GoogleMail使用OAuth 2.0刷新Access Token的方案咨询

前置说明 #

你原有代码中已经配置了.setAccessType("offline")和持久化令牌的FileDataStoreFactory，已经具备刷新令牌的基础，首次授权时谷歌会返回长期有效的refresh_token，自动存储在你配置的TOKENS_DIRECTORY_PATH目录下。

方案一：使用官方SDK自带自动刷新（推荐，无需额外开发刷新逻辑） #

谷歌官方的Credential类自带自动刷新能力，调用getAccessToken()时如果检测到access token已过期，会自动用本地存储的refresh token请求新的access token，无需自己写刷新代码，仅需在使用凭证前加一层过期校验即可：

// 调用原有方法获取凭证
Credential credential = getCredentials(HTTP_TRANSPORT);
// 提前60秒判断是否需要刷新，避免请求时过期
if (credential.getExpiresInSeconds() <= 60) {
    boolean isRefreshSuccess = credential.refreshToken();
    if (!isRefreshSuccess) {
        // 刷新失败处理逻辑，比如清除本地缓存重新走授权流程
    }
}
// 后续直接使用credential调用Gmail接口即可

方案二：整合你提供的手动刷新方法 #

如果需要自定义刷新逻辑，可以按以下步骤修改代码：

步骤1：调整原有getCredentials方法 #

无需修改核心逻辑，仅需补充可获取refresh_token的能力即可：

private static Credential getCredentials(final NetHttpTransport HTTP_TRANSPORT) throws IOException {
    // 加载客户端配置
    InputStream in = GoogleMail.class.getResourceAsStream(CREDENTIALS_FILE_PATH);
    if (in == null) {
        throw new FileNotFoundException("Resource not found: " + CREDENTIALS_FILE_PATH);
    }
    GoogleClientSecrets clientSecrets = GoogleClientSecrets.load(GSON_FACTORY, new InputStreamReader(in));

    // 构建授权流程，原有配置不变
    GoogleAuthorizationCodeFlow flow = new GoogleAuthorizationCodeFlow.Builder(
            HTTP_TRANSPORT, GSON_FACTORY, clientSecrets, SCOPES)
            .setDataStoreFactory(new FileDataStoreFactory(new java.io.File(TOKENS_DIRECTORY_PATH)))
            .setAccessType("offline")
            .setApprovalPrompt("force")
            .build();
    LocalServerReceiver receiver = new LocalServerReceiver.Builder().setPort(8888).build();
    Credential credential = new AuthorizationCodeInstalledApp(flow, receiver).authorize("user");
    // 可按需获取refresh_token存储到自定义位置
    System.out.println("当前有效Refresh Token：" + credential.getRefreshToken());
    return credential;
}

步骤2：修改手动刷新方法适配现有参数 #

复用全局的传输、序列化实例，无需重复创建，同时直接更新原有凭证对象的属性：

public static Credential refreshAccessToken(Credential oldCredential, GoogleClientSecrets clientSecrets, NetHttpTransport transport) throws IOException {
    try {
        TokenResponse response = new GoogleRefreshTokenRequest(
                transport, 
                GSON_FACTORY,
                oldCredential.getRefreshToken(), 
                clientSecrets.getDetails().getClientId(), 
                clientSecrets.getDetails().getClientSecret()
        ).execute();
        // 更新原有凭证的令牌和过期时间
        oldCredential.setAccessToken(response.getAccessToken());
        oldCredential.setExpirationTimeMilliseconds(
            System.currentTimeMillis() + response.getExpiresInSeconds() * 1000
        );
        System.out.println("刷新后Access Token：" + response.getAccessToken());
        return oldCredential;
    } catch (TokenResponseException e) {
        if (e.getDetails() != null) {
            System.err.println("刷新错误：" + e.getDetails().getError());
            if (e.getDetails().getErrorDescription() != null) {
                System.err.println("错误描述：" + e.getDetails().getErrorDescription());
            }
            if (e.getDetails().getErrorUri() != null) {
                System.err.println("错误地址：" + e.getDetails().getErrorUri());
            }
        } else {
            System.err.println("刷新异常：" + e.getMessage());
        }
        // 刷新失败可在此处添加重新授权逻辑
        return oldCredential;
    }
}

步骤3：调用示例 #

NetHttpTransport HTTP_TRANSPORT = GoogleNetHttpTransport.newTrustedTransport();
Credential credential = getCredentials(HTTP_TRANSPORT);
// 校验是否需要刷新
if (credential.getExpiresInSeconds() < 60) {
    GoogleClientSecrets clientSecrets = GoogleClientSecrets.load(
        GSON_FACTORY, 
        new InputStreamReader(GoogleMail.class.getResourceAsStream(CREDENTIALS_FILE_PATH))
    );
    credential = refreshAccessToken(credential, clientSecrets, HTTP_TRANSPORT);
}

注意：如果首次授权未拿到refresh_token，请删除本地TOKENS_DIRECTORY_PATH目录下的缓存文件，重新走一次授权流程即可。refresh_token长期有效，仅当用户手动取消授权、开发者重置客户端密钥、或超过90天未使用时才会失效。

内容的提问来源于stack exchange，提问作者Tom