How to not execute "onAddToSpace" when I add a OAUTH scope - google-apps-script

Question

I'm trying to create a bot using GoogleChatAPI.
Here is what I am trying to do:
If a User adds the bot that I'm creating, I want the bot to show a message of caution for using the bot.
If a User posts a message in the bot, the bot will post that message to another chat room.
The method of posting a message is "UrlFetchApp.fetch" (and add an OAUTH scope at the same time)
To achieve task 1, I have used the code onAddToSpace.
To achieve task 2, I have used the code onMessage.
But when the Users add the bot, onAddToSpace does not get ignited. This event isn't in the Executions List.
But when I delete the code UrlFetchApp.fetch (and delete an OAUTH scope at the same time), then onAddToSpace gets ignited.
How can I write the codes to achieve the two things I'm trying to do at the same time?
Or is it even possible?
Code:
function onMessage(event) {
var name = "";
var message = "ご依頼承りました！情シスからご連絡いたしますので少々お待ち下さい。";
postICTRoom(event);
return { "text": message };
}
function onAddToSpace(event) {
var message = "情シスへ質問、依頼ができるbotです。送信したメッセージは、ユーザー名付きですべて情シスチームチャットに送信されます。遊びが一切ないbotです、ご利用の際は十分ご注意ください。ここは万事屋ではありません。";
return { "text": message };(*1)
}
function onRemoveFromSpace(event) {
console.info("Bot removed from ",
(event.space.name ? event.space.name : "this chat"));
}
function postICTRoom(event){
var messageDate = new Date()
var url = "https://chat.googleapis.com/v1/spaces/...";
var thread = "spaces/..."
var payload = {
"text" : event.user.displayName + " " + Utilities.formatDate(messageDate, "JST", 'yyyy/MM/dd_HH:mm:ss') + "\n" + event.message.text,
"thread": {
"name": thread
}
}
var json = JSON.stringify(payload);
var options = {
'method': 'POST',
'contentType': 'application/json; charset=UTF-8',
"payload" : json
};
var response = UrlFetchApp.fetch(url, options);
Manifest:
{
"timeZone": "Asia/Tokyo",
"dependencies": {
},
"exceptionLogging": "STACKDRIVER",
"runtimeVersion": "V8",
"chat": {
}
}
OAuthScope
https://www.googleapis.com/auth/script.external_request
Update
onAddToSpace wasn't executed when I added the bot.
I posted a message and approved OAuth, then onMessage got executed.
After when I approved OAuth, and I once removed the bot, I added it again, onAddToSpace was already executed as I have expected...
I want to know if it is possible and if so, how I can get onAddToSpace executed before I have to approve OAuth.
Update2
Example of onAddToSpace successed(1)
Set scopes script.external_request and chat.
Added the bot.onAddToSpace was not executed at that time, because the log didn't display on screen and the bot didn't post a message(point of (*1) in Code).
Posted a message. onMessage successed. At that time I approved OAuth.
Removed the bot and added it again. onAddToSpace was executed the first time.
Example of onAddToSpace successed(2)
Removed scopes script.external_request and chat. And removed "UrlFetchApp.fetch".
Added the bot. onAddToSpace is executed from the beginning. Of course, It was not OAuth.
Posted a message. onMessage successed.
I'd like to get onAddToSpace to be executed at the point of successed(1)-Step2.
I don't know how I can make this work.
Update3
Manifest(modified):
{
"timeZone": "Asia/Tokyo",
"dependencies": {
},
"exceptionLogging": "STACKDRIVER",
"runtimeVersion": "V8",
"chat": {
"addToSpaceFallbackMessage": "情シスへ質問、依頼ができるbotです。送信したメッセージは、ユーザー名付きですべて情シスチームチャットに送信されます。遊びが一切ないbotです、ご利用の際は十分ご注意ください。ここは万事屋ではありません。"
}
}

Answer 1

For correct functioning of your code you need to include the necessary OAuth scopes into the manifest
For this please modify your manifest as following:
{
"timeZone": "Asia/Tokyo",
"dependencies": {
},
"exceptionLogging": "STACKDRIVER",
"oauthScopes": ["https://www.googleapis.com/auth/chat", "https://www.googleapis.com/auth/script.external_request"],
"runtimeVersion": "V8",
"chat": {
}
}
UPDATE
I understand that you want to show a custom message before configuring your bot
This is not possible for security reasons
It is part of the Google OAuth authenticatication concept that your bot cannot anything (not even writing a message) before being authorized by the user
As states int he documentation
onAddToSpace(e)
This function is executed when your bot is added to a space.
Before you authorize the access you bot is NOT added to a space
WORKAROUND
You can customize the OAuth2 concent screen in your GCP console
Unfortunately there is no way to add a custom message to the consent screen, but you can include / set it as the Application name:
After doing so, your content screen will look as following:
HOW TO TEST
In order to trigger authorization again
Go on https://myaccount.google.com/security
Third party apps with account access
Remove your bot
Now you can test authorization with the new consent screen