I am having trouble with Android TV and the integration with Google Sign-In. I have an app that accesses Google Drive to download and render user content from their Google Drive.
First, a bit about the process of integrating Google Sign-In inside Android TV: Initially, the app was using GoogleSignIn, something like:
GoogleSignInOptions gso = new GoogleSignInOptions.Builder(GoogleSignInOptions.DEFAULT_SIGN_IN)
.requestScopes(new Scope(DRIVE_SCOPE))
.requestEmail()
.build();
GoogleSignInClient googleSignInClient = GoogleSignIn.getClient(this, gso);
startActivityForResult(googleSignInClient.getSignInIntent(), SIGN_IN);
That mostly works. I get the user picker, and if it is the first time, I get the consent screens:
That worked for some time, but suddenly the newly logged-in users started to have issues. Some days after the login (a few days later), the app starts getting code 12500 when trying to start an OAuth session without much information. Revoking and logging in again does not help. The only solution I found was to factory reset the Android TV unit (Nvidia SHIELD) and then log in again. Then again, it works for a few days. I have one user with a Nvidia Shield that was logged in some years ago and is still working without any issue nowadays, but the same code seems to be failing with newly created users. Anyway, I thought that before reporting that, I must upgrade my app to use the latest AuthorizationRequest flow and see if that fixes my issue.
The issue:
AuthorizationRequest seems to be working (still have a few days to go to see if the user stays connected), but I realize that the user picker was changed and that I don't get the user consent request view with this version. I built a new app from scratch just to be sure that it was not already approved, and I still don't get the consent screen. The only thing I see is the picker:
Is this right? Where is the consent screen? I need it to go through the OAuth verification process in Google Cloud, and the user also needs to consent.
Also, I couldn't find any way to revoke and log out from one account.
Summing up:
OAuth Authorization tokens, for users' security and privacy reasons, are restricted and different on devices such as ATV or Auto, that are commonly considered shared devices. These restricted tokens do not allow access to certain services, such as GMail, Drive or Calendar. So in theory, these restricted tokens should be issued from the beginning so access to Drive, e.g., should fail from the beginning. What is happening in your case, however, is that due to some version issues, initially a non-restricted token is issued on ATV (on some specific models/versions) which allows Drive access, and then, within a few days, our OAuth server corrects that error and replaces the non-restricted tokens with correct restricted ones, hence you lose access after a few days. In short, not having access to Drive on ATV is the expected behavior that you should plan for.
Hope that helps.