Google service account: The API returned an error: TypeError: source.hasOwnProperty is not a function after an hour

Question

I have added google cloud service account in a project and its working. But the problem is that after an hour(i think), I get this error:

The API returned an error: TypeError: source.hasOwnProperty is not a function
Internal Server Error

and I need to restart the application to make it work.

Here in this StackOverflow post, I found this:

Once you get an access token it is treated in the same way - and is expected to expire after 1 hour, at which time a new access token will need to be requested, which for a service account means creating and signing a new assertion.

but didn't help. I'm using Node js and amazon secret service:

the code I have used to authorize:

        const jwtClient = new google.auth.JWT(
            client_email,
            null,
            private_key,
            scopes
        );

        jwtClient.authorize((authErr) =>{
            if(authErr){
                const deferred = q.defer();
                deferred.reject(new Error('Google drive authentication error, !'));
            }
        });

Any idea?

hint: Is there any policy in AWS secret to access a secret or in google cloud to access a service account? for example access in local or online?

Answer 1

[NOTE: You are using a service account to access Google Drive. A service account will have its own Google Drive. Is this your intention or is your goal to share your Google Drive with the service account?]

Is there any policy in AWS secret to access a secret or in google cloud to access a service account? for example access in local or online?

I am not sure what you are asking. AWS has IAM policies to control secret management. Since you are able to create a Signed JWT from stored secrets, I will assume that this is not an issue. Google does not have policies regarding accessing service accounts - if you have the service account JSON key material, you can do whatever the service account is authorized to do until the service account is deleted, modified, etc.

Now on to the real issue.

Your Signed JWT has expired and you need to create a new one. You need to track the lifetime of tokens that you create and recreate/refresh the tokens before they expire. The default expiration in Google's world is 3,600 seconds. Since you are creating your own token, there is no "wrapper" code around your token to handle expiration.

The error that you are getting is caused by a code crash. Since you did not include your code, I cannot tell you where. However, the solution is to catch errors so that expiration exceptions can be managed.

I recommend instead of creating the Google Drive Client using a Signed JWT that you create the client with a service account. Token expiration and refresh will be managed for you.

Very few Google services still support Signed JWTs (which your code is using). You should switch to using service accounts, which start off with a Signed JWT and then exchange that for an OAuth 2.0 Access Token internally.

There are several libraries that you can use. Either of the following will provide the features that you should be using instead of crafting your own Signed JWTs.

https://github.com/googleapis/google-auth-library-nodejs

https://github.com/googleapis/google-api-nodejs-client

The following code is an "example" and is not meant to be tested and debugged. Change the scopes in this example to match what you require. Remove the section where I load a service-account.json file and replace with your AWS Secrets code. Fill out the code with your required functionality. If you have a problem, create a new question with the code that you wrote and detailed error messages.

const {GoogleAuth} = require('google-auth-library');
const {google} = require('googleapis');

const key = require('service-account.json');

/**
 * Instead of specifying the type of client you'd like to use (JWT, OAuth2, etc)
 * this library will automatically choose the right client based on the environment.
 */
async function main() {
  const auth = new GoogleAuth({
    credentials: {
      client_email: key.client_email,
      private_key: key.private_key,
    },
    scopes: 'https://www.googleapis.com/auth/drive.metadata.readonly'
  });

  const drive = google.drive('v3');

  // List Drive files.
  drive.files.list({ auth: auth }, (listErr, resp) => {
    if (listErr) {
      console.log(listErr);
      return;
    }
    resp.data.files.forEach((file) => {
      console.log(`${file.name} (${file.mimeType})`);
    });
  });
}

main()