Silently Doesnt return refreshToken unless prompt=consent included

[chaffeqa]

Environment details

• OS: osx 11.1
• Ruby version: 2.6.4p104
• Gem name and version: google-api-client (~> 0.52.0)

Steps to reproduce

oauth flow without manual changes:

# Rails log output:
Redirected to https://accounts.google.com/o/oauth2/auth?access_type=offline&client_id=***-***.apps.googleusercontent.com&redirect_uri=http://localhost:8080/oauth/google_oauth2/callback&response_type=code&scope=email%20profile%20openid%20https://www.googleapis.com/auth/user.birthday.read&state=****

Response:

GET /oauth/google_oauth2/callback?state=***&code=4/0AY0e-g7jAvbTBEMJrLWpjRtgeGAyxDmLvYKj441fptaS8QGWvNuGlAnkTFRGXjSt99q1Iw&scope=email%20profile%20https://www.googleapis.com/auth/userinfo.email%20https://www.googleapis.com/auth/userinfo.profile%20openid%20https://www.googleapis.com/auth/user.birthday.read&authuser=1&hd=finalforms.com&prompt=none

Fetching token:

client_secrets = Google::APIClient::ClientSecrets.new(Rails.configuration.google.oauth_web_credentials)
      auth_client = client_secrets.to_authorization
      auth_client.update!(
        redirect_uri: oauth_callback_uri(provider: "google_oauth2"),
        additional_parameters: {
          access_type: "offline",
          include_granted_scopes: "true"
        }
      )
auth_client.update!(code: code)
        auth_client.grant_type = "authorization_code"
auth_client.fetch_access_token!

debugging reveals:

I, [2020-12-28T21:46:09.293685 #12751]  INFO -- request: POST https://oauth2.googleapis.com/token
D, [2020-12-28T21:46:09.293744 #12751] DEBUG -- request: User-Agent: "Faraday v0.15.4"
Content-Type: "application/x-www-form-urlencoded"
D, [2020-12-28T21:46:09.293807 #12751] DEBUG -- request: grant_type=authorization_code&code=4%2F0AY0e-g7jAvbTBEMJrLWpjRtgeGAyxDmLvYKj441fptaS8QGWvNuGlAnkTFRGXjSt99q1Iw&redirect_uri=http%3A%2F%2Flocalhost%3A8080%2Foauth%2Fgoogle_oauth2%2Fcallback&client_id=712371328747-vkq28iga72b31ube6j3jep3i2d3h0sn6.apps.googleusercontent.com&client_secret=***
I, [2020-12-28T21:46:09.434353 #12751]  INFO -- response: Status 200
D, [2020-12-28T21:46:09.434460 #12751] DEBUG -- response: cache-control: "no-cache, no-store, max-age=0, must-revalidate"
pragma: "no-cache"
expires: "Mon, 01 Jan 1990 00:00:00 GMT"
date: "Tue, 29 Dec 2020 04:46:06 GMT"
content-type: "application/json; charset=utf-8"
vary: "Origin, X-Origin, Referer"
server: "scaffolding on HTTPServer2"
x-xss-protection: "0"
x-frame-options: "SAMEORIGIN"
x-content-type-options: "nosniff"
alt-svc: "h3-29=\":443\"; ma=2592000,h3-T051=\":443\"; ma=2592000,h3-Q050=\":443\"; ma=2592000,h3-Q046=\":443\"; ma=2592000,h3-Q043=\":443\"; ma=2592000,quic=\":443\"; ma=2592000; v=\"46,43\""
connection: "close"
transfer-encoding: "chunked"
D, [2020-12-28T21:46:09.434507 #12751] DEBUG -- response: {
  "access_token": "ya29.a0AfH6SMCQcLsE3N4HRT2c47oHGkShDSbukj4Fv0vMion0D2bkRzqgKjF1LcOoJHauFc5MLVBBFIgqzRAUMyGKnD2sb0_Cp6pJjcPnRwgyTjai95_IJyr9K2YRMtqtBcA3GEUQqo0-NMSMiqiixXdkE-lu6ZU_W-HkjZSTsRhaLZE",
  "expires_in": 3599,
  "scope": "https://www.googleapis.com/auth/userinfo.profile openid https://www.googleapis.com/auth/user.birthday.read https://www.googleapis.com/auth/userinfo.email",
  "token_type": "Bearer",
  "id_token": "***"
}

Proven Fix:

If we modify the consent request to include prompt=consent plus /v2 parameter (as does the oauth google playground) this provides us with a code that correctly returns a refresh token:

Upon redirecting, add the parameter so url becomes:

https://accounts.google.com/o/oauth2/auth/oauthchooseaccount?access_type=offline&client_id=712371328747-vkq28iga72b31ube6j3jep3i2d3h0sn6.apps.googleusercontent.com&redirect_uri=http%3A%2F%2Flocalhost%3A8080%2Foauth%2Fgoogle_oauth2%2Fcallback&response_type=code&scope=email%20profile%20openid%20https%3A%2F%2Fwww.googleapis.com%2Fauth%2Fuser.birthday.read&state=Rnh1M05SQzBYYmJrbVg0bkVMWlMxTXFXODBKN0ZmWWdWMnZ2UHIvZ3RicE5rekRRWTVwUWFZVlBSSlNlRzBWRW0vem95RFJReWtWU0lYZ1pkMUVpUWpJSElWVzRjc3VyU0pVNnpyeTJnZHNEbjIvUTZDYXRDMW9pZ0J5aFg0ZGotLVlZenlnWXoybkEwclA1S09tUWFSaGc9PQ%3D%3D--aab5bbc23bc4022144a3b0c2e54146d7cf1f82b5&flowName=GeneralOAuthFlow&consent=prompt

An extra screen will be added (for the birthday?) but the same code results in:

I, [2020-12-28T21:57:05.769129 #12751]  INFO -- request: POST https://oauth2.googleapis.com/token
D, [2020-12-28T21:57:05.769200 #12751] DEBUG -- request: User-Agent: "Faraday v0.15.4"
Content-Type: "application/x-www-form-urlencoded"
D, [2020-12-28T21:57:05.769236 #12751] DEBUG -- request: grant_type=authorization_code&code=4%2F0AY0e-g44J0NlPOH97IsKKfC6urEmF-SG-6TluFqAHwVyuBvAfnT3q7MAplpQTpDrIjtQmQ&redirect_uri=http%3A%2F%2Flocalhost%3A8080%2Foauth%2Fgoogle_oauth2%2Fcallback&client_id=712371328747-vkq28iga72b31ube6j3jep3i2d3h0sn6.apps.googleusercontent.com&client_secret=****
I, [2020-12-28T21:57:05.950320 #12751]  INFO -- response: Status 200
D, [2020-12-28T21:57:05.950412 #12751] DEBUG -- response: pragma: "no-cache"
date: "Tue, 29 Dec 2020 04:57:03 GMT"
expires: "Mon, 01 Jan 1990 00:00:00 GMT"
cache-control: "no-cache, no-store, max-age=0, must-revalidate"
content-type: "application/json; charset=utf-8"
vary: "Origin, X-Origin, Referer"
server: "scaffolding on HTTPServer2"
x-xss-protection: "0"
x-frame-options: "SAMEORIGIN"
x-content-type-options: "nosniff"
alt-svc: "h3-29=\":443\"; ma=2592000,h3-T051=\":443\"; ma=2592000,h3-Q050=\":443\"; ma=2592000,h3-Q046=\":443\"; ma=2592000,h3-Q043=\":443\"; ma=2592000,quic=\":443\"; ma=2592000; v=\"46,43\""
connection: "close"
transfer-encoding: "chunked"
D, [2020-12-28T21:57:05.950452 #12751] DEBUG -- response: {
  "access_token": "ya29.a0AfH6SMBK5Co-B6nZ_H0hdUln5g0HEsN0ILhERq2BMx1NJ2c7GeCJAXvoWU9EjqFejKwwn_zj0ly1ThKqr0DuBnVk8hZdC8lKdNaiCk5W2r1its4zxI9hE7CZMFNhhrpI6OeUULQJkLDFrcwWOJzFZyKsR1wGNCxchwgfAqFiF9k",
  "expires_in": 3598,
  "refresh_token": "***",
  "scope": "https://www.googleapis.com/auth/user.birthday.read https://www.googleapis.com/auth/userinfo.email https://www.googleapis.com/auth/userinfo.profile openid",
  "token_type": "Bearer",
  "id_token": "***"
}

How come this seems to be the only way to get a refresh token? and why doesnt signet support this v2 endpoint?
So