aicam commented on PR #5721:
URL: https://github.com/apache/texera/pull/5721#issuecomment-4927610911
@Sentiaus You're right — let's go with your flow. Picker keeps us on the
non-sensitive `drive.file` scope, and the token never touches any Texera
service; file-service only sees the session URI (a write-only, single-file
grant).
One refinement: get the token with the **GIS token client**
(`initTokenClient` → `requestAccessToken()`) directly in the frontend — no
authorization code, no client secret. That makes the backend
`/connect`/`/callback` in this PR unnecessary; please remove
`GoogleDriveAuthResource` and restructure around GIS + Picker + a file-service
export endpoint.
```mermaid
sequenceDiagram
participant User as Frontend (GIS)
participant OAuth as Google/OAuth
participant Picker as Drive Picker
participant FS as File-service
participant MinIO
User->>OAuth: 1. requestAccessToken() — GIS consent popup
OAuth-->>User: 2. Access token (JS memory only)
User->>Picker: 3. Open Picker (token + apiKey)
Picker-->>User: 4. folderId
User->>OAuth: 5. POST resumable upload init (Bearer token)
OAuth-->>User: 6. Session URI
User->>FS: 7. POST /export {datasetId, sessionUri} — Texera JWT, no
Google token
FS->>MinIO: 8. Request file
MinIO-->>FS: 9. Stream file
FS->>OAuth: 10. Chunked PUTs to session URI (no auth header)
```
Requirements:
- Token in JS memory only — never localStorage, never sent to any Texera
endpoint.
- File-service must validate the session URI (host `www.googleapis.com`,
path `/upload/drive/v3/files`), check the user's dataset access, and not log
the URI.
- Stream MinIO → Drive as an async job with a status endpoint, not inside
the request.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
