access their identity and THEN to access the Google APIs.

Anyway, I'll implement this as a new package (sibling of google_sign_in_web) to try to keep this API compatible, even though the new behavior is slightly different.

No token auto-renewal (tokens last 1h)

Does this mean users need to sign in again after 1hr of inactivity?

Does this mean users need to sign in again after 1hr of inactivity?

@Levi-Lesches I don't think this has to do with inactivity, I think this means that Google will not maintain user sessions for your site anymore; you're supposed to use the google identity to create/link accounts to a user on your site. I think it's somewhat described in the docs here:

You'll manage per user session state for sign-in to your site.
User sign-in status to their Google Account and your app are independent of each other, except during the sign-in moment itself when you know that the user has successfully authenticated and is signed into their Google Account. Users may remain signed-in, sign-out, or switch to a different Google Account while maintaining an active, signed-in session on your website.

Also, with regards to Authorization tokens (oauth2 access_token, the ones that authorize access to scopes):

access tokens have a short lifetime. If the access token expires prior to the end of the user's session, obtain a new token by calling requestAccessToken() from a user-driven event such as a button press.

The client-side SDK will not attempt to renew the token before it completely expires, it's up to your app to see that a request to an API failed, so a new token needs to be requested (from a user interaction). In order to have a renewable token, the code client needs to be used, where your server will keep the data fresh.
(The above is why I'm making this a separate package, the features are going to be slightly different than before, but since the old API still seems compatible (sign in/sign out/is signed in, and requestPermissions), I'm trying to create a package that "looks" like the old one, however some changes to our apps seem inevitable).

Hi Ditman, thank you very much for the effort you are doing to migrate this library for web flutter, but could you enable the google_sign_in_web package you had uploaded, this was working for me to work with the Google Drive API I have in a web application in production for a client and is claiming me because it does not work.... I would be very grateful. Greetings!

@cristhianA94 we didn't disable anything with regards to google_sign_in_web, in fact, it should contain an exemption to continue working as intended. Please, ensure that the version your app is using is newer than 0.10.1.
See the changelog.

Sorry Ditman, you are right, it still works, I think that as the package is listed as "Unlist" in pub.dev, when I installed another dependency it was removed. I already tested it and everything is ok, thank you very much.

I think that as the package is listed as "Unlist" in pub.dev, when I installed another dependency it was removed.

Unlisted packages just don't show up in pub.dev search results; it has no effect on how they are used, or on the resolver. Also, if you depend on a recent version of google_sign_in, google_sign_in_web can't be removed by pub, since it's a dependency of the package.

Hey all!
I just pushed a quick and dirty early draft (no tests! probably doesn't work yet, I haven't attempted to integrate it yet!) but so people can see what this migration is going to be about, check it out here:

https://github.com/ditman/plugins/tree/google-sign-in-gis-web/packages/google_sign_in/google_sign_in_gis_web

Check it out and let me know what you think! It has a README, and it uses a separate package to interop with the new JS SDK (which you can also use now!)
PS:  The path dependency in the plugin is pending to land here: https://github.com/flutter/packages/pull/2688
(PPS: I'm at an all-hands team meeting, so my ability to respond this week is limited. I just wanted to offer a sneak peek of the work that's happening here, and also "preserve" the code somewhere in github, rather than only in my machine 😅)

I did some more fiddling with the new SDK last friday, trying to keep the plugin API compatible, unsuccessfully. You can see the experiments in the plugin here, and attempted to wire it to the example app for validation.
My approach was:

Use the one-tap prompt for the implementation of silentSignIn; it's not totally silent, but at least we don't have to do crazy stuff to maintain the "last seen credential" around. It also felt more consistent with the spirit of the new SDK.
Use the oauth2 implicit flow to have "authentication + authorization" in one popup (which the "id" library doesn't provide); this opens a very similar popup as with the current version of google_sign_in_web, but it will NOT return the Authentication of the user (credential), only the Authorization (access_token).

I attempted to "fill in" the user information by requesting a couple of extra "userinfo" scopes (userinfo.email, userinfo.profile) for the People API (see the file network.dart), and attempting to request info from the people.get method.

Adding the extra userinfo scopes (or the email scope that was in the app) caused the Sign-In popup to display an error: invalid_scopes. All scopes I passed in were marked as invalid, and no further information was given (maybe because my test app is not verified?)

The error above uncovered a small issue (that AFAIK has already been reported); the oauth2 popup does not notify the application of a wrong/unsucessful/aborted login attempt, so if the requestToken process doesn't finish through the happy path, our plugin keeps awaiting for a Future that will never be rejected.
At this point, and barring programmer error (that's why I'm linking to the diffs too 😜), I'm not entirely sure that we can have a version of google_sign_in for the web that is compatible with the old API, so unless the new SDK changes, it's likely that we'll need a new package for the web, incompatible with the current google_sign_in_platform_interface.
Next steps:

The js-interop layer is not complete, it's not exposing any of the renderButton API or its configuration attributes. Add this.
Build a Flutter widget that adapts to the size of its (web) contents, so we can render the button and have it resize while reflowing the Flutter app around it.
Then, create a new plugin that is a very thin layer on top of the SDK, just to add some usability to it, for example:

Mimic the SDK API to follow their flows: id.renderButton, id.prompt (for one-tap) or oauth2.requestToken.
Expose Authentication and Authorization events as Streams, so the UI can be built in a "rx" fashion, rather than being Future-based (which can lead to the UI of the app hanging). (It is easy to go from Streams to Futures too, if anybody wants those.)
...
Profit?

Meanwhile:

Discuss the feasibility to keep a single plugin for all platforms with the current "state of the art" of the available GIS SDKs.

Anyway, thanks for reading this wall of text. If anybody comes up with a different set of solutions, feel free to share. Otherwise, I'll start modifying the js-interop layer and maybe adding the "Elastic" Web widget :)

Changing to P3 to match b/233812803

Hi @ditman ,
After the completion of migration process do we need to forcefully upgrade our present billing scheme of FirebaseAuth to the new 'Auth with identity platform' in our firebase console, in order to use the new plugins made for google sign in using new identity services api ?

After the completion of migration process do we need to forcefully upgrade our present billing scheme of FirebaseAuth to the new 'Auth with identity platform' in our firebase console, in order to use the new plugins made for google sign in using new identity services api ?

@hpomgithub I don't know, I think the migration should be transparent in that regard, since all the code knows about your firebase account is the "client ID" used for Google Auth itself, but you should ask that through Firebase customer support to be 100% certain.
(The fix I'm working on is completely independent of Firebase inner workings, this plugin can be used directly by projects using the Google Cloud console directly, without any Firebase whatsoever)

Hi @ditman
Thank You, as I got my answer after checking with firebase team. One thing I I want to ask is about the new plugin which you are developing (to sign_in with  google) , can we use it in a same way to carry out authentication using firebase 'FirebaseAuth.instance.signInWithPopup(GoogleAuthProvider())', like we use to do earlier because firebase security depends majorly on the auth part.

To everybody interested in this, please do check out the PR and Demo app that I have just posted, here:

https://github.com/flutter/plugins/pull/6921

I still need to rewrite most tests (the JS mocks I used to use are not valid anymore), but you can take a look. Particularly at the subtle changes in behavior of silentSignIn and signIn.
Please, do provide feedback! To me, the plugin "works" (but I don't know all possible use cases, so your definition of "works" and mine might vary!)

The PR has been updated with a version of the branch that should be much easier to use directly from Git (no path dependencies anymore), with a dependency override pointing here:
  google_sign_in_web:
    git:
      url: https://github.com/ditman/plugins.git
      ref: google-sign-in-web-using-gis
      path: packages/google_sign_in/google_sign_in_web

Hi @ditman ,
From where we can the document to implement the new one and use with firebase auth like we used to do it with previous google_sign_in_web.

The PR has been updated with a version of the branch that should be much easier to use directly from Git (no path dependencies anymore), with a dependency override pointing here:
  google_sign_in_web:
    git:
      url: https://github.com/ditman/plugins.git
      ref: google-sign-in-web-using-gis
      path: packages/google_sign_in/google_sign_in_web

hey, I tried adding that to the pubspec.yaml and i got:
Because google_sign_in 5.4.3 depends on google_sign_in_web ^0.10.0 and no versions of google_sign_in match >5.4.3 <6.0.0, google_sign_in ^5.4.3 requires google_sign_in_web from hosted.
because app depends on both google_sign_in_web from git and google_sign_in ^5.4.3, version solving failed.)

That sounds like you added it in dependencies rather than dependency_overrides; only the latter will work.

That sounds like you added it in dependencies rather than dependency_overrides; only the latter will work.

thank you. that solved it. is it possible you could tell me the approach to this new method?
patient opens flutter web app>
2) clicks google sign-in button:
3)google identity services pops  open upon click depending on singinSilently(). thats if the browser detects a session.
ELSE itll open up the Oauth. which will then return a googleaccount via:  GoogleSignInAccount? googleaccount = await _googleSignIn.signIn();
for some reason my app says: The OAuth token was not passed to gapi.client, since the gapi.client library is not loaded in your page.

Hi,
From where we can get the document to implement the new implementation and use with firebase auth, like we used to do with previous google_sign_in_web ?

From where we can get the document to implement the new implementation and use with firebase auth, like we used to do with previous google_sign_in_web.

@hpomgithub You can install the version of the plugin in the PR by adding a dependency_overrides, as described here.
With regards to firebase_auth, I am not 100% positive how to use this. We should bring somebody from the firebase repo (I'll reach out to them, and point them to this issue).

That sounds like you added it in dependencies rather than dependency_overrides; only the latter will work.

@stuartmorgan this is a good point, I updated the "setup" instructions in my comment above, so it's clearer.

thank you. that solved it. is it possible you could tell me the approach to this new method?
patient opens flutter web app>
2) clicks google sign-in button:
3) google identity services pops open upon click depending on singinSilently(). thats if the browser detects a session. but since it always returns Null. how do you obtain the access token via signinsilently().
ELSE itll open up the Oauth. which will then return a googleaccount via: GoogleSignInAccount? googleaccount = await _googleSignIn.signIn();

@avatarKaran thanks for giving the new plugin a shot, as you can read in the description of the PR here, the small differences that you're finding are the reason why the new version is (most probably) be released as a MAJOR version, even though there shouldn't be many changes to do in your web app.
The root of the problem is that:

The new Authentication API (idToken) does NOT return accesTokens anymore, and
The new Authorization API (oauth2, accessToken) does NOT return idTokens anymore.

In order to try to minimize those two differences of behavior, we do the following:

signInSilently() always returns null, because the new SDK does not authorize the scopes on sign in. If the user authenticates with the One Tap card, we keep the idToken for later, but we tell the plugin that the authentication was not successful (because we don't have the accessToken yet).

(In future versions of the web package, as people migrate to the new world of expiring Authorization credentials, we can start returning the object we receive in silentSignIn, instead of always null, but not in the first version!)

signIn() behaves in two ways:

If the user has accepted the signInSilently(), we call the oauth2 authorization process (the popup), and if successful, return a User Information object with the idToken from the previous signInSilently call. We store the accessToken.
If the user has NOT accepted the signInSilently(), we add a couple more scopes to the oauth2 authorization process, so we can do a People Request API to retrieve as much User Information as we can immediately after a successful authorization (unfortunately, idToken will be null in this case).

The way that the new API wants to be used is the following:

Completely separate sign in (authentication) from the oauth2 popup (authorization).
Users sign in with the signIn and signInSilently methods. These two do not handle scope.
Then, users get permissions with the requestScopes method.

The oauth2 authorization is now very short lived (1h, I think), and will not auto-renew as before.

Your app must keep track of failed requests to APIs, and re-authorize the user as needed.

See the official documentation of the JS migrations here:

Authentication: https://developers.google.com/identity/gsi/web/guides/migration
Authorization: https://developers.google.com/identity/oauth2/web/guides/migration-to-gis

for some reason my app says: The OAuth token was not passed to gapi.client, since the gapi.client library is not loaded in your page.

@avatarKaran this is expected (but in my latest changes I've made this only show up in debug mode). The google_sign_in_web plugin does NOT use the gapi library anymore, so we don't even download its JS. The new SDK warns that gapi is not in the page to interact with it, but this is only a warning, and shouldn't affect functionality. (The warning now only shows up in debug mode)

@hpomgithub: I've confirmed with the Flutterfire maintainers (thanks @Lyokone!) that firebase_auth works fine with the new version of the plugin. (🥳)

I'll have a meeting with members of the GIS team to discuss the "tricks" that this new implementation does to stay API compatible with the old one, and discuss a roadmap with the upcoming changes to align the plugin with what the new SDK wants to do (primarily: separating authentication from authorization).
I'll share a document with the roadmap for the upcoming changes ASAP (hopefully next week, I need to cordinate a bunch of people to attend the same meeting :))

With regards to firebase_auth, I am not 100% positive how to use this. We should bring somebody from the firebase repo (I'll reach out to them, and point them to this issue).

@hpomgithub: I've confirmed with the Flutterfire maintainers (thanks @Lyokone!) that firebase_auth works fine with the new version of the plugin. (🥳)

Thank you @ditman for clarifying this. Can you mention any document link explaining the implementation of the new Api and carry out the authentication using firebase auth.

hopefully next week, I need to cordinate a bunch of people from different teams to attend the same meeting

The meeting will happen next Tuesday, Jan 24th at 3PM (UTC -08:00). I'll try to share a public doc later that day, or on Wednesday, Jan 25th.

hopefully next week, I need to cordinate a bunch of people from different teams to attend the same meeting

The meeting will happen next Tuesday, Jan 24th at 3PM (UTC -08:00). I'll try to share a public doc later that day, or on Wednesday, Jan 25th.

Thank you @ditman

Does anyone has a web code snippet about the new syntax combined with Firebase Auth?

I'll have a meeting with members of the GIS team to discuss the "tricks" that this new implementation does to stay API compatible with the old one, and discuss a roadmap with the upcoming changes to align the plugin with what the new SDK wants to do (primarily: separating authentication from authorization).
I'll share a document with the roadmap for the upcoming changes ASAP (hopefully next week, I need to cordinate a bunch of people from different teams to attend the same meeting :))

thank you for the quick responses. youre doing great. will look forward to your updates. my app is a flutter web app with a django back end.

Hello, everyone!
I'm giving a try on this new version and for me it's working fine, but my only problem is that I need to have access on the idToken to send it to my backend server, but I can't get it anymore, only the accessToken. However, looking at the logs, I can see that the library prints out exactly what I need, the idToken/credential.
[GSI_LOGGER]: Message received: {"type":"response","response":{"xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx","client_id":"xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx","credential":"eyJhbGciOiJSUzI1NiIsImtpZCI6ImFmYzRmInE2NTk5ZmY1ZjYzYjcyZGM1MjI0MjgyNzg2ODJmM2E3ZjEiLCJ0eXAiOiJKV1QifQ.eyJpc3MiOiJodHRwczovL2FjY291bnRzLmdvb2dsZS5jb20iLCJuYmYiOjE2NzQ1NzE3NjcsImF1ZCI6IjkzMjkxNjkwMDk1MS12cjdnbHJ1cDZlcm1kdW3obnFzNDgyOXNtZDJtZWgzaC5hcHBzLmdvb2dsZXVzZXJjb250ZW50LmNvbSIsInN1YiI6IjEwNjE5NzA2NjYyMjUyODU3OTc0MSIsImhkIjoibW90b3JvbGEuY29tIiwiZW1haWwiOiJlaHNhbnRvc0Btb3Rvcm9sYS5jb20iLCJlbWFpbF92ZXJpZmllZCI6dHJ1ZSwiYXp0IjoiOTMyOTE2OTAwOTUxLXZyN2dscnVwNmVybWR1ZGhucXM0ODI5c21kMm1laDNoLmFwcHMuZ29vZ2xldXNlcmNvbnRlbnQuY29tIiwibmFtZSI6IkVkdWFyZG8gSGVucmlxdWUgZG9zIFNhbnRvcyBDb3JyZWlhIiwicGljdHVyZSI6Imh0dHBzOi8vbGgzLmdvb2dsZXVzZXJjb250ZW50LmNvbS9hL0FFZEZUcDRlRW04WExaWDg5OXE3ZVNUTC1aZVZkdHRqNE9GTEx2WDdJcTlSPXM5Ni1jIiwiZ2l2ZW5fbmFtZSI6IkVkdWFyZl8iLCJmYW1pbHlfbmFtZSI6IkhlbnJpcXVlIGRvcyBTYW50b3MgQ29ycmVpYSIsImlhdCI6MTY3NDU3MjA2NywiZXhwIjoxNjc0NTc1NjY3LCJqdGkiOiJhOTQ2NDA0NTkyNjllNTkyNDExMzMyMTg3NWNkOTRlMDViNGRiOTgxIn0.gNSA96rQJIc-BPkVun9BDLE8dsCdZjudkvxDqpvNHUjCR-W0vlQywVdlKW3zcPIP-wRkNTyBxjTPw5P8C4hGW8pOmzlBI_l2zvD8k247z1AziJfcGG6hd5jS_GDR251s6xDeab_6EI4bQXMybS9Sr-CS5w6x3GmC0TmdIFFMpYWN4hCDMl_RLecOcS6zJLcBhR2CIFoLm0TVijQuP5u27IDIV0e1NojGS4Rf96vXQ-8K-2qm-2SB9N0PDzjWH1v2m6C9-Cgln0OpQhSpoLbrBKTkzxF5faCg6mnFqBKzPAk0MbSeDpaz5mQbl9V7Wyb8t9ddC6cceNoAd80Dhugdjg","select_by":"auto"},"announcement":"Signed in as XXXXXXXXX"}
So, what method can I call to get this credential value?

Does anyone has a working example of google sign in on flutter web with gis and without Firebase Auth?

@avinash-bsharp tried https://pub.dev/packages/google_sign_in ?

@kevmoo I need it for web. This package has the old documentation I think https://pub.dev/packages/google_sign_in_web. I am getting mails for deprecation.

@ditman should be working on rolling this forward to the latest APIs.

I can confirm that the PR from @ditman is working without breaking anything in our app. BUT make sure that you enable People Google API for your project or the scope request will fail.
@ditman the People API request is asking for photos, names and emailAddresses scopes even if I ask only for email, is that the intended behaviour?
For those asking, we are using Google Sign In method and Firebase Auth this way.
final _googleSignIn = GoogleSignIn(
        scopes: [
          'email',
        ],
        clientId: DevicePlatform.isWeb
            ? const String.fromEnvironment('WEB_GOOGLE_OAUTH_CLIENT_ID')
            : null,
      );

final googleSignInAccount = await _googleSignIn.signIn();

final googleAuth = await googleSignInAccount.authentication;

final googleAuthCredential = GoogleAuthProvider.credential(
        accessToken: googleAccessTokenEntity.accessToken,
        idToken: googleAccessTokenEntity.idToken, //Should be null now in WEB
      );

await firebaseAuth.signInWithCredential(googleAuthCredential);

Hello @jorgeroncero @ditman,
In our project, we have used google_sign_in and firebase for authentication in both mobile and web platforms.
Recently we've received the migration notice. So, to fix that we've been trying to implement all the possible ways which you have described in this portal.
https://github.com/flutter/flutter/issues/88084#issuecomment-1378143035
But we aren't able to resolve it, and every time we try to override the dependencies, we are getting this message:
"Package not available (the pubspec for google_sign_in_web 0.11.0 from git has version 0.10.2+1)"
Is there anything I've missed over here, or implemented in the wrong way?

@Prajun2010 can you show your pubspec.yaml? Or at least your google_sign_in dependency and the google_sign_in_web dependency_override

@jmagman

The pubspec seems right.
The error could be caused because the previous version installed in your cache was 0.10.2+1. Have you tried to do a flutter clean and then flutter pub get? The pubspec.lock file must be forcing to use the previous version, not sure why.

Hi @ditman
Big ups for the work you did! Just tried out the new version. It is working perfectly fine when we use 'GoogleSignIn().signIn()' (after enabling people's api) - with firebase auth,
But it is unable to get the credential when we use GoogleSignIn().signInSilently(). It will be great if you can suggest steps to get the credential obtained while using signInSilently().
Also do we need to sign in every hour as access token expiration is now 1 hour?

So, what method can I call to get this credential value?

@edu-correia you should be able to get both the idToken (authentication credential) and accessToken (authorization token) (if the user has given you permission to have them) with the authentication getter of the GoogleSignInAccount after signIn. Note that in the new implementation, the idToken may be null, if the user doesn't go through (or cancels) the signInSilently (OneTap UX) flow, in which case the plugin will fall-back to a People API request to retrieve the basic profile information of the user (name, email, photo and google User ID). You will have everything you need about the user (except its JWT representation as idToken).

Does anyone has a working example of google sign in on flutter web with GIS and without Firebase Auth?

@avinash-bsharp yes, check the package:google_sign_in example app, which I have deployed for testing here with my upcoming changes as a dependency override.

BUT make sure that you enable People Google API for your project or the scope request will fail.

@jorgeroncero this is a great point that I had totally forgotten to document. Back to the PR!

the People API request is asking for photos, names and emailAddresses scopes even if I ask only for email, is that the intended behaviour?

@jorgeroncero this is correct, I'm attempting to return the same data that the previous version of the SDK gave you after Sign In. The People API request will only happen if the signInSilently doesn't authenticate the current user (or the user aborts the One Tap UX flow). In that case, the plugin attempts to retrieve the information from the People API after the oauth popup is done, by doing an extra REST request. If signInSilently is successful, the People API request won't happen.

It is unable to get the credential when we use GoogleSignIn().signInSilently(). It will be great if you can suggest steps to get the credential obtained while using signInSilently().

@hpomgithub Unfortunately, I had to do this for the new version to be "backwards compatible" with the current implementations. Since the old silentSignIn did both Authentication and Authorization, it could return a full GoogleSignInAccount with a complete authentication (that contained both idToken and accessToken).
In the new SDK, however, the One Tap UX flow only returns the idToken, which is half of the authentication. Then on signIn we retrieve the other half: accessToken (with the authorized scopes). So only after the user has done signIn the plugin can say that the authentication is complete.
TL;DR: we simulate that signInSilently fails on the web, so current apps are "forced" to call signIn, and thus obtain a complete GoogleSignInAccount.

Also do we need to sign in every hour as access token expiration is now 1 hour?

@hpomgithub I was also surprised to learn this, but... yes!

Token expiration
By design, access tokens have a short lifetime. If the access token expires prior to the end of the user's session, obtain a new token by calling requestAccessToken() from a user-driven event such as a button press.

From the Docs.
For longer lived sessions, the new SDK proposes that you use the "Code" client, which means: you talk to the Google services from your backend, on behalf of the user. Docs.

Question for all: Should the new web plugin return an "authenticated-but-not-authorized" GoogleSignInAccount if signInSilently is successful (requires apps to call signIn or, much better, requestScopes before being able to perform REST requests), or should it only return a "complete" GoogleSignInAccount once the accessToken is granted?
The new SDK is going in the direction of completely separating Authentication from Authorization, so from a "Google Identity Services", separating "isSignedIn" from "isAuthorized" is better, and since we're writing a Migration Guide, we might as well add that extra bit of backwards incompatibility :)
To minimize code changes, however, it is better that signInSilently "fails", as it does now (that enabled the example app to work without any significant changes!)

Please, do take a look at the "Migration guide"/"FAQ" on the new README, and do comment in the PR if you feel like there's missing stuff, or anything needs more clarification:
New README.md
And thank you everyone for your time testing this package!

@ditman Thanks for clarifying everything in detail.

@hpomgithub I was also surprised to learn this, but... yes!

Maybe Firebase Auth can help in renewing the tokens automatically as I have signed in using firebase yesterday with the new version & it was still signed in even today. What you think about this?

Maybe Firebase Auth can help in renewing the tokens automatically as I have signed in using firebase yesterday with the new version & it was still signed in even today. What you think about this?

@hpomgithub for user authentication (login) yes, I even "recommend" it on the migration guide. For user authorization (give me access to your Contacts), I don't think it'll help.

@ditman I do the request but the Id Token returns null, how can I fix this ~ Flutter Web? Thanks in advance .

I do the request but the Id Token returns null, how can I fix this ~ Flutter Web? Thanks in advance.

@Ianpot12 I've documented that behavior in the README already, here:

https://github.com/ditman/plugins/blob/google-sign-in-web-using-gis/packages/google_sign_in/google_sign_in_web/README.md#idtoken-is-null-in-the-googlesigninaccount-object-after-signin

What info do you need from the idToken?

@ditman I want to send it our backend server

@Ianpot12 @edu-correia for you to get an idToken with the new plugin, you need to use signInSilently, which currently is the only flow that computes and returns a valid idToken. If users do not complete the sign in successfully, the idToken will not be produced (because I cannot fake Google server private keys from the plugin).

@ditman Thanks !! , This is my method, how do I get the idToken from
signInSilently() call if it was successful? Thanks for the help!!

_googleSignIn.signInSilently() might never return a user, you need to use both signInSilently and signIn.
After signIn, if the user has authorized the OneTap flow to authenticate them, you'll get an idToken in the GoogleSignInAccount.authentication getter (this one).

@ditman sorry man, but something likes this the IdToken still returns null

@Ianpot12 not exactly like that (but close). signIn needs to be triggered from a user interaction (like a button press), so the browser won't block the auth pop-up.
Check the example app, it's very similar to yours (except it uses regular setState to propagate users from the currentUserChanged). Source:

on initState, it sets the onCurrentUserChanged listener, and calls signInSilently
signIn gets called on a button click

@ditman  Thank you so much, I was very close to give up !

!!

@Ianpot12 do you mind pasting your working example as text, so people can find it when searching github by "_googleSignIn.signIn()" or similar? Thanks!!
You can use "triple backtick syntax" and github will do some syntax coloring even!

```dart
// your dart code
```

Flutter / Dart gis migration with googleSignIn()
My  dependencies
  google_sign_in: ^5.4.4
  google_sign_in_web: ^0.10.0

dependency_overrides:
  google_sign_in_web:
    git:
      url: https://github.com/ditman/plugins.git
      ref: google-sign-in-web-using-gis
      path: packages/google_sign_in/google_sign_in_web

Code ~ BLOC State management
Call this method first on page Load

silentUserLogin() async {
    _googleSignIn.onCurrentUserChanged.listen((GoogleSignInAccount? account) {
      emit(state.copyWith(currentUser: account));

      if (state.currentUser != null) {
        handleGetContact(state.currentUser!);
      }

    });

    _googleSignIn.signInSilently();
  }

Then this method onTap() ~ Login button

  login(Function onSuccess) async {
    try {
      await _googleSignIn.signIn();
    } catch (error) {
      print(error);
    }
    emit(state.copyWith(currentUser: _googleSignIn.currentUser));

    if (state.currentUser != null) {
      state.currentUser!.authentication.then((GoogleSignInAuthentication value) {
       print(value.idToken!)
      });
    }
  }

The pubspec seems right.
The error could be caused because the previous version installed in your cache was 0.10.2+1. Have you tried to do a flutter clean and then flutter pub get? The pubspec.lock file must be forcing to use the previous version, not sure why.

I've done that too, but the error is persistent.

@Prajun2010 I'm waiting for one more review, then land the PR. That'll create a new major version of the package in pub.dev, so you should be able to set a more "normal" override, before you fully commit to upgrading the package.
(Note that package:google_sign_in will also have a major version release, so people can control (and test) when they get the newest code for the web)

For some reason onCurrentUserChanged doesn't get fired when I login through signInSilently(), using the following code:
    _googleSignIn.onCurrentUserChanged.listen((GoogleSignInAccount? account) {
      print("user changed");
    });
    _googleSignIn.signInSilently();

Any idea how I can debug this?

For some reason onCurrentUserChanged doesn't get fired when I login through signInSilently(), using the following code:

@ramonvermeulen This is (sadly) expected, let me know if this bit of documentation explains this situation successfully:
https://github.com/ditman/flutter-plugins/tree/google-sign-in-web-using-gis/packages/google_sign_in/google_sign_in_web#signinsilently-always-returns-null

A change that I can think of is to return a user object IF there were no initial scopes requested. I think that'd be a fair compromise between the old and the new behavior.

For some reason onCurrentUserChanged doesn't get fired when I login through signInSilently(), using the following code:

@ramonvermeulen This is (sadly) expected, let me know if this bit of documentation explains this situation successfully:
https://github.com/ditman/flutter-plugins/tree/google-sign-in-web-using-gis/packages/google_sign_in/google_sign_in_web#signinsilently-always-returns-null

@ditman Hmm I see, I'm still struggling a bit finding a correct way to migrate this implementation.
In the old implementation I listen on _googleSignIn.onCurrentUserChanged to change the "authenticated" state of the user within the application. On page load a signInSilently() got triggered to sign-in the user in the background if he already signed-in manually before. And on the login button the signIn() will get triggered manually. Both of these scenario's used to fire an event in the onCurrentUserChanged listener, but currently only signIn does that.
If I understand the explanation correctly I now have to request scopes after the signInSilently to trigger the onCurrentUserChanged event listener. (Because authentication and authorization is now separated)
For example if I try the following:
silentUserLogin() async {
  _googleSignIn.onCurrentUserChanged.listen((GoogleSignInAccount? account) {
    print("user changed"); // never gets called
  });
  await _googleSignIn.signInSilently();
  await _googleSignIn.requestScopes(_googleSignIn.scopes);
}

I get this output:
[GSI_LOGGER-TOKEN_CLIENT]: Instantiated.
[GSI_LOGGER]: Setup message received: {"type":"readyForConnect","channelId":"xxx"}
[GSI_LOGGER]: Setup message received: {"type":"readyForConnect","channelId":"xxx"}
[GSI_LOGGER]: Message received: {"type":"command","command":"resize","height":360}
[GSI_LOGGER]: Message received: {"type":"command","command":"cancel_protect_start"}
[GSI_LOGGER]: Message received: {"type":"command","command":"resize","height":147}
[GSI_LOGGER]: Message received: {"type":"command","command":"resize","height":147}
[GSI_LOGGER]: Message received: {"type":"command","command":"start_auto_select"}
[GSI_LOGGER]: Message received: {"type":"command","command":"cancel_protect_start"}
[GSI_LOGGER]: Message received: {"type":"response","response":{"clientId":"xxx","client_id":"xxx","credential":"xxx","select_by":"auto"},"announcement":"Ingelogd als<EMAIL_ADDRESS>[GSI_LOGGER]: Response received: {"clientId":"xxx","client_id":"xxx","credential":"xxx","select_by":"auto"}
[GSI_LOGGER-TOKEN_CLIENT]: Starting popup flow.
[GSI_LOGGER-OAUTH2_CLIENT]: Starting popup timer.
[GSI_LOGGER-OAUTH2_CLIENT]: Checking popup closed.
[GSI_LOGGER-OAUTH2_CLIENT]: Checking popup closed.
[GSI_LOGGER-OAUTH2_CLIENT]: Checking popup closed.
[GSI_LOGGER-OAUTH2_CLIENT]: Checking popup closed.
[GSI_LOGGER-TOKEN_CLIENT]: Handling response. {"access_token":"xxx","token_type":"Bearer","expires_in":3599,"scope":"email profile https://www.googleapis.com/auth/userinfo.profile openid https://www.googleapis.com/auth/admin.directory.user.readonly https://www.googleapis.com/auth/userinfo.email https://www.googleapis.com/auth/cloud_search.query","authuser":"0","hd":"xxx.com","prompt":"none"}
[GSI_LOGGER-OAUTH2_CLIENT]: Popup timer stopped.
[GSI_LOGGER-TOKEN_CLIENT]: Trying to set gapi client token.
[GSI_LOGGER-TOKEN_CLIENT]: The OAuth token was not passed to gapi.client, since the gapi.client library is not loaded in your page.

The last line felt a bit weird since I have the following in my index.html:
Maybe I'm missing something here?
<meta name="google-signin-client_id" content="xxx-xxx.apps.googleusercontent.com">
<script src="https://apis.google.com/js/api.js"></script>

Preferably I want to let the user signIn and request scopes once, and the next times the user revisits the application signInSilently will handle most of it in the background.
Sorry if I miss something or misunderstand the way how I should migrate this implementation. I didn't write the original implementation in this application, and I'm not that much of a flutter developer, but I really want to fix this migration for a customer 😀

On page load a signInSilently() got triggered to sign-in the user in the background if he already signed-in manually before. And on the login button the signIn() will get triggered manually. Both of these scenario's used to fire an event in the onCurrentUserChanged listener, but currently only signIn does that.

@ramonvermeulen That is correct. This happened because the former SDK did authentication+authorization in one step, but now they're two separated clients.
On signInSilently, only authentication happens, so if the plugin gave you an "authenticated but not authorized" user, all your API requests would start failing.
Only when the user is fully authenticated and authorized (after signIn), you get a signed in notification.
silentUserLogin() async {
  _googleSignIn.onCurrentUserChanged.listen((GoogleSignInAccount? account) {
    print("user changed"); // never gets called
  });
  await _googleSignIn.signInSilently();
  await _googleSignIn.requestScopes(_googleSignIn.scopes);
}

You cannot signIn (or requestScopes) without user interaction, because those two methods always trigger opening a popup. I think this previous answer may be helpful in your case. TL;DR:

Try to signInSilently when you build your page. This is probably the code that you already have. That will show the One Tap UX in your page, and if the user agrees, you'll have user authentication information (idToken).
You must signIn or requestScopes in an interactive bit of your app (a button), so users click and the browser allows the pop-up to open. Once this is done, you'll get the authorizationToken.

(Your code is probably already doing 1 and 2 above)

Preferably I want to let the user signIn and request scopes once, and the next times the user revisits the application signInSilently will handle most of it in the background.

That is not going to be possible moving forward, since the new SDK is separating authentication (user ID) from authorization (user permissions). However, if the user has never signed out of your application (or their tokens have expired), their sign-in will be almost automatic (the popup will show up, but will close automatically without users having to do anything extra).

The last line felt a bit weird since I have the following in my index.html

Don't worry about the last line. That's a trick that the new SDK is attempting to do to be "less breaking" with the users of those libraries. In fact, you should not need any script tag for google authentication to work. Check our super-simple example app.
The biggest issue that you might encounter is that API requests from your app might start failing, and users need to re-authorize access to the scopes. The mechanics of authentication should remain the same/similar.

On page load a signInSilently() got triggered to sign-in the user in the background if he already signed-in manually before. And on the login button the signIn() will get triggered manually. Both of these scenario's used to fire an event in the onCurrentUserChanged listener, but currently only signIn does that.

@ramonvermeulen That is correct. This happened because the former SDK did authentication+authorization in one step, but now they're two separated clients.
On signInSilently, only authentication happens, so if the plugin gave you an "authenticated but not authorized" user, all your API requests would start failing.
Only when the user is fully authenticated and authorized (after signIn), you get a signed in notification.
silentUserLogin() async {
  _googleSignIn.onCurrentUserChanged.listen((GoogleSignInAccount? account) {
    print("user changed"); // never gets called
  });
  await _googleSignIn.signInSilently();
  await _googleSignIn.requestScopes(_googleSignIn.scopes);
}

You cannot signIn (or requestScopes) without user interaction, because those two methods always trigger opening a popup. I think this previous answer may be helpful in your case. TL;DR:

Try to signInSilently when you build your page. This is probably the code that you already have. That will show the One Tap UX in your page, and if the user agrees, you'll have user authentication information (idToken).
You must signIn or requestScopes in an interactive bit of your app (a button), so users click and the browser allows the pop-up to open. Once this is done, you'll get the authorizationToken.

(Your code is probably already doing 1 and 2 above)

Preferably I want to let the user signIn and request scopes once, and the next times the user revisits the application signInSilently will handle most of it in the background.

That is not going to be possible moving forward, since the new SDK is separating authentication (user ID) from authorization (user permissions). However, if the user has never signed out of your application (or their tokens have expired), their sign-in will be almost automatic (the popup will show up, but will close automatically without users having to do anything extra).

The last line felt a bit weird since I have the following in my index.html

Don't worry about the last line. That's a trick that the new SDK is attempting to do to be "less breaking" with the users of those libraries. In fact, you should not need any script tag for google authentication to work. Check our super-simple example app.
The biggest issue that you might encounter is that API requests from your app might start failing, and users need to re-authorize access to the scopes. The mechanics of authentication should remain the same/similar.

@ditman Thanks a lot for your clarification! With this information I think I need to redesign the flow in the application a little bit to make this work.
In my case onCurrentUserChanged still does not get triggered after calling requestScopes (manually) when the user is already signed-in with signInSilently. I only manage to get the event triggered with the signIn function. I changed my login function (triggered on manual click) to the following, and signInSilently got called on page load with an event listener on onCurrentUserChanged:
  Future<void> logIn() async {
    try {
      var signedIn = await _googleSignIn.isSignedIn();
      if (signedIn) {
        await _googleSignIn.requestScopes(_googleSignIn.scopes); // does just scopes
      } else {
        await _googleSignIn.signIn(); // does sign-in + scopes
      }
    } catch (error) {
      throw LogInFailure.fromMessage(error.toString());
    }
  }

I can always use signIn instead of requestScopes, but then the whole signInSilently part and one-tap pop-up feels redundant since you have to call signIn anyways?
In my opinion it feels really unnatural that after signInSilently and the GIS pop-up being showed, the user still has to manually click on a button to trigger another pop-up (e.g. requestScopes) to request the authorization scopes. Out of an user perspective if the GIS pop-up is being showed with a chevron the user has the feeling of being signed in. It's quite weird to then have to click on another button to trigger another pop-up to retrieve the right scopes, before being "actually" signed-in into the application. I mean technically you can define the first part as being "signed-in", however in a lot of applications you need additional scopes to be able to actually do something within the application such as calling external API's. In my case it is an application totally build around Google Cloud Search API for which it needs additional scopes.
Out of an implementation perspective I totally get it, they are two different clients one for authentication (GIS one-tap part) and one for authorization (old style pop-up). But for my application it feels more like a step back rather than a step forward.
P.s.
I will clone and test the example app to hopefully get a bit wiser

I can always use signIn instead of requestScopes, but then the whole signInSilently part and one-tap pop-up feels redundant since you have to call signIn anyways?

@ramonvermeulen in your case, maybe it's simpler to just stop doing signInSilently on the web, and just use signIn when the user clicks the sign in button? This would be the same that your current app is doing in case silentSignIn returns a null idToken in the current implementation (?).
About signIn and requestScopes, I don't think you need to over-think this too much. Use signIn. If you still use signInSilently, and users have consented to it, the popup will go straight to the requestScopes part. If the user hasn't completed signInSilently (they're not authenticated in the browser, or they aborted the process), signIn will sign them in, and then requestScopes.

it feels really unnatural that after signInSilently and the GIS pop-up being showed, the user still has to manually click on a button to trigger another pop-up (e.g. requestScopes) to request the authorization scopes. [...] in a lot of applications you need additional scopes to be able to actually do something within the application such as calling external API's. [...] for my application it feels more like a step back rather than a step forward.

I agree. This plugin is just another user of the new GIS SDK and had very little input on its design. In fact, the way this unfolded has us thinking about the future of the Google Sign In plugin(s) as a whole.
I can explain why this is moving to a "two step" process, though! In the near future, idTokens may come straight from the user's web browser rather than Google; for example see FedCM, and FIDO2. In those cases, the Authentication is handled by the browser, locally, but the Authorization process would still need to call the remote service for permissions.
Anyway, thanks for giving this a shot, I hope you manage to work around the quirks of the new SDKs!

I can always use signIn instead of requestScopes, but then the whole signInSilently part and one-tap pop-up feels redundant since you have to call signIn anyways?

@ramonvermeulen in your case, maybe it's simpler to just stop doing signInSilently on the web, and just use signIn when the user clicks the sign in button? Wouldn't this be the same/similar that your current app does when signInSilently returns a null idToken in the current implementation (?).
About signIn and requestScopes, I don't think you need to over-think this too much. Use signIn. If you still use signInSilently, and users have consented to it, the popup will go straight to the requestScopes part. If the user hasn't completed signInSilently (they're not authenticated in the browser, or they aborted the process), signIn will sign them in, and then requestScopes.
The code of the new plugin does what it does to maximize the compatibility with the previous code, without you having to change much about the sign-in flow (for more details, pls look at the full README!)

it feels really unnatural that after signInSilently and the GIS pop-up being showed, the user still has to manually click on a button to trigger another pop-up (e.g. requestScopes) to request the authorization scopes. [...] in a lot of applications you need additional scopes to be able to actually do something within the application such as calling external API's. [...] for my application it feels more like a step back rather than a step forward.

I agree. This plugin is just another user of the new GIS SDK and had very little input on its design. In fact, the way this unfolded has us thinking about the future of the Google Sign In plugin(s) as a whole.
I can explain why this is moving to a "two step" process, though! In the near future, idTokens may come straight from the user's web browser rather than Google; for example see FedCM, and FIDO2. In those cases, the Authentication is handled by the browser, locally, but the Authorization process would still need to call the remote service for permissions.
Anyway, thanks for giving this a shot, I hope you manage to work around the quirks of the new SDKs!

Thanks for the explanation! I eventually got it all working in the application, had to dive a bit into how to persist state with bloc using hydrated bloc and make some structural changes to the application. I save the authHeaders in state now, and log the user out if I get a 403 back from one of the google APIs. The accessToken has a lifetime of 1 hour, so after 1 the user has to manually sign in again. I haven't seen a mechanism to refresh the accessToken yet, or change the lifetime of the accessToken. (Maybe I'm missing something here, if one of these is possible I would be even more happy 😄)
I haven't heard of the FedCM and https://fidoalliance.org/fido2/ concepts before. Thanks for referring to it, makes more sense now why google is separating authentication and authorization to different APIs.

I haven't seen a mechanism to refresh the accessToken yet (can't find a refreshToken in GoogleSignInAuthentication for example), or change the lifetime of the accessToken. (Maybe I'm missing something here, if one of these is possible I would be even more happy 😄 but referring to the docs I guess extending the lifetime is not possible)

@ramonvermeulen This is not possible from the client-side anymore, if you want to extend a users' session, they need to re-authorize the scopes.
The only way that I'm aware of that you get a renew token and all that jazz is if when you use the "Authorization Code" model, which then you use from your server-side to do requests to Google on your users' behalf, behind the scenes.
Then your users access your backend (and not Google's) where you're supposed to have all the data they need.

I eventually got it all working in the application, had to dive a bit into how to persist state with bloc using hydrated bloc and make some structural changes to the application. I save the authHeaders in state now, and log the user out if I get a 403 back from one of the google APIs.

I think a blog post about this, if you have the energy to write it, would be very beneficial to the community. I can't handle all the integrations with all the possible state management solutions, but we can have links to blog posts describing solutions for the most common architectures!

The PR has been reviewed and labeled as autosubmit, it'll land into the repo as soon as it's ready to accept new changes.

Reopening this until we update the core plugin to use the new version!

I haven't seen a mechanism to refresh the accessToken yet (can't find a refreshToken in GoogleSignInAuthentication for example), or change the lifetime of the accessToken. (Maybe I'm missing something here, if one of these is possible I would be even more happy smile but referring to the docs I guess extending the lifetime is not possible)

@ramonvermeulen This is not possible from the client-side anymore, if you want to extend a users' session, they need to re-authorize the scopes.
The only way that I'm aware of that you get a renew token and all that jazz is if when you use the "Authorization Code" model, which then you use from your server-side to do requests to Google on your users' behalf, behind the scenes.
Then your users access your backend (and not Google's) where you're supposed to have all the data they need.

I eventually got it all working in the application, had to dive a bit into how to persist state with bloc using hydrated bloc and make some structural changes to the application. I save the authHeaders in state now, and log the user out if I get a 403 back from one of the google APIs.

I think a blog post about this, if you have the energy to write it, would be very beneficial to the community. I can't handle all the integrations with all the possible state management solutions, but we can have links to blog posts describing solutions for the most common architectures!

Thanks for the information, also nice job on the Migrating to v0.11 section in the readme, explains everything really well in my opinion.
I see, in my case we don't have our own server-side "back-end" for this app. It's just a client calling Google API's for authentication / authorization, and then fetching search results from the Google Cloud Search API (which is basically the back-end). But I don't think it will be that big of a problem that an user has to re-authorize after 1 hour of inactivity, was just wondering if there were other options.
Unfortunately I'm quite packed with work at the moment, so I don't have a lot of time to write a blog post. However, for people reading this and facing the same issues and are already using flutter_bloc as state management solution within their application. Be sure to take a look at hydrated_bloc which is the library I used to persist the bloc state, for instance you can store the authHeaders in here so a user can stay "signed-in" with the required scopes for up to one hour.

in my case we don't have our own server-side "back-end" for this app. It's just a client calling Google API's for authentication / authorization, and then fetching search results from the Google Cloud Search API (which is basically the back-end)

@ramonvermeulen yes, this is the case of many people too, you're not alone :)

I don't think it will be that big of a problem that an user has to re-authorize after 1 hour of inactivity

I think users have to re-authorize after 1 hour (even if they're being very busy with your app!)

I'm quite packed with work at the moment, so I don't have a lot of time to write a blog post.

Again, thanks for giving this a test, checking the documentation and everything! Please, feel no pressure about the blog post at all! It's possible that others will fill the gaps. IMO people finding this issue and knowing that their migration "is possible" is quite a good start!

Hi! @ditman
I have a problem with the new google_sign_in version 6.0.0 on the web.
I call signIn() which returns GoogleSignInAccount. Then I call authentication and hope to get an idToken for my backend as it was in the previous version of the package, but the idToken is null, instead, I have an accessToken which the backend can't exchange on our access token.
Here's my piece of code
  Future<String> signInWithGoogleIdToken() async {
    GoogleSignInAccount? account;

    try {
      account = await googleSignIn.signIn();
    } catch (e) {
      _catchSignInError(e);
    }

    final authentication = await account?.authentication;

    return authentication?.idToken ?? '';
  }

I've read the previous conversation here and think that idToken shouldn't be null.
I suppose this is the working code and it's similar to mine (second one).
I will appreciate it if you can give me some advice on what could happen wrong 🙏

I call signIn() [...], but the idToken is null

@TimYusR, @scrfrk, @NickelGit, @Silipok, @ruslanislan, @JavasquirtDeveloper, @tuanvumaihuynh you're correct. Since signIn now uses the Oauth implicit flow to authenticate and authorize users, an idToken is not being returned there.
If you need the idToken, make sure to call signInSilently when you build your page to give an opportunity to the OneTap UX to grab the idToken (if the user wants to give it to you).
Here's the relevant information about your use case:
https://pub.dev/packages/google_sign_in_web#idtoken-is-null-in-the-googlesigninaccount-object-after-signin
(Since we have received a bunch of feedback regarding this, I'm going to report the lack of an idToken on the Oauth flows as a bug to the GIS team //cc @brdaugherty).

So I need to call signInSilently even if I don't need that. It seems a little bit awkward 😅
@ditman Thanks!

(Since we have received a bunch of feedback regarding this, I'm going to report the lack of an idToken on the Oauth flows as a bug feature request to the GIS team //cc @brdaugherty -> b/270203049).

It seems a little bit awkward 😅

It is, however it was required to make the new SDK behave similarly to the old one to ease the migration of everybody!

A few comments after testing:
1/ using googleSignIn.signIn() works well with firebase auth in the cloud but will break firebase auth emulator since it expects idToken. Error is the following :
firebase_auth/the-auth-emulator-only-support-sign-in-with-google.com-using-id-token,-not-access-token.-please-update-your-code-to-use-id-token
2/ and when using signInSilently followed by signIn as in the following code :
Future googleLogin() async {
    try {
      await googleSignIn.signInSilently();
      final googleUser = await googleSignIn.signIn();
      if (googleUser == null) return;
      _user = googleUser;

      final googleAuth = await googleUser.authentication;

      final credential = GoogleAuthProvider.credential(
        accessToken: googleAuth.accessToken,
        idToken: googleAuth.idToken,
      );

      await FirebaseAuth.instance.signInWithCredential(credential);
      notifyListeners();
    } catch (e) {
      debugPrint(e.toString());
    }
  }

It works well on a chrome session that already knows my google account, however it fails in an incognito window.
In the incognito window, first click on the login button open the signIn popup dialog (and I suppose it fails to get the idToken because signInSilently failed). However, I would have expected that a retry on the login button would work and instead I get the following error :

@ditman

"I would have expected that a retry on the login button would work"

@pldelattre It doesn't work, because the retry needs to be done by signInSilently. You should probably refresh the incognito window after sign-in, to let the signInSilently process to work?

"I would have expected that a retry on the login button would work"

@pldelattre It doesn't work, because the retry needs to be done by signInSilently. You should probably refresh the incognito window after sign-in, to let the signInSilently process to work?

If you look at my googleLogin() function in the message above which is the function I call with the button, you can see that the first line is calling signInSilently and this is why I expected a retry on the button to work. Unfortunately, it does not.

the first line is calling signInSilently and this is why I expected a retry on the button to work. Unfortunately, it does not.

Please, check the JS Console of the browser (in development mode) for logging, it'll let you know if the OneTap UX decided to not show up for any reason. There's a few reasons why the "One Tap UX" may not show, it's smart. Please, use signInSilently as advised: when you build your pages, and not as part as your "signIn" button implementation.
There's also an internal bug that I'm trying to get solved to make this much simpler for everybody; as mentioned here.

With the current solution it feels a bit strange, since google silent login will always be triggered on my LoginPage (using it as stated in the example within the initState). My LoginPage contains multiple login options not only google, so google should only be triggered to make any call to google services once the user decides to use it for login but not in advance.

My LoginPage contains multiple login options not only google, so google should only be triggered to make any call to google services once the user decides to use it for login but not in advance.

@c-seeger yes, you're right.  In that case, GSI recommends this:

Display the Sign In With Google button

This is a missing feature of the current google_sign_in_web. Could you create a new issue so we can discuss its implementation separately from the more general plugin?
(There's also the problem that users authenticating there would still not authorize scopes however!)

I originally had the code
  GoogleSignIn googleSignIn = GoogleSignIn(
    clientId: constants.WEB_GOOGLE_CLIENT_ID,
  );

  GoogleSignInAccount? account = await googleSignIn.signIn();
  GoogleSignInAuthentication? auth;
  if (account != null) {
    auth = await account.authentication;
  }

  AuthResponse? signInRes;
  AuthException? error;
  if (auth?.idToken != null) {
    try {
      signInRes = await AuthService.signInWIthOpenID(
        idToken: auth!.idToken!,
        provider: Provider.google,
      );
    } on AuthException catch (e) {
      error = e;
    }
  }

And this code gave me the error: The OAuth token was not passed to gapi.client, since the gapi.client library is not loaded in your page.
And reading comments it looks like I should be calling signInSilently first. Silently signing in works, but then calling signIn just hangs.

Hello all who must have an idToken!
I'm currently implementing the "Google Sign In Button" flow for the web. Please, follow the progress in the corresponding places:

The issue: https://github.com/flutter/flutter/issues/121781
The WIP: https://github.com/flutter/packages/pull/3461

The PR adds the "Google Sign In Button" as a Flutter for Web Widget, so Web apps can use that instead of the programmatic signIn code.
It also adds a canAccessScopes method so the app can check if a logged-in user still has permissions to access all the scopes that are needed.
Also also: updates the example app to see all the new changes "in action".
(PS: I think we should stop updating this issue. Let's continue the conversation in the issues/PRs that are being actively worked on, or on new ones for anything new that might show up. Thanks for reading!)

hey @ramonvermeulen how did you fix your issue with [GSI_LOGGER-TOKEN_CLIENT]: The OAuth token was not passed to gapi.client, since the gapi.client library is not loaded in your page.? just using signIn() instead of signInSilently() doesn't work for me


Modify SmartFund token info

.json and .png document checklists

[X] logo dimensions: 120*120 px
[X] logo background: Transparent
[X] At least one transaction on the token contract
[X] For ERC-20 project teams: Upper and lower capitalized alphabets in token address (For checksum purposes)
[x] Same document name for both .json and .png (Including capitalization)

Project background:
Official announcement:#imToken #4653 We are providing SF token’s information on imToken. After completion, you can see the logo and full information inside imToken’s Token Manager.
Project team background:The SmartFund team is located at Singapore. The core members have more than 10 years of experience in Internet product development, and they are also a technical team in the field of early research blockchain. At present, there are more than a dozen members of the team, which gathers the core technology development elites of the wallets, BPs, mining, trading, etc., and has experience in operating LBTC Block Producer.
Project basic information:The SmartFund is a set of smart contracts and tokens running on Ethereum. The smart investment ecosystem consists of a $mart Fund and a number of DAPP projects invested, the core goal is to use the smart contract to achieve a digital currency decentralized investment in the DAPP projects with clear profit model. The democratic vote participates in the investment decision and automatically distributes the project revenue in real time.
Tradeable exchanges:https://coinx.exchange
Recommended Gas Limit (For ERC-20 project teams) for transaction: 5000000

@tstt  I modified the symbols and icons of the token, but they are not updated in the Imtoken. Could you please check it out? Thank you~

@tstt I modified the symbols and icons of the token, but they are not updated in the Imtoken. Could you please check it out? Thank you~

Sorry, we've fixed the update issues, you can pull request again. We'll check with it asap.

@tstt I modified the symbols and icons of the token, but they are not updated in the Imtoken. Could you please check it out? Thank you~

Sorry, we've fixed the update issues, you can pull request again. We'll check with it asap.

It doesn't matter, please check #4707 .


Hotfix/sf star update

Are you a current Fivetran customer?

Fivetran created PR
What change(s) does this PR introduce?

With the patch release of dbt-utils v0.7.3 the snowflake uppercase fix no longer is needed and thus is removed from relevant models.
Does this PR introduce a breaking change?

[ ] Yes (please provide breaking change details below.)
[X] No  (please provide explanation how the change is non breaking below.)

This simply removes a Snowflake conditional that is no longer needed and is actually breaking users runs currently.
Is this PR in response to a previously created Issue

[x] Yes https://github.com/fivetran/dbt_iterable/issues/9
[ ] No

How did you test the PR changes?

[x] CircleCi
[ ] Other (please provide additional testing details below)

Select which warehouse(s) were used to test the PR

[X] BigQuery
[X] Redshift
[X] Snowflake
[X] Postgres
[ ] Databricks
[ ] Other (provide details below)

Provide an emoji that best describes your current mood

🧯
Feedback
We are so excited you decided to contribute to the Fivetran community dbt package! We continue to work to improve the packages and would greatly appreciate your feedback on our existing dbt packages or what you'd like to see next.

Looks good!
I have one small question regarding if we truly need to keep the set function in one space. I believe we should be able to simply remove this. Let me know your thoughts and then you can have me re-review in case there are any other changes based off my comment.
Thanks!

Thanks for pointing that out. I updated the PR; check has passed if you'd like to re-review!


Potential gaps to address prior to intial release & implemenation

In reviewing the current baseline(1) I've come across a few things that could be gaps, oversights, or perhaps were intentionally removed for some reason.  I'd like the group to discuss if we want to included them so we better align with industry frameworks and the initial TAC proposal(2).  I perhaps overlooked something we have already, but perhaps it was phrased in a way that didn't make it obvious to me the goals were the same.

Generate SBOMs
Only release signed artifacts
Run automated tools and scanners to find defects and vulns
Review dependencies for security & quality
No hard-coded secrets or hard-coded accounts
Data protections at rest, in use, and in transit
Handling data/PII
SLSA lvls?
Logging enabled
Documented project requirements, including security requirements
Threat Modeling/Attack surface analysis

Thanks in advance for the group feedback.
(1) - https://github.com/ossf/security-baseline/blob/main/baseline.md
(2) - https://github.com/ossf/tac/blob/main/process/security_baseline.md

So, I had thought we simplified the baseline to get started with the plan to iterate, but it does seem like there's a lot less there than what I remember us discussing. With that said some of the ones you stated above don't necessarily make sense to me.
Here's my general thoughts on the stated requirements:
For generating SBOMS, I lumped it into the SCA requirements, but reading closer we have a requirement to deal with SCA results but nothing in there says SCA should be run.
I actually think we should go beyond signed releases. In general signed artifacts don't really say anything at least compared to SLSA or even a signed SBOM.
Not clear what Logging enabled means (logging on Github for the project?, logging in the app itself?)

A take away for me is if we start to go down this path does it make more sense to just adopt something like a subset of NIST 800-53, NIST 800-218, along with a few things specific to LF and then call it a day? If the idea is to align with existing stuff I think SSDF and associated NIST stuff already hits everything we want to hit, and then the baseline can focus on how to make that scalable for projects in the open source space.

Application-related criteria can be moved to required values in Security Insights, which could then be made into automated checks (OR, in baseline we could require docs for these):

Logging enabled by default
Default handling of data/PII
Data protections at rest, in use, and in transit

I propose we create a PR to add the following issues unless we can find them to be already covered:

Only release signed artifacts
Run automated tools and scanners to find defects and vulns (SAST)
Review dependencies for security & quality (SCA)
No hard-coded secrets or hard-coded accounts
Threat Modeling
Data flow analysis (modify actors and actions?)

The following items should be discussed further:

Generate SBOM
SLSA lvls
Documented project requirements, including security requirements

So, I had thought we simplified the baseline to get started with the plan to iterate, but it does seem like there's a lot less there than what I remember us discussing. With that said some of the ones you stated above don't necessarily make sense to me.
Here's my general thoughts on the stated requirements:
For generating SBOMS, I lumped it into the SCA requirements, but reading closer we have a requirement to deal with SCA results but nothing in there says SCA should be run.
I actually think we should go beyond signed releases. In general signed artifacts don't really say anything at least compared to SLSA or even a signed SBOM.
Not clear what Logging enabled means (logging on Github for the project?, logging in the app itself?)
A take away for me is if we start to go down this path does it make more sense to just adopt something like a subset of NIST 800-53, NIST 800-218, along with a few things specific to LF and then call it a day? If the idea is to align with existing stuff I think SSDF and associated NIST stuff already hits everything we want to hit, and then the baseline can focus on how to make that scalable for projects in the open source space.

Thanks Mike, I appreciate the feedback.  I started efforts to line up our Baseline with a few frameworks.  Generally, I agree with the idea, and would prefer to pin on something like the SSDF rather than 800-53 (which is an operations standard for enterprises that has little to do with software development directly).  Eddie and I are chatting today about these topics and will come back to the group with some suggestions on if we identify "must haves" we want to pull into the Baseline before it goes out the door.


Smart Select doesn't show me anything

Hi guys? I have the next problem, i'm update django-smart-selects and now it doesn't works.
I don't know why, at first, i think that problem was django-jet:

I have a chained foreingkey between affiliates withg membership through entity's name. I select a Entity and Membership field doesn't load anything.

First, if i don't put USE_DJANGO_JQUERY = False i haven't any jquery load file, yes, i haven't now jquery and i think i won't put jquery in admin/js, will be great put a custom jquery file path.

Ok, i put USE_DJANGO_JQUERY = False and this load a Google CDN jquery, but, wrong version. I have these problem and i don't understand which warning is.

Ok, i put the newest jquery  Google CDN link and nothing errors but, can you see any estrange here? Oh yeah, anything, memberships fields load nothing. Why?

You can think, there aren't any membership with juridical entity type, isn't, as you can see.
You can think, it's a problem from django-jet, good, i though this and i test without django-jet:

I test each one of the previous steps and i have the same problems.
So, i don't know why happen this if with previous django-smart-selects versions i hadn't problems. And, i haven't idea for what do, because, as you can see, i haven't any errors in firefox console, so, i'm lost.
System check identified no issues (0 silenced).
February 02, 2016 - 22:56:01
Django version 1.9.2, using settings 'ccct.settings'
Starting development server at http://<IP_ADDRESS>:8000/
Quit the server with CONTROL-C.

Django info.
Thank you for your help
PD: Where are Form's build docs? I have do anything for use smart_selects in forms?
Anyone have problem with the actual version?
@jimmykobe1171 What's about this?

@SalahAdDin could you have a try of the version on branch master? I have fix some Jquery issue on Django 1.9.

@SalahAdDin Please test against master.

Version 1.2.6 - which was released on PyPI a few days ago - fixed a few issues with no results being returned and a previous released version allowed for disabling automatically loading jQuery (use USE_DJANGO_JQUERY = None and load jQuery yourself for that - see the updated README for more).
I'm going to close this because I suspect that both issues are now fixed, but feel free to reopen if they aren't fixed in version 1.2.6 or the master branch on GitHub. Thanks!

Ok, thank you!


Test Freecen2 deployment process

Step 1 has been completed on my server. There were just 3 code conflicts. Resolved

Step 2 has been started; my own tests showed nothing odd.
Have asked @SteveBiggs  and @Sherlock21 if they would kick it

Have done basic tests of test2 CEN for Step 3. Looks OK so will proceed to step 4

I had a good play with test2 REG and found no problems.

@SteveBiggs Thanks very much Steve I owe you one

Been away for a couple of days, so only just got started.
and of course I wrecked Test2 at the first chance!
I decided to look up Location of a place name.
chose DEV / Sidmouth which I clicked on in the alphabetic list of Active Places.
Got this. (  repeated the test and got the same)
SO I have stopped - Eric B
On 3 Nov 2020, at 23:47, Kirk Dawson<EMAIL_ADDRESS>wrote:
Step 2 has been started; my own tests showed nothing odd.
Have asked @SteveBiggs https://github.com/SteveBiggs and @Sherlock21 https://github.com/Sherlock21 if they would kick it
—
You are receiving this because you were mentioned.
Reply to this email directly, view it on GitHub https://github.com/FreeUKGen/FreeCENMigration/issues/1035#issuecomment-721433882, or unsubscribe https://github.com/notifications/unsubscribe-auth/ACHPJAAHZCJZZZMMYHL4XY3SOCJBTANCNFSM4TJATFIQ.

Kirk
forget the item below.
I had not realised I had to swap the url to CEN
will have another try later when I am back from garage.\Eris
On 5 Nov 2020, at 12:12, Eric Booker<EMAIL_ADDRESS>wrote:
Been away for a couple of days, so only just got started.
and of course I wrecked Test2 at the first chance!
I decided to look up Location of a place name.
chose DEV / Sidmouth which I clicked on in the alphabetic list of Active Places.
Got this. (  repeated the test and got the same)
SO I have stopped - Eric B
On 3 Nov 2020, at 23:47, Kirk Dawson<EMAIL_ADDRESS><EMAIL_ADDRESS>wrote:
Step 2 has been started; my own tests showed nothing odd.
Have asked @SteveBiggs https://github.com/SteveBiggs and @Sherlock21 https://github.com/Sherlock21 if they would kick it
—
You are receiving this because you were mentioned.
Reply to this email directly, view it on GitHub https://github.com/FreeUKGen/FreeCENMigration/issues/1035#issuecomment-721433882, or unsubscribe https://github.com/notifications/unsubscribe-auth/ACHPJAAHZCJZZZMMYHL4XY3SOCJBTANCNFSM4TJATFIQ.

Kirk
ignore this one please.!
the other email with the Error details still stands
EB
On 5 Nov 2020, at 13:17, Eric Booker<EMAIL_ADDRESS>wrote:
Kirk
forget the item below.
I had not realised I had to swap the url to CEN
will have another try later when I am back from garage.\Eris
On 5 Nov 2020, at 12:12, Eric Booker<EMAIL_ADDRESS><EMAIL_ADDRESS>wrote:
Been away for a couple of days, so only just got started.
and of course I wrecked Test2 at the first chance!
I decided to look up Location of a place name.
chose DEV / Sidmouth which I clicked on in the alphabetic list of Active Places.
Got this. (  repeated the test and got the same)
SO I have stopped - Eric B
On 3 Nov 2020, at 23:47, Kirk Dawson<EMAIL_ADDRESS><EMAIL_ADDRESS>wrote:
Step 2 has been started; my own tests showed nothing odd.
Have asked @SteveBiggs https://github.com/SteveBiggs and @Sherlock21 https://github.com/Sherlock21 if they would kick it
—
You are receiving this because you were mentioned.
Reply to this email directly, view it on GitHub https://github.com/FreeUKGen/FreeCENMigration/issues/1035#issuecomment-721433882, or unsubscribe https://github.com/notifications/unsubscribe-auth/ACHPJAAHZCJZZZMMYHL4XY3SOCJBTANCNFSM4TJATFIQ.

Eric, it is unclear to me what actions you took and your error does not show up in your post.
Please detail precisely what action buttons you pressed and what error you saw.

The problem @Sherlock21 was having was looking at an active place in devon called sidmouth. The system crashed. I was able to duplicate and fix.
Actually it was nothing to do with the actual code base at all but a configuration setting on development that raised an error when it could not find a file. Normally we ask the server to respond with a nil and our code works around the problem.
I have changed the setting and the system no longer crashes.
@sherlock is welcome to kick some more

@SteveBiggs @Sherlock21 I have confirmed that the sits does exactly the same thing running the master code. Suspect it is a result of the trapping of communications from test2. The logs tell me that the download file si prepared.
Do not believe this is an issue that should stop us deploying the master code with the CEN2 code changes.
Thank you both.

OK, I go with your proposal.
you have a better grasp of the overall picture than I do.
Eric B
On 7 Nov 2020, at 23:56, Kirk Dawson<EMAIL_ADDRESS>wrote:
@SteveBiggs https://github.com/SteveBiggs @Sherlock21 https://github.com/Sherlock21 I have confirmed that the sits does exactly the same thing running the master code. Suspect it is a result of the trapping of communications from test2. The logs tell me that the download file si prepared.
Do not believe this is an issue that should stop us deploying the master code with the CEN2 code changes.
Thank you both.
—
You are receiving this because you were mentioned.
Reply to this email directly, view it on GitHub https://github.com/FreeUKGen/FreeCENMigration/issues/1035#issuecomment-723510721, or unsubscribe https://github.com/notifications/unsubscribe-auth/ACHPJACJJVUFACE45NJVIQTSOXNEFANCNFSM4TJATFIQ.

Have tested Freereg on test2.
Have tested Freecen on test2


GGUF Support for LLMs

By when can we expect GGUF support in CTransformers? Llama.cpp and Kobold already support GGUF.

Added GGUF format support for Llama and Falcon models in the latest version 0.2.24


public-server option not implemented on windows

it needs the openssl binary which exists on windows, but is not standard.
or maybe there's a better way that's more native?
https://github.com/twosigma/beaker-notebook/blob/master/core/src/main/java/com/twosigma/beaker/core/module/config/DefaultBeakerConfig.java#L175 is where it is run.

Is this problem fixed yet? When I try to launch public server on windows I get:
Exception in thread "main" com.google.inject.ProvisionException: Guice provision errors:

1) Error injecting constructor, java.io.IOException: Cannot run program "sh": CreateProcess error=
2, The system cannot find the file specified
  at com.twosigma.beaker.core.module.config.DefaultBeakerConfig.<init>(DefaultBeakerConfig.java:89
)
  at com.twosigma.beaker.core.module.config.DefaultBeakerConfig.class(DefaultBeakerConfig.java:89)

  while locating com.twosigma.beaker.core.module.config.DefaultBeakerConfig
  while locating com.twosigma.beaker.core.module.config.BeakerConfig
    for parameter 0 at com.twosigma.beaker.core.rest.PluginServiceLocatorRest.<init>(PluginService
LocatorRest.java:73)
  at com.twosigma.beaker.core.module.URLConfigModule.configureServlets(URLConfigModule.java:77)
  while locating com.twosigma.beaker.core.rest.PluginServiceLocatorRest

And long uninformative stacktrace after that.

And why not to use JSSE which is part of JVM in case native library is not found? I believe that openSSL is better for very high workloads, but still it is better to have some slower client than to have none.


maximize pane to center of screen

Hi,
I was reading your post about the maximize pane to a new window and it seems to come close to something im interested in.  I started using a 4k monitor recently.  When I maximize my tmux pane, all of the text goes very far to the left since the high resolution can fit so many panes.  This has been straining my neck.  What I'd like is to be able to center the zoomed pane in my monitor.  Have you thought about this at all?  Is it possible doing something like your maximize_pane() function?
thanks

I'm afraid it's not possible in tmux. There's no way to e.g. have a single pane in a window and reduce its dimensions and center it.

okay, thank you.


get-imports does not search for root dir

cd some_dir
flow get-imports ~/some_other_dir/foo.js

runs flow in some_dir (the cwd) and errors saying it can't find ~/some_other_dir/foo.js. it succeeds if you pass --root, like this:
flow get-imports --root ~/some_other_dir ~/some_other_dir/foo.js

get-imports should act like all other commands and guess the root from the path, unless overridden by --root.

This command no longer exists.


[Refactor] SegmentsStats#filesSizes from ImmutableOpenMap to java.util.Map

Using an ImmutableOpenMap in o.o.index.engine.SegmentsStats#filesSizes is overkill since all we care about is public facing API not leaking the filesSizes collection. To remove all of the unnecessary temporary object copies saddled with using ImmutableOpenMap internally, this PR refactors the SegmentsStats#filesSizes variable from an ImmutableOpenMap to an unmodifiable java.util.Map. It also refactors the internal only used FILE_DESCRIPTIONS static variable to an unmodifiable java.util.Map in order to completely remove SegmentsStats dependency on hppc based ImmutableOpenMap.
relates #5910

Gradle Check (Jenkins) Run Completed with:

RESULT: FAILURE ❌
URL: https://build.ci.opensearch.org/job/gradle-check/13850/
CommitID: fce11ab
Please examine the workflow log, locate, and copy-paste the failure(s) below, then iterate to green.
Is the failure a flaky test unrelated to your change?

Doc count assertion failure, seems non-related to changes. Retrying check.
REPRODUCE WITH: ./gradlew ':modules:geo:internalClusterTest' --tests "org.opensearch.geo.search.aggregations.bucket.GeoTileGridIT.testMultivaluedGeoPointsAggregation" -Dtests.seed=73A6EB980B2F13B4 -Dtests.security.manager=true -Dtests.jvm.argline="-XX:TieredStopAtLevel=1 -XX:ReservedCodeCacheSize=64m" -Dtests.locale=is -Dtests.timezone=Africa/Addis_Ababa -Druntime.java=19

org.opensearch.geo.search.aggregations.bucket.GeoTileGridIT > testMultivaluedGeoPointsAggregation FAILED
    java.lang.AssertionError: Geohash 13/1627/7465 has wrong doc count  expected:<0> but was:<1>
        at __randomizedtesting.SeedInfo.seed([73A6EB980B2F13B4:BE14626187F3995E]:0)
        at org.junit.Assert.fail(Assert.java:89)
        at org.junit.Assert.failNotEquals(Assert.java:835)
        at org.junit.Assert.assertEquals(Assert.java:647)
        at org.opensearch.geo.search.aggregations.bucket.GeoTileGridIT.testMultivaluedGeoPointsAggregation(GeoTileGridIT.java:128)

I opened #7101 for the unrelated GeoHashGridIT failure. Rerunning the cancelled precommit job and will merge on green.


[REQ] Add data encryption of database

Describe the problem that needs solving
An additional request tied to issue #24    Hopefully adding an additional layer of data protection to user of Quacker
Describe the solution you'd like
I'd like to suggest the use of SQLCipher within the app, it's a fork of SQLite and should hopefully be mostly a drop in replacement.   This would add a layer of protection to the data the app holds

I am working on this to be published in the next minor release 2.2.0

I am looking into this, keep your eyes peeled for updates

Please create this issue in fritter instead
https://github.com/jonjomckay/fritter/issues/new/choose


Use symbol table to generate fresh names in InsertRefCounting

Add name mangling pass to make VarIds globally unique
Use slightly more esoteric mangling to avoid clashes
Actually update the varNames map
Make LambdaLift use manglenames
Fix Lambda lift pass
Fix things after different binder structure
Still broken, waiting for types to appear in binders
Ok ok ok ok
Get it compiling
Passtests
Some small fixes
Use symbol table to generate fresh names in InsertRefCounting

actually, no point in breaking up this into a separate commit. This commit will be rolled in together with #120


Add Hook Support

Depends on: https://github.com/konveyor/mig-operator/pull/247
After talking with Derek on 3/20 we agreed the following things should be done at a minimum:
Outstanding work:

[x] Allow any phase to run on either source or destination cluster
[x] Add remote_watcher so we receive events
[x] Move from PollReque to event watching
[x] Fix/Add correlation labels
[x] Use generateName to ensure hook name uniqueness
[x] Use correlation labels / List to retrieve existing resources instead of client.Get
[x] Add predicates for jobs so we don't trigger on unrelated jobs
[x] Ensure failed jobs don't cause eternal hangs and fail the plan
[x] Validations
[x] Fix Phase Label
[x] Add hook validation on migplan
[x] Add Spec.Playbook validation
[x] Add Documentation (I will add this in usage docs in the operator repo as part of the operator PR)

The controller is starting up and writing status at this point.
$ oc logs -f -c cam migration-controller-6964858db6-8bnh2 | grep hook
{"level":"info","ts":1583860309.7292616,"logger":"kubebuilder.controller","msg":"Starting EventSource","controller":"mighook-controller","source":"kind source: /, Kind="}
{"level":"info","ts":1583860309.730713,"logger":"entrypoint","msg":"setting up webhooks"}
{"level":"info","ts":1583860316.5370944,"logger":"kubebuilder.controller","msg":"Starting Controller","controller":"mighook-controller"}
{"level":"info","ts":1583860316.637221,"logger":"kubebuilder.controller","msg":"Starting workers","controller":"mighook-controller","worker count":1}

$ oc get mighook -o yaml test
apiVersion: migration.openshift.io/v1alpha1
kind: MigHook
metadata:
  creationTimestamp: "2020-03-10T17:03:11Z"
  generation: 2
  name: test
  namespace: openshift-migration
  resourceVersion: "2252114"
  selfLink: /apis/migration.openshift.io/v1alpha1/namespaces/openshift-migration/mighooks/test
  uid: 29ecb916-dfd0-4316-bbf0-d210408cad6d
spec:
  image: quay.io/konveyor/hook-runner:latest
  namespace: openshift-migration
  playbook: |
    - hosts: localhost
      gather_facts: false
      tasks:
      - debug:
          msg: "Test"
status:
  conditions:
  - category: Required
    lastTransitionTime: "2020-03-10T17:11:56Z"
    message: The storage is ready.
    status: "True"
    type: Ready
  observedGeneration: 2

@jortel @djwhatle could I get another review to let me know what you'd like to see changed, fixed, or added before merging?

Validations have been added:

Documentation of the feature:
https://github.com/konveyor/mig-operator/blob/5d164f27d29e99bb65048632685bb2ef35e100f5/docs/usage/10.md

Confirming the validation to prevent more than one hook per phase exists:
https://github.com/konveyor/mig-controller/pull/448/files#diff-1614d4fe57af8f3e7157ccc87313a6d3R1085-R1115

@jmontleon are there mig-operator CRDs associated with this PR? If so, can we link them?

@djwhatle it was merged at the same time as this: https://github.com/konveyor/mig-operator/pull/247

I also pushed the updated metadata to quay


Add FRC Colors integration to v2 bubble chart

Congrats on the v2 release!
This PR adds the FRC Colors integration to the v2 bubble chart component. By default, colors are set to disabled, and can be enabled with a switch. Colors are hidden if their contrast ratio with the background is too low. This accounts for light/dark themes. There is no longer a limit on how many teams can be queried at once.

Thanks for the PR! The Statbotics API that the new frontend subscribes to actually has a primary_color and secondary_color fields from FRC Colors to reduce website network requests (also reduces queries to TBA, Chezy Arena, etc.)
I need to do some more work to expose the primary and secondary colors in the website through the data context. I'll put this PR on hold until I do that (and probably the team, event, and match pages). For what it's worth, I think most people will use the V1 website until these features are complete anyways.

Ah, got it, thanks for the info. Feel free to adapt any parts of the PR you think would be useful once the colors are exposed from the Statbotics end.


Feat: drop mutable()

Is your feature request related to a problem?
mutable() is today required becasue otherwise the serialization runtime would serialize a lot of data. However it's an smelly API that makes little sense from developers point of view.
Before 1.0, this API should be done.
Describe the solution you'd like

Props are mutable by default from the outside, however the optimizer will be able to mark with props are static.
Runtime optimazation when the component only leaks if the parent component can rerender.
mutable() might stay (probably converted into a different api) only as an advanced topic for further optimization.
Maybe: only serialize props, not internal component state (this is tricky)

Describe alternatives you've considered
Keep mutable()
Fully leverage on signals
Additional context
No response

Fixed!