feat: Create google sign in button and send id token with request

[duwenxin99]

No description provided.

[kurtisvg]

Do we need to refresh the user_id_token when it expires? If so, how is that handled?

[duwenxin99]

Both the ID tokens ("Authorization" field for cloud run and "User-Id-Token" for user authentication) expire after one hour. I could add a refresher function to re-acquire the headers once every hour in a separate PR maybe?

[kurtisvg]

Does the session support dynamic credentials? If not we probably need to switch to grabbing the credentials on the fly

[kurtisvg]

I think this needs up be updated to be dynamic -- this changes when we are deployed to cloud run

[duwenxin99]

set to use referer url

[kurtisvg]

delete this line

[kurtisvg]

We should follow up on this -- it needs to be more intentional to reset history here

[kurtisvg]

Probably should add a new endpoint reset-- update the session data, removes history, and deletes agent under the hood

[duwenxin99]

Addressed in merged PR: #152

[kurtisvg]

This needs to be a required parameter

[duwenxin99]

Deleted default value and added check if credential exists

[kurtisvg]

should this be hardcoded to localhost?

[duwenxin99]

Changed to dynamic URL.

[kurtisvg]

Suggested change

	if "http://" in BASE_URL:
	headers = None
	else:
	# Append ID Token to make authenticated requests to Cloud Run services
	headers = {
	"Authorization": f"Bearer {get_id_token()}",
	}
	headers = {}
	if "http://" not in BASE_URL:
	# Append ID Token to make authenticated requests to Cloud Run services
	headers["Authorization"] = f"Bearer {get_id_token()}",

[duwenxin99]

modified if else statement

[kurtisvg]

delete this line

[kurtisvg]

Delete these two lines as well

[duwenxin99]

deleted

[kurtisvg]

Suggested change

	def get_id_token() -> str:
	"""Helper method to generate ID tokens for authenticated requests"""
	# Use Application Default Credentials on Cloud Run
	if os.getenv("K_SERVICE"):
	auth_req = google.auth.transport.requests.Request()
	id_token = None # (token, expiry_time)
	def get_id_token() -> str:
	"""Helper method to generate ID tokens for authenticated requests"""
	if id_token is None or id_token[1] <= time.now():
	auth_req = google.auth.transport.requests.Request()
	token = google.oauth2.id_token.fetch_id_token(auth_req, BASE_URL)
	id_token = (token, datetime.now() + timedelta(minutes=55))

[duwenxin99]

We still need to use the shell command 'gcloud auth print-identity-tokenbecausegcloud auth login` does not set Application Default Credential for local development: https://www.googlecloudcommunity.com/gc/Serverless/fetch-id-token-or-equivalent-locally-with-gcloud-non-default/m-p/552409

[kurtisvg]

Why are we updating this?

[duwenxin99]

It's a little irrelevant to this PR. The instruction says to open the page localhost://8081 to view the assistant, but if the 8081 port isn't specified, uvicorn default runs on 8080 so 8081 would be empty.

[kurtisvg]

Averi and I talked about this a bit and we think this is the right solution here:

Suggested change

	def get_id_token():
	global CLOUD_RUN_CREDENTIALS
	if os.getenv("K_SERVICE"):
	auth_req = google.auth.transport.requests.Request()
	if CLOUD_RUN_CREDENTIALS is None:
	CLOUD_RUN_CREDENTIALS = google.oauth2.id_token.fetch_id_token_credentials(
	BASE_URL, auth_req
	)
	if not CLOUD_RUN_CREDENTIALS.valid:
	CLOUD_RUN_CREDENTIALS.refresh(auth_req)
	else:
	# Use gcloud credentials locally
	import subprocess
	return (
	subprocess.run(
	["gcloud", "auth", "print-identity-token"],
	stdout=subprocess.PIPE,
	check=True,
	)
	.stdout.strip()
	.decode()
	)
	return CLOUD_RUN_CREDENTIALS.token
	def get_id_token():
	global CREDENTIALS
	if CREDENTIALS is None:
	CREDENTIALS, _ = google.auth.default()
	if not CREDENTIALS.valid:
	CREDENTIALS.refresh(Request())
	return CREDENTIALS.id_token