Dialogflow新手求助：Node.js账号关联后带令牌重定向至模拟器方案

Hey there! Let's break down how to handle this Dialogflow account linking flow with your Node.js app step by step. I'll walk you through the code and key considerations to make this work smoothly.

Step 1: Understand the Flow Context #

First, let's recap what's happening here:

• When the user clicks "Login" in the Dialogflow simulator, it redirects to your /login endpoint with all those OAuth parameters (response_type, client_id, redirect_uri, etc.).
• Your job is to validate the user against your database, then send back an authorization code to Dialogflow's redirect URI so it can complete the account linking and return the user to the simulator.

Step 2: Implement the Login & Redirect Logic #

Assuming you're using Express for your Node.js app, here's how to handle the login validation and redirect:

First, install any needed dependencies:

npm install express uuid jsonwebtoken

Then, the login route setup:

const express = require('express');
const uuid = require('uuid');
const jwt = require('jsonwebtoken');
const app = express();
app.use(express.urlencoded({ extended: true }));

// Replace these with your actual database functions
const yourUserDB = {
  findOne: async (credentials) => {
    // Logic to check username/password against your DB
    return credentials.username === 'test' && credentials.password === 'test' ? { id: 'user123' } : null;
  }
};

const yourCodeStore = {
  create: async (record) => {
    // Store the code, user ID, client ID, redirect URI, and expiration time (e.g., in Redis or a DB)
    console.log('Storing code record:', record);
  }
};

app.get('/login', (req, res) => {
  // Show your login form, passing along critical OAuth parameters
  const state = req.query.state;
  const redirectUri = req.query.redirect_uri;
  res.send(`
    <form method="POST" action="/login?state=${state}&redirect_uri=${redirectUri}&client_id=${req.query.client_id}">
      <input type="text" name="username" placeholder="Username" required>
      <input type="password" name="password" placeholder="Password" required>
      <button type="submit">Login</button>
    </form>
  `);
});

app.post('/login', async (req, res) => {
  // 1. Validate user against your database
  const user = await yourUserDB.findOne({
    username: req.body.username,
    password: req.body.password
  });

  if (!user) {
    return res.status(401).send('Invalid username or password. Try again.');
  }

  // 2. Grab the OAuth parameters from the request query
  const { state, redirect_uri: redirectUri, client_id: clientId } = req.query;

  // 3. Generate a unique authorization code (expire after 10 mins for security)
  const authCode = uuid.v4();
  await yourCodeStore.create({
    code: authCode,
    userId: user.id,
    clientId,
    redirectUri,
    expiresAt: new Date(Date.now() + 10 * 60 * 1000) // 10-minute expiration
  });

  // 4. Build the redirect URL with required parameters
  const redirectUrl = new URL(redirectUri);
  redirectUrl.searchParams.set('code', authCode);
  redirectUrl.searchParams.set('state', state); // MUST match original state to prevent CSRF

  // 5. Redirect back to Dialogflow – this sends the user back to the simulator
  res.redirect(redirectUrl.toString());
});

app.listen(process.env.PORT || 3000, () => {
  console.log('Server running on port 3000');
});

Step 3: Build the Token Endpoint for Dialogflow #

Dialogflow will take the authorization code you sent and send a POST request to your token endpoint (configured in Dialogflow's account linking settings) to exchange it for an access token. Here's how to implement that:

const yourTokenStore = {
  create: async (record) => {
    // Store refresh tokens (for offline access) linked to the user
    console.log('Storing token record:', record);
  }
};

app.post('/token', express.json(), async (req, res) => {
  const { code, client_id: clientId, grant_type } = req.body;

  // Validate grant type (we only support authorization_code here)
  if (grant_type !== 'authorization_code') {
    return res.status(400).json({ error: 'unsupported_grant_type' });
  }

  // 1. Look up the authorization code to verify it's valid and not expired
  // Replace this with your actual code lookup logic
  const codeRecord = {
    code,
    userId: 'user123',
    clientId,
    expiresAt: new Date(Date.now() + 5 * 60 * 1000) // Example: not expired yet
  };

  if (!codeRecord || codeRecord.expiresAt < new Date()) {
    return res.status(400).json({ error: 'invalid_grant', error_description: 'Code is invalid or expired' });
  }

  // 2. Generate access token (using JWT) and refresh token
  const accessToken = jwt.sign(
    { userId: codeRecord.userId, scope: 'openid offline_access profile email' },
    'your_strong_secret_key', // Use a secure secret in production!
    { expiresIn: '1h' }
  );
  const refreshToken = uuid.v4();

  // 3. Store the refresh token for future offline access requests
  await yourTokenStore.create({
    refreshToken,
    userId: codeRecord.userId,
    clientId
  });

  // 4. Delete the used authorization code (it can only be used once!)
  // await yourCodeStore.delete({ code });

  // 5. Send back the OAuth-compliant response
  res.json({
    access_token: accessToken,
    token_type: 'Bearer',
    expires_in: 3600, // 1 hour in seconds
    refresh_token: refreshToken // Required since offline_access is in the scope
  });
});

Key Things to Remember #

• Never modify the state parameter: You must pass it back exactly as received – Dialogflow uses this to prevent CSRF attacks and will reject the request if it doesn't match.
• Use HTTPS: Dialogflow requires all OAuth endpoints to be HTTPS. Heroku handles this automatically for you.
• Configure Dialogflow Account Linking: In your Dialogflow console, go to Settings > Account Linking and set:
  • Authorization URL: https://dialogflow.herokuapp.com/login
  • Token URL: https://dialogflow.herokuapp.com/token
  • Client ID: da4sad4sa56ds54sdb67re5a4 (from your request parameters)
  • Scopes: openid offline_access profile email
• Clean Up Used Codes: Always delete authorization codes after they're used to prevent reuse.

Once all this is set up, when the user logs in successfully, they'll be redirected back to Dialogflow, which exchanges the code for an access token, completes account linking, and returns the user to the simulator automatically.

内容的提问来源于stack exchange，提问作者Devika V