寻求DialogFlow集成Google OAuth2.0的示例代码（含账户关联端点）

Absolutely! I’ve got you covered with a practical example that integrates Dialogflow (whether you’re using ES or CX) with Google OAuth 2.0, including the critical OAuth callback and token endpoints needed for account linking. Let’s walk through this with a Node.js/Express implementation since it’s widely used for such backend tasks.

• A Google Cloud project with Dialogflow enabled
• A configured OAuth consent screen in Google Cloud Console (under APIs & Services > OAuth consent screen)
• Node.js and npm installed
• Dependencies: express, axios, dotenv, jsonwebtoken (install with npm install express axios dotenv jsonwebtoken)

This endpoint handles the redirect from Google’s OAuth server after the user grants permission. It exchanges the authorization code for an access token and refresh token, then redirects the user back to Dialogflow.

require('dotenv').config();
const express = require('express');
const axios = require('axios');
const router = express.Router();

// Google OAuth 2.0 credentials (store these in .env for security!)
const GOOGLE_CLIENT_ID = process.env.GOOGLE_CLIENT_ID;
const GOOGLE_CLIENT_SECRET = process.env.GOOGLE_CLIENT_SECRET;
const REDIRECT_URI = process.env.REDIRECT_URI; // Must match the callback URL configured in Dialogflow

router.get('/oauthcallback', async (req, res) => {
  const { code, state } = req.query;

  try {
    // Exchange authorization code for tokens from Google
    const tokenResponse = await axios.post('https://oauth2.googleapis.com/token', {
      code: code,
      client_id: GOOGLE_CLIENT_ID,
      client_secret: GOOGLE_CLIENT_SECRET,
      redirect_uri: REDIRECT_URI,
      grant_type: 'authorization_code'
    });

    const { access_token, refresh_token, expires_in } = tokenResponse.data;

    // Critical: Store these tokens securely (e.g., encrypted database) linked to the user's Dialogflow session ID
    // For demo purposes, we'll pass them back in the redirect (never do this in production!)
    const dialogflowRedirectUrl = `${process.env.DIALOGFLOW_REDIRECT_URL}?state=${state}&access_token=${access_token}&refresh_token=${refresh_token}&expires_in=${expires_in}`;
    
    res.redirect(dialogflowRedirectUrl);
  } catch (error) {
    console.error('OAuth callback error:', error.response?.data || error.message);
    res.status(500).send('Failed to exchange authorization code for tokens');
  }
});

module.exports = router;

Dialogflow calls this endpoint to fetch or refresh access tokens when interacting with your backend APIs. It supports both authorization_code and refresh_token grant types.

const express = require('express');
const axios = require('axios');
const router = express.Router();

router.post('/token', async (req, res) => {
  const { grant_type, code, refresh_token } = req.body;

  try {
    let tokenResponse;
    if (grant_type === 'authorization_code') {
      // Exchange authorization code (Dialogflow may call this directly in some flows)
      tokenResponse = await axios.post('https://oauth2.googleapis.com/token', {
        code: code,
        client_id: process.env.GOOGLE_CLIENT_ID,
        client_secret: process.env.GOOGLE_CLIENT_SECRET,
        redirect_uri: process.env.REDIRECT_URI,
        grant_type: 'authorization_code'
      });
    } else if (grant_type === 'refresh_token') {
      // Refresh expired access token using the stored refresh token
      tokenResponse = await axios.post('https://oauth2.googleapis.com/token', {
        refresh_token: refresh_token,
        client_id: process.env.GOOGLE_CLIENT_ID,
        client_secret: process.env.GOOGLE_CLIENT_SECRET,
        grant_type: 'refresh_token'
      });
    } else {
      return res.status(400).json({ error: 'unsupported_grant_type' });
    }

    const { access_token, expires_in, refresh_token: newRefreshToken } = tokenResponse.data;

    // Return token data in the exact format Dialogflow expects
    res.json({
      access_token: access_token,
      token_type: 'Bearer',
      expires_in: expires_in,
      ...(newRefreshToken && { refresh_token: newRefreshToken })
    });
  } catch (error) {
    console.error('Token endpoint error:', error.response?.data || error.message);
    res.status(400).json({ error: error.response?.data?.error || 'invalid_request' });
  }
});

module.exports = router;

1. Go to your Dialogflow agent’s settings > Account Linking
2. Select Authorization code as the grant type
3. For the Authorization URL, use Google’s OAuth authorization URL with your parameters:

   https://accounts.google.com/o/oauth2/v2/auth?client_id=YOUR_CLIENT_ID&redirect_uri=YOUR_CALLBACK_URL&response_type=code&scope=openid%20email%20profile&state={state}
   

   Replace YOUR_CLIENT_ID and YOUR_CALLBACK_URL with your actual values
4. For the Token URL, enter your backend’s token endpoint (e.g., https://your-domain.com/token)
5. Input your Client ID and Client Secret (same as in your .env file)
6. Save the settings

• Enforce HTTPS: OAuth flows require secure connections to avoid token interception
• Secure token storage: Never store tokens in plaintext—use encrypted databases or cloud key management services
• Validate the state parameter: This prevents CSRF attacks; always verify it matches the value sent in the initial authorization request
• Add robust error handling: Catch invalid codes, expired tokens, and missing parameters to avoid breaking the account linking flow

内容的提问来源于stack exchange，提问作者Rainmaker