POST
Host: yourboturl.com
Authorization: Bearer %JWT%
Content-Type: application/json
User-Agent: Google-Dynamite

{
  "alg": "RS256",
  "kid": "424189bd9a18927f7ee924f1a100601f1524f441",
  "typ": "JWT"
}

{
  "aud": "1234567890",
  "exp": 1629047990,
  "iat": 1629044390,
  "iss": "chat@system.gserviceaccount.com"
}

import { NextFunction, Request, Response, Router } from 'express';
import jwt from 'jsonwebtoken';
import { JwksClient } from 'jwks-rsa';

const GOOGLE_CHAT_PROJECT_NUMBER = '1234567890';

const jwksClient = new JwksClient({
  jwksUri:
    'https://www.googleapis.com/service_accounts/v1/jwk/chat@system.gserviceaccount.com',
  cache: true,
});

const router: Router = Router();

router.post('/google-chat/events', verificationRequestMiddleware(), async (req, res) => {
  // process google chat event
});

function verificationRequestMiddleware() {
  return async (request: Request, response: Response, next: NextFunction) => {
    const isVerified = await verifyRequest(request);

    if (!isVerified) {
      throw new UnauthorizedError('Authentication failed');
    }

    return next();
  };
}

async function verifyRequest(request: Request): Promise<boolean> {
  const prefix = 'Bearer ';
  const authHeader = request.header('Authorization') as string;
  const token = authHeader?.startsWith(prefix) ? authHeader.slice(prefix.length) : null;

  if (!token) {
    return false;
  }

  return new Promise<boolean>((resolve, reject) => {
    const getKey = (header, callback) => {
      jwksClient.getSigningKey(header.kid, (err, key) => {
        const signingKey = key.getPublicKey();
        callback(null, signingKey);
      });
    };

    jwt.verify(
      token,
      getKey,
      {
        audience: GOOGLE_CHAT_PROJECT_NUMBER,
        issuer: 'chat@system.gserviceaccount.com'
      },
      (err: any, decoded: any) => {
        if (err) {
          reject(false);
        } else {
          resolve(true);
        }
      }
    );
  });   
}