document with oauth client ids are used for which build

[tomholub]

especially which were used for enterprise prod build - I understand there were two client ids? One for mail provider and one for calling our backend?

[DenBond7]

As I remember we already talked about. I will try to find history.

[DenBond7]

I use only a single OAuth 2.0 Client ID for both flavors(customer and enterprise)

374364070962-n83b6asllhfkhij6slijr61576lqqi3v.apps.googleusercontent.com

The main point is GoogleApiClientHelper

Especially the following lines

    /**
     * OAuth 2.0 Client IDs that was taken from the Google Developer Console
     * (should be called as "FlowCrypt Android Web Application for id_token").
     * The client ID of the server that will verify the integrity of the token.
     */
    private const val SERVER_CLIENT_ID =
      "374364070962-n83b6asllhfkhij6slijr61576lqqi3v.apps.googleusercontent.com"

    fun generateGoogleSignInOptions(): GoogleSignInOptions {
      val builder = GoogleSignInOptions.Builder(GoogleSignInOptions.DEFAULT_SIGN_IN)

      /**
       * we require "https://mail.google.com/" scope. This scope describe full access to the account,
       * including permanent deletion of threads and messages.
       */
      builder.requestScopes(Scope(Constants.SCOPE_MAIL_GOOGLE_COM))
      /**
       * Specifies that email info is requested by the app. We use it to create a local account.
       */
      builder.requestEmail()
      /**
       * Specifies that an ID token for authenticated users is requested.
       * Requesting an ID token requires that the server client ID be specified.
       */
      builder.requestIdToken(SERVER_CLIENT_ID)

      return builder.build()
    }

Later we will receive GoogleSignInAccount and idToken that can be used to communicate with our backend.

[DenBond7]

@tomholub Please check if it looks good and informative.

[tomholub]

Does that mean all of the other client ids can be removed from google developer console?

[tomholub]

[tomholub]

could for example delete the debug one, see if it still works

[DenBond7]

• FlowCrypt Android Web Application for id_token - we use it to communicate with our backend(customer + enterprise)
• FlowCrypt Android App Enterprise Debug - we use it to be able to use SignIn for enterprise debug builds
• FlowCrypt Android App Enterprise - we use it to be able to use SignIn for enterprise builds
• FlowCrypt Android App - we use it to be able to use SignIn for customer builds
• FlowCrypt Android App Debug - we use it to be able to use SignIn for customer debug builds

After some manipulations, we can have the following

• FlowCrypt Android Web Application for id_token - we use it to communicate with our backend(customer + enterprise)
• FlowCrypt Android App Enterprise - we use it to be able to use SignIn for enterprise builds(need to add the second SHA1 + package of the debug build)
• FlowCrypt Android App - we use it to be able to use SignIn for customer builds(need to add the second SHA1 + package of the debug build)

Or

• FlowCrypt Android Web Application for id_token - we use it to communicate with our backend(customer + enterprise)
• FlowCrypt Android App - we use it to be able to use SignIn for all builds(need to have 4 cases of SHA1 + package: customer, customerDebug, enterprise, enterpriseDebug)

It depends on your needs. We can leave all things as-is(I prefer it). Because changes in that settings sometimes affect the app and we will have to change the package to be able to use SignIn(I had such experience). I think we can play with debug versions, but it will be better to leave prods as-is.

[DenBond7]

It depends on your needs.

I meant management, analyzing statistics, and so on.

[tomholub]

Ok. That means that all apps currently use two client ids. Could you please document this in some hollistic manner - maybe a table of builds and which exact client ids (copy the client id string) they use and so on. Customers sometimes need these strings to specifically allow them.

(by the way, where in the codebase are these other 4 client ids set?)

[DenBond7]

maybe a table of builds and which exact client ids (copy the client id string) they use and so on

Will do

(by the way, where in the codebase are these other 4 client ids set?)

We only use this one 374364070962-n83b6asllhfkhij6slijr61576lqqi3v.apps.googleusercontent.com(FlowCrypt Android Web Application for id_token) in the codebase

[tomholub]

I see, so all of this is (except for 74364070962-n83b6asllhfkhij6slijr61576lqqi3v.apps.googleusercontent.com) decided purely by the console sha-1 fingerprints - no reference in our codebase.

[DenBond7]

I see, so all of this is (except for 74364070962-n83b6asllhfkhij6slijr61576lqqi3v.apps.googleusercontent.com) decided purely by the console sha-1 fingerprints - no reference in our codebase.

Correct

[DenBond7]

Build type	Package	OAuth 2.0 Client ID for API(flowcrypt)	OAuth 2.0 Client ID for email access
Customer	com.flowcrypt.email	374364070962-n83b6asllhfkhij6slijr61576lqqi3v.apps.googleusercontent.com	374364070962-bs819lhrqvkv3nthh2cdb3i8fqirv3de.apps.googleusercontent.com
Customer Debug	com.flowcrypt.email.debug	374364070962-n83b6asllhfkhij6slijr61576lqqi3v.apps.googleusercontent.com	374364070962-ejldjom41l965jm913cgbopn4u9g65hd.apps.googleusercontent.com
Enterprise	com.flowcrypt.email.enterprise	374364070962-n83b6asllhfkhij6slijr61576lqqi3v.apps.googleusercontent.com	374364070962-hmqdikqd0o5tuogldli60k380jem9mu5.apps.googleusercontent.com
Enterprise Debug	com.flowcrypt.email.enterprise.debug	374364070962-n83b6asllhfkhij6slijr61576lqqi3v.apps.googleusercontent.com	374364070962-j3hb01jo4n97f213aoffncjnt35b2chb.apps.googleusercontent.com