using Berry with Google drive API

[btsimonh]

Q: Has anyone got a sample of authenticating and accessing google APIs from Berry?
e.g. uploading a file to GDrive?

I found a curl/scripting description here:
https://medium.com/@nschairer/automating-google-drive-uploads-with-google-drive-api-curl-196989ffb6ce

It looks like you can create a service account, share a folder with it, and create an access key (json file?).
But from this key, you then need to create a token (jwt?) dynamically, signed with the key.
This goes well beyond my Berry ablities... although it looks like we have the crypto parts available to do such things

(use case: posting jpeg images to google drive for a timelapse recording implementation, or motion detection).

[barbudor]

I don't know about Drive upload but RandomNerdsTutorials have a few instructions on how to directly write data to a Google sheet. That doesn't involve using a service account.
Samples are for Arduino or Micropython but should be easily transposable to Berry

Regarding service account and token, this is not much about Berry. You do that once in the GCloud console.
Then you just use Berry http client.
However I never tried to PUT a file, only GET or POST so far

[s-hadinger]

There is a much simpler way to extract the key:

var private_key_DER = bytes().fromb64(string.split(private_key, '\n')[1..-3].concat())

var private_key_DER = bytes().fromb64(string.split(private_key, '\n')[1..-3].concat())
print(private_key_DER.tohex())
# 308204BF020100300D06092A864886F70D0101010500048204A9308204A50201000282010100BB5494D4B7D52CF1C2A333311F6328E2580E11E3F3366D2D46078B7B357A7DF02DD20BA75532F0EE89CB467AEAD3F2335BBC9647B424AE604BEE34CA127E6EFAA2A16F029F06CB48B3E6CC636664A75F209D3C4A2F1A12DAD15CCC690F2CF822CEC92E7A63208519E259AA0B7327A191DDEAA86125BD6FD50CBE406964E0D272D5923468F73FB8D11433B95684F00900166C59CE8C37C7E54960A763CA4909D224FDC024B40D14D7BB6EBD576EB855FFF78EFADE75988A46483094BF71340C315C5834C7F5C5C34D3951655122476070A5938E904FD9D3F0559E16582FBD68655DF86CA7D68D022DE95FE2B1231A85DB00012002A786531ADC2256E35DF6DC9B02030100010282010100A4E68DA4BAB642BC0653D70A54D0DAFA73FCDEAEC43792DF9997A6A6ACAAC91595A02276083FB16AA98D70DB5EB

[btsimonh]

yeah - I was not sure what was allowed when it came to keys as text, and my Berry skills are minimal at the moment, so the insight is very useful :). I suck up every berry snippet I find.... thankyou!

[s-hadinger]

I'm almost there...

[s-hadinger]

It's working now with the latest commit in development branch.

import string
import crypto

# JWT requires base64url and not raw base64
# see https://base64.guru/standards/base64url
# input: string or bytes
def base64url(v)
  import string
  if type(v) == 'string'   v = bytes().fromstring(v) end
  var b64 = v.tob64()
  # remove trailing padding
  b64 = string.tr(b64, '=', '')
  b64 = string.tr(b64, '+', '-')
  b64 = string.tr(b64, '/', '_')
  return b64
end

# JWT header and claim
var header = '{"alg":"RS256","typ":"JWT"}'
var claim = '{"sub":"1234567890","name":"John Doe","admin":true,"iat":1516239022}'
var b64header = base64url(header)
var b64claim = base64url(claim)

assert(b64header == 'eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9')
assert(b64claim == 'eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiYWRtaW4iOnRydWUsImlhdCI6MTUxNjIzOTAyMn0')

# `body` is the payload to sign with RS256
var body = b64header + '.' + b64claim
assert(body == 'eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiYWRtaW4iOnRydWUsImlhdCI6MTUxNjIzOTAyMn0')

var private_key =
'-----BEGIN PRIVATE KEY-----\n'+
'MIIEvwIBADANBgkqhkiG9w0BAQEFAASCBKkwggSlAgEAAoIBAQC7VJTUt9Us8cKj\n'+
'MzEfYyjiWA4R4/M2bS1GB4t7NXp98C3SC6dVMvDuictGeurT8jNbvJZHtCSuYEvu\n'+
'NMoSfm76oqFvAp8Gy0iz5sxjZmSnXyCdPEovGhLa0VzMaQ8s+CLOyS56YyCFGeJZ\n'+
'qgtzJ6GR3eqoYSW9b9UMvkBpZODSctWSNGj3P7jRFDO5VoTwCQAWbFnOjDfH5Ulg\n'+
'p2PKSQnSJP3AJLQNFNe7br1XbrhV//eO+t51mIpGSDCUv3E0DDFcWDTH9cXDTTlR\n'+
'ZVEiR2BwpZOOkE/Z0/BVnhZYL71oZV34bKfWjQIt6V/isSMahdsAASACp4ZTGtwi\n'+
'VuNd9tybAgMBAAECggEBAKTmjaS6tkK8BlPXClTQ2vpz/N6uxDeS35mXpqasqskV\n'+
'laAidgg/sWqpjXDbXr93otIMLlWsM+X0CqMDgSXKejLS2jx4GDjI1ZTXg++0AMJ8\n'+
'sJ74pWzVDOfmCEQ/7wXs3+cbnXhKriO8Z036q92Qc1+N87SI38nkGa0ABH9CN83H\n'+
'mQqt4fB7UdHzuIRe/me2PGhIq5ZBzj6h3BpoPGzEP+x3l9YmK8t/1cN0pqI+dQwY\n'+
'dgfGjackLu/2qH80MCF7IyQaseZUOJyKrCLtSD/Iixv/hzDEUPfOCjFDgTpzf3cw\n'+
'ta8+oE4wHCo1iI1/4TlPkwmXx4qSXtmw4aQPz7IDQvECgYEA8KNThCO2gsC2I9PQ\n'+
'DM/8Cw0O983WCDY+oi+7JPiNAJwv5DYBqEZB1QYdj06YD16XlC/HAZMsMku1na2T\n'+
'N0driwenQQWzoev3g2S7gRDoS/FCJSI3jJ+kjgtaA7Qmzlgk1TxODN+G1H91HW7t\n'+
'0l7VnL27IWyYo2qRRK3jzxqUiPUCgYEAx0oQs2reBQGMVZnApD1jeq7n4MvNLcPv\n'+
't8b/eU9iUv6Y4Mj0Suo/AU8lYZXm8ubbqAlwz2VSVunD2tOplHyMUrtCtObAfVDU\n'+
'AhCndKaA9gApgfb3xw1IKbuQ1u4IF1FJl3VtumfQn//LiH1B3rXhcdyo3/vIttEk\n'+
'48RakUKClU8CgYEAzV7W3COOlDDcQd935DdtKBFRAPRPAlspQUnzMi5eSHMD/ISL\n'+
'DY5IiQHbIH83D4bvXq0X7qQoSBSNP7Dvv3HYuqMhf0DaegrlBuJllFVVq9qPVRnK\n'+
'xt1Il2HgxOBvbhOT+9in1BzA+YJ99UzC85O0Qz06A+CmtHEy4aZ2kj5hHjECgYEA\n'+
'mNS4+A8Fkss8Js1RieK2LniBxMgmYml3pfVLKGnzmng7H2+cwPLhPIzIuwytXywh\n'+
'2bzbsYEfYx3EoEVgMEpPhoarQnYPukrJO4gwE2o5Te6T5mJSZGlQJQj9q4ZB2Dfz\n'+
'et6INsK0oG8XVGXSpQvQh3RUYekCZQkBBFcpqWpbIEsCgYAnM3DQf3FJoSnXaMhr\n'+
'VBIovic5l0xFkEHskAjFTevO86Fsz1C2aSeRKSqGFoOQ0tmJzBEs1R6KqnHInicD\n'+
'TQrKhArgLXX4v3CddjfTRJkFWDbE/CkvKZNOrcf1nhaGCPspRJj2KUkj1Fhl9Cnc\n'+
'dn/RsYEONbwQSjIfMPkvxF+8HQ==\n'+
'-----END PRIVATE KEY-----\n'

# public_key for reference but not actually used here
var public_key =
'-----BEGIN PUBLIC KEY-----\n'+
'MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAu1SU1LfVLPHCozMxH2Mo\n'+
'4lgOEePzNm0tRgeLezV6ffAt0gunVTLw7onLRnrq0/IzW7yWR7QkrmBL7jTKEn5u\n'+
'+qKhbwKfBstIs+bMY2Zkp18gnTxKLxoS2tFczGkPLPgizskuemMghRniWaoLcyeh\n'+
'kd3qqGElvW/VDL5AaWTg0nLVkjRo9z+40RQzuVaE8AkAFmxZzow3x+VJYKdjykkJ\n'+
'0iT9wCS0DRTXu269V264Vf/3jvredZiKRkgwlL9xNAwxXFg0x/XFw005UWVRIkdg\n'+
'cKWTjpBP2dPwVZ4WWC+9aGVd+Gyn1o0CLelf4rEjGoXbAAEgAqeGUxrcIlbjXfbc\n'+
'mwIDAQAB\n'+
'-----END PUBLIC KEY-----\n'

# read private_key as DER binary
while (private_key[-1] == '\n') private_key = private_key[0..-2] end
var private_key_DER = bytes().fromb64(string.split(private_key, '\n')[1..-2].concat())

# comparison with what was expected
assert(private_key_DER.tob64() == 'MIIEvwIBADANBgkqhkiG9w0BAQEFAASCBKkwggSlAgEAAoIBAQC7VJTUt9Us8cKjMzEfYyjiWA4R4/M2bS1GB4t7NXp98C3SC6dVMvDuictGeurT8jNbvJZHtCSuYEvuNMoSfm76oqFvAp8Gy0iz5sxjZmSnXyCdPEovGhLa0VzMaQ8s+CLOyS56YyCFGeJZqgtzJ6GR3eqoYSW9b9UMvkBpZODSctWSNGj3P7jRFDO5VoTwCQAWbFnOjDfH5Ulgp2PKSQnSJP3AJLQNFNe7br1XbrhV//eO+t51mIpGSDCUv3E0DDFcWDTH9cXDTTlRZVEiR2BwpZOOkE/Z0/BVnhZYL71oZV34bKfWjQIt6V/isSMahdsAASACp4ZTGtwiVuNd9tybAgMBAAECggEBAKTmjaS6tkK8BlPXClTQ2vpz/N6uxDeS35mXpqasqskVlaAidgg/sWqpjXDbXr93otIMLlWsM+X0CqMDgSXKejLS2jx4GDjI1ZTXg++0AMJ8sJ74pWzVDOfmCEQ/7wXs3+cbnXhKriO8Z036q92Qc1+N87SI38nkGa0ABH9CN83HmQqt4fB7UdHzuIRe/me2PGhIq5ZBzj6h3BpoPGzEP+x3l9YmK8t/1cN0pqI+dQwYdgfGjackLu/2qH80MCF7IyQaseZUOJyKrCLtSD/Iixv/hzDEUPfOCjFDgTpzf3cwta8+oE4wHCo1iI1/4TlPkwmXx4qSXtmw4aQPz7IDQvECgYEA8KNThCO2gsC2I9PQDM/8Cw0O983WCDY+oi+7JPiNAJwv5DYBqEZB1QYdj06YD16XlC/HAZMsMku1na2TN0driwenQQWzoev3g2S7gRDoS/FCJSI3jJ+kjgtaA7Qmzlgk1TxODN+G1H91HW7t0l7VnL27IWyYo2qRRK3jzxqUiPUCgYEAx0oQs2reBQGMVZnApD1jeq7n4MvNLcPvt8b/eU9iUv6Y4Mj0Suo/AU8lYZXm8ubbqAlwz2VSVunD2tOplHyMUrtCtObAfVDUAhCndKaA9gApgfb3xw1IKbuQ1u4IF1FJl3VtumfQn//LiH1B3rXhcdyo3/vIttEk48RakUKClU8CgYEAzV7W3COOlDDcQd935DdtKBFRAPRPAlspQUnzMi5eSHMD/ISLDY5IiQHbIH83D4bvXq0X7qQoSBSNP7Dvv3HYuqMhf0DaegrlBuJllFVVq9qPVRnKxt1Il2HgxOBvbhOT+9in1BzA+YJ99UzC85O0Qz06A+CmtHEy4aZ2kj5hHjECgYEAmNS4+A8Fkss8Js1RieK2LniBxMgmYml3pfVLKGnzmng7H2+cwPLhPIzIuwytXywh2bzbsYEfYx3EoEVgMEpPhoarQnYPukrJO4gwE2o5Te6T5mJSZGlQJQj9q4ZB2Dfzet6INsK0oG8XVGXSpQvQh3RUYekCZQkBBFcpqWpbIEsCgYAnM3DQf3FJoSnXaMhrVBIovic5l0xFkEHskAjFTevO86Fsz1C2aSeRKSqGFoOQ0tmJzBEs1R6KqnHInicDTQrKhArgLXX4v3CddjfTRJkFWDbE/CkvKZNOrcf1nhaGCPspRJj2KUkj1Fhl9Cncdn/RsYEONbwQSjIfMPkvxF+8HQ==')

# sign body
var body_b64 = bytes().fromstring(body)
var sign = crypto.RSA.rs256(private_key_DER, body_b64)
var b64sign = base64url(sign)

# check output
assert(b64sign == 'NHVaYe26MbtOYhSKkoKYdFVomg4i8ZJd8_-RU8VNbftc4TSMb4bXP3l3YlNWACwyXPGffz5aXHc6lty1Y2t4SWRqGteragsVdZufDn5BlnJl9pdR_kdVFUsra2rWKEofkZeIC4yWytE58sMIihvo9H1ScmmVwBcQP6XETqYd0aSHp1gOa9RdUPDvoXQ5oqygTqVtxaDr6wUFKrKItgBMzWIdNZ6y7O9E0DhEPTbE9rfBo6KTFsHAZnMg4k68CDp2woYIaXbmYTWcvbzIuHO7_37GT79XdIwkm95QJ7hYC9RiwrV7mesbY4PAahERJawntho0my942XheVLmGwLMBkQ')

# Final token:
var jwt_token = payload + '.' + b64sign

[btsimonh]

good spot on the b64url thing. I got the padding removal from an error on jwt.io... but did not look at the specs.
I'll merge into my webcam branch tonight and duplicate the result, and then I'll try posting some files to google to test if they accept it.

[s-hadinger]

Let me know. At least the test passes the online JWT simulators.

[btsimonh]

hmm... merged and built, but
BRY: Exception> 'attribute_error' - module 'crypto' has no member 'RSA'
do I have to run some other thing other than just build?
Trying a clean all and then a build....

[btsimonh]

ahh:
#ifdef USE_BERRY_CRYPTO_RSA
!!!
one moment...
Edit: yep, runs now.
Will try to test the token using node-red first...
Edit2: interfacing with google is not going well. Docs are not clear, and I'm gettign 408 whatever I do. Will try again tomorrow. I think the token is ok.

[btsimonh]

For future visitors:
A 'complete' google authentication based on creating a service account in the google console, and downloading an associated JSON for authentication.
This code uses @s-hadinger 's new RS256 signing to create a JWT, which it then uses to get an OAuth token, which may then be used to access any google APIs enabled for the service account.
Basic testing reveals it can list files on GDrive, but scopes may need to be changed for other APIs.
Also, I had to add #define USE_WEBCLIENT_HTTPS, #define USE_WEBCLIENT to my build (webcam based)
Thanks again @s-hadinger for more great work on Berry.

import crypto
import json
import string

class google_oauth
  var access_token
  # JWT requires base64url and not raw base64
  # see https://base64.guru/standards/base64url
  # input: string or bytes
  def base64url(v)
    import string
    if type(v) == 'string'   v = bytes().fromstring(v) end
    var b64 = v.tob64()
    # remove trailing padding
    b64 = string.tr(b64, '=', '')
    b64 = string.tr(b64, '+', '-')
    b64 = string.tr(b64, '/', '_')
    return b64
  end

  def create_google_jwt(json_filename, duration)
    # this is the key file downloaded from the google cloud console, assigned to a service account.
    # we need private_key and client_email
    var f = open(json_filename,"r")
    var json_data = f.read()
    f.close()
    var key_map = json.load(json_data)
    var time = tasmota.rtc()

    # expirey in 1 hour
    var header = '{"alg":"RS256","typ":"JWT"}'
    var claim = '{"iss":"' .. key_map['client_email'] .. '",' ..
        '"scope":"https://www.googleapis.com/auth/drive",' ..
        '"aud":"https://oauth2.googleapis.com/token",' ..
        '"exp":' .. (time['utc']+duration) .. ',' ..
        '"iat":' .. time['utc'] .. '}' 

    var b64header=self.base64url(header)
    var b64claim=self.base64url(claim)
    # this is the first part of the JWT, xxx.yyy
    var body = b64header .. '.' .. b64claim

    # extract private key as bytes
    # split key into lines
    var private_key = key_map['private_key']
    while (private_key[-1] == '\n') private_key = private_key[0..-2] end
    var private_key_DER = bytes().fromb64(string.split(private_key, '\n')[1..-2].concat())

    # sign body
    var body_b64 = bytes().fromstring(body)
    var sign = crypto.RSA.rs256(private_key_DER, body_b64)
    var b64sign = self.base64url(sign)
    var jwt_token = body + '.' + b64sign
    print('created jwt')
    return jwt_token
  end

  def get_oath_token(json_filename, duration)
    var jwt = self.create_google_jwt(json_filename, duration)
    print('got jwt')
    var cl = webclient();
    print('got cl')
    
    cl.begin('https://oauth2.googleapis.com/token')
    var payload = 
      '{"grant_type":"urn:ietf:params:oauth:grant-type:jwt-bearer",' ..
      '"assertion":"' .. jwt .. '"}'
    var r = cl.POST(payload)
    if r == 200
      var s = cl.get_string()
      var jmap = json.load(s)
      print(jmap)
      self.access_token = jmap['access_token']
    end
  end

  def add_access_key(client)
    client.add_header('Authorization', 'Bearer ' .. self.access_token)
  end
end

var auth = google_oauth();
auth.get_oath_token("/google.json", 3600)
print('got token ' .. auth.access_token[1..10])

var cl = webclient()
cl.begin('https://www.googleapis.com/drive/v3/files')
print('began test call ')
auth.add_access_key(cl)
print('added header ')
var r = cl.GET()
print(r)
print(cl.get_string())

[btsimonh]

The result of this discussion:

prototype google api classes

For the moment, only writing files.
https://github.com/btsimonh/TasmotaBerryPLay/tree/master/googleapis

[btsimonh]

@s-hadinger - quick question -

can you imagine a way to do a multipart upload through wcclient?

At the moment, I'm writing files to gdrive in two shots, the first creates the file metadata (a json), and the second uploads the image (binary). But you can do this in one POST of multipart style...

I see that we can get the tcp stream, and write to it, but I'm unsure if this would be the correct approach (and what about SSL?)

Google's docs: https://developers.google.com/drive/api/guides/manage-uploads#http_1

[s-hadinger]

Keep in mind that binary can only be stored to file system. That's a limitation of the current Arduino http client lib.

[btsimonh]

yeah, I noticed that storing to bytes would involve creating a stream object to write into the bytes object... all just work, just does not need to be done now, especially as we could store to file, and then read. I'd offer to do it, but feel I need to keep my focus on the new webcam driver, else it'll never get to PR. My next steps are to finish timelapse and motion capture in Berry, and run them for periods of days as testing of both the google interface and the webcam driver. It's better such a PR proves stable and useful before submission.

[s-hadinger]

I started an async driver for HTTP client in Berry. It is used by Matter to driver ESP8266 Tasmota devices. But it would require a lot of work to make it a full async HTTP implementation.

[btsimonh]

@s-hadinger - please could you review #18829
Adds get_bytes() to berry webclient - I copied the flash implementation.
Restricted to 32k and must have content-length header

[btsimonh]

I looked into multipart. I don't want to craft the whole thing as a single buffer, so the ideal would be a Stream which called a Berry function, and then to use
int HTTPClientLight::sendRequest(const char * type, Stream * stream, size_t size);
But it's beyond my time comittment at the moment. I did add a prototype .write(buf, len) to berry, but I'd still need to construct everything manually, parse return headers, deal with redirects, etc. So it works as is with multiple posts... I'll leave it like that.