import { GoogleAuth, OAuth2Client } from "google-auth-library";

import { normalizeLowercaseStringOrEmpty } from "openclaw/plugin-sdk/text-runtime";

import { fetchWithSsrFGuard } from "../runtime-api.js";

import type { ResolvedGoogleChatAccount } from "./accounts.js";

import {

__testing as googleAuthRuntimeTesting,

getGoogleAuthTransport,

loadGoogleAuthRuntime,

resolveValidatedGoogleChatCredentials,

} from "./google-auth.runtime.js";

const CHAT_SCOPE = "https://www.googleapis.com/auth/chat.bot";

const CHAT_ISSUER = "chat@system.gserviceaccount.com";

// Size-capped to prevent unbounded growth in long-running deployments (#4948)

const MAX_AUTH_CACHE_SIZE = 32;

const authCache = new Map<string, { key: string; auth: GoogleAuth }>();

const verifyClient = new OAuth2Client();

type GoogleAuthModule = typeof import("google-auth-library");

type GoogleAuthRuntime = {

GoogleAuth: GoogleAuthModule["GoogleAuth"];

OAuth2Client: GoogleAuthModule["OAuth2Client"];

};

type GoogleAuthInstance = InstanceType<GoogleAuthRuntime["GoogleAuth"]>;

type GoogleAuthOptions = ConstructorParameters<GoogleAuthRuntime["GoogleAuth"]>[0];

type GoogleAuthTransport = NonNullable<GoogleAuthOptions>["clientOptions"] extends {

transporter?: infer T;

}

? T

: never;

type OAuth2ClientInstance = InstanceType<GoogleAuthRuntime["OAuth2Client"]>;

const authCache = new Map<string, { key: string; auth: GoogleAuthInstance }>();

let cachedCerts: { fetchedAt: number; certs: Record<string, string> } | null = null;

let verifyClientPromise: Promise<OAuth2ClientInstance> | null = null;

async function getVerifyClient(): Promise<OAuth2ClientInstance> {

if (!verifyClientPromise) {

verifyClientPromise = (async () => {

try {

const { OAuth2Client } = await loadGoogleAuthRuntime();

// google-auth-library types its transporter through gaxios' CJS surface,

// while the plugin imports the ESM entrypoint directly.

const transporter = (await getGoogleAuthTransport()) as unknown as GoogleAuthTransport;

return new OAuth2Client({ transporter });

} catch (error) {

verifyClientPromise = null;

throw error;

}

})();

}

return await verifyClientPromise;

}

function buildAuthKey(account: ResolvedGoogleChatAccount): string {

if (account.credentialsFile) {

return "none";

}

function getAuthInstance(account: ResolvedGoogleChatAccount): GoogleAuth {

async function getAuthInstance(account: ResolvedGoogleChatAccount): Promise<GoogleAuthInstance> {

const key = buildAuthKey(account);

const cached = authCache.get(account.accountId);

if (cached && cached.key === key) {

return cached.auth;

}

const [{ GoogleAuth }, rawTransporter, credentials] = await Promise.all([

loadGoogleAuthRuntime(),

getGoogleAuthTransport(),

resolveValidatedGoogleChatCredentials(account),

]);

const transporter = rawTransporter as unknown as GoogleAuthTransport;

const evictOldest = () => {

if (authCache.size > MAX_AUTH_CACHE_SIZE) {

}

};

if (account.credentialsFile) {

const auth = new GoogleAuth({ keyFile: account.credentialsFile, scopes: [CHAT_SCOPE] });

authCache.set(account.accountId, { key, auth });

evictOldest();

return auth;

}

if (account.credentials) {

const auth = new GoogleAuth({ credentials: account.credentials, scopes: [CHAT_SCOPE] });

authCache.set(account.accountId, { key, auth });

evictOldest();

return auth;

}

const auth = new GoogleAuth({ scopes: [CHAT_SCOPE] });

const auth = new GoogleAuth({

...(credentials ? { credentials } : {}),

clientOptions: { transporter },

scopes: [CHAT_SCOPE],

});

authCache.set(account.accountId, { key, auth });

evictOldest();

return auth;

export async function getGoogleChatAccessToken(

account: ResolvedGoogleChatAccount,

): Promise<string> {

const auth = getAuthInstance(account);

const auth = await getAuthInstance(account);

const client = await auth.getClient();

const access = await client.getAccessToken();

const token = typeof access === "string" ? access : access?.token;

if (audienceType === "app-url") {

try {

const verifyClient = await getVerifyClient();

const ticket = await verifyClient.verifyIdToken({

idToken: bearer,

audience,

if (audienceType === "project-number") {

try {

const verifyClient = await getVerifyClient();

const certs = await fetchChatCerts();

await verifyClient.verifySignedJwtWithCertsAsync(bearer, certs, audience, [CHAT_ISSUER]);

return { ok: true };

}

export const GOOGLE_CHAT_SCOPE = CHAT_SCOPE;

export const __testing = {

resetGoogleChatAuthForTests(): void {

authCache.clear();

cachedCerts = null;

verifyClientPromise = null;

googleAuthRuntimeTesting.resetGoogleAuthRuntimeForTests();

},

};