使用google-apis-playintegrity_v1解码Integrity Token时遇400错误求助

问题描述 #

使用Ruby的google-api-ruby-client库中的google-apis-playintegrity_v1模块处理Android Play Integrity验证结果时，调用decode_integrity_token接口返回400错误，错误提示为Integrity token cannot be decoded due to invalid arguments.。

实现代码 #

# Gemfile
gem "google-apis-playintegrity_v1"
...


# API可执行文件
require 'google/apis/playintegrity_v1'

class AndroidRightfulnessCheck
  class << self
    def device_rightfulness_check( integrity_token: token)
      play_integrity = Google::Apis::PlayintegrityV1
      decode_integrity_token_request = play_integrity::DecodeIntegrityTokenRequest.new
      play_integrity_service = play_integrity::PlayIntegrityService.new
      cred = Google::Auth::DefaultCredentials.make_creds(json_key_io: StringIO.new(ENV["PRIVATE_KEY"]), scope: "https://www.googleapis.com/auth/playintegrity")
      play_integrity_service.authorization = cred

      integrity_token = decode_integrity_token_request.update!(integrity_token: integrity_token)
      payload = play_integrity_service.decode_integrity_token(package_name, integrity_token)
    end
  end
end

错误信息 #

Error - #<Google::Apis::ClientError: Invalid request status_code: 400 header: #<HTTP::Message::Headers:0x000055d11d04b098 @http_version="1.1"
, @body_size=0
, @chunked=false
, @request_method="POST"
, @request_uri=#<Addressable::URI:0x2ae88e7fa714 URI:https://playintegrity.googleapis.com/v1/package_name:decodeIntegrityToken?>
, @request_query=nil
, @request_absolute_uri=nil
, @status_code=400
, @reason_phrase="Bad Request"
, @body_type=nil
, @body_charset=nil
, @body_date=nil
, @body_encoding=#<Encoding:UTF-8>
, @is_request=false
...
body: "{
  \"error\": {
    \"code\": 400
,\"message\": \"Integrity token cannot be decoded due to invalid arguments.\"
,\"status\": \"INVALID_ARGUMENT\"
  }
}\n"

排查建议 #

• 修正参数传递逻辑：
  代码中错误地将DecodeIntegrityTokenRequest对象赋值给了integrity_token变量并传入接口，导致参数类型不匹配。正确写法应为：

  # 方式1：直接赋值token
  decode_integrity_token_request.integrity_token = integrity_token
  payload = play_integrity_service.decode_integrity_token(package_name, decode_integrity_token_request)
  
  # 方式2：使用update!后传递对象
  decode_integrity_token_request.update!(integrity_token: integrity_token)
  payload = play_integrity_service.decode_integrity_token(package_name, decode_integrity_token_request)
  

• 验证包名正确性：
  确认package_name变量已正确赋值为Android应用的真实包名，需与生成Integrity Token的应用包名完全一致，包括大小写和拼写。从错误的请求URI可见，当前package_name是未替换的字面量，需检查变量赋值逻辑。

• 检查Integrity Token有效性：
  确保传入的integrity_token是从Android客户端正常获取的未篡改值，且未过期（Play Integrity Token有效期通常为几分钟）。

• 确认服务账号权限：
  检查用于认证的服务账号已在Google Play Console关联目标应用，且拥有Play Integrity API的访问权限；同时验证ENV["PRIVATE_KEY"]中的JSON密钥格式正确、内容完整。

内容的提问来源于stack exchange，提问作者tk109o