Accessing the google calendar using a refresh token

Question

Is this the right way to access the google calendar api using a refresh token? That's 2 weeks after a user gave me his consent.

const oauth2Client = new google.auth.OAuth2(
    process.env.GOOGLE_OAUTH_CLIENT_ID,
    process.env.GOOGLE_OAUTH_CLIENT_SECRET,
    process.env.DOMAIN_NAME + "/google/oauth/callback"
);


 oauth2Client.setCredentials({
        refresh_token: refreshToken
    })
    const calendar = google.calendar({version: "v3", auth: oauth2Client});
    calendar.events.watch({
        auth: oauth2Client,
        resource: {
            id: makeid(10) + Date.now(),
            token: process.env.GOOGLE_API_WATCH_TOKEN,
            type: 'web_hook',
            address: "https://" + process.env.DOMAIN_NAME + "/google/notifications"
        },
        calendarId: "primary"
    }, function(error, response) {
        if (error) {
            defer.reject(error);
        } else {
            defer.resolve(response);
        }
    });
    return defer.promise;

I'm not using jwt.

Answer 1

Your code shows a valid approach to token handling if it doesn't generate any issues. As an answer, I show below an alternative to OAuth 2.0 token handling.

This code will first read the token file with the readFile method. Then it will be fed to the authorize function. That function will set up the objects used on the authentication flow, and if it fails (due to an invalid token, per example) then it will call the getAccessToken function to gather new tokens.

const fs = require('fs');
const readline = require('readline');
const {
  google
} = require('googleapis');

const SCOPES = ['{YOUR SCOPES HERE}'];
const TOKEN_PATH = 'token.json';


fs.readFile('credentials.json', (err, content) => {
  if (err) return console.log('Error loading client secret file:', err);
  authorize(JSON.parse(content), listEvents);
});


function authorize(credentials, callback) {
  const {
    client_secret,
    client_id,
    redirect_uris
  } = credentials.installed;
  const oAuth2Client = new google.auth.OAuth2(
    client_id, client_secret, redirect_uris[0]);


  fs.readFile(TOKEN_PATH, (err, token) => {
    if (err) return getAccessToken(oAuth2Client, callback);
    oAuth2Client.setCredentials(JSON.parse(token));
    callback(oAuth2Client);
  });
}


function getAccessToken(oAuth2Client, callback) {
  const authUrl = oAuth2Client.generateAuthUrl({
    access_type: 'offline',
    scope: SCOPES,
  });

  console.log('Authorize this app by visiting this url:', authUrl);

  const rl = readline.createInterface({
    input: process.stdin,
    output: process.stdout,
  });

  rl.question('Enter the code from that page here: ', (code) => {
    rl.close();
    oAuth2Client.getToken(code, (err, token) => {
      if (err) return console.error('Error retrieving access token',
        err);
      oAuth2Client.setCredentials(token);
      fs.writeFile(TOKEN_PATH, JSON.stringify(token), (err) => {
        if (err) return console.error(err);
        console.log('Token stored to', TOKEN_PATH);
      });
      callback(oAuth2Client);
    });
  });
}

Please write back if you have doubts about this approach or your own.