403 error with fetchquerysummary response

[tendres]

Hi,
Hoping someone can point me in the right direction here.

Production Deployment
Tile is added successfully but after 'Generate Summary' no results are returned.

The 'fetchquerysummary queryResult' is successful but the following 'fetchquerysummary response' fails with:
POST 403 251 B 2 ms Ruby https://dashboard-summary-service-xxxxxxxxxxx.us-central1.run.app/generateQuerySummary

httpRequest: {
cacheFillBytes: "0"
cacheHit: false
cacheLookup: false
cacheValidatedWithOriginServer: false
latency: "0.003355997s"
protocol: "HTTP/1.1"
remoteIp: "0.0.0.0"
requestMethod: "POST"
requestSize: "64357"
requestUrl: "https://dashboard-summary-service-xxxxxxxxxxx.us-central1.run.app/generateQuerySummary"
responseSize: "251"
serverIp: "216.xxx.xx.xx"
status: 403
userAgent: "Ruby"
}

Any suggestions on where to diagnose would be much appreciated.

[solavrc]

@tendres Are you checking the correct client secret?

dashboard-summarization/restful-service/src/index.js

Lines 56 to 62 in af034be

	const verifyClientSecret = (req, res, next) => {
	const clientSecret = req.body.client_secret;
	console.log('checking client secret', clientSecret, storedClientSecret);
	if (clientSecret === storedClientSecret) {
	next();
	} else {
	res.status(403).send('Forbidden: Invalid client secret');

In manifest.lkml:

project_name: "your-project"
application: dashboard-summarization {

In this case, the User Attribute required in {YOUR_ORG}.cloud.looker.com/admin/user_attributes is:
your_project_dashboard_summarization_genai_client_secret

Don't forget to add the project_name prefix and convert hyphens - to underscores _.

FYI: I encountered Forbidden: Invalid client secret during deployment with an AI Agent. This happened because there was a newline character at the end of the GENAI_CLIENT_SECRET environment variable in Cloud Run, causing it to not match the request.

[tendres]

@solavrc Really appreciate your help - yes this is a GENAI_CLIENT_SECRET issue.

My added User Attribute = dashboard_summarization_extension_dashboard_summarization_genai_client_secret with the Default Value populated (current_password).

I am seeing this problem in the GC logs:
checking client secret current_password old_password from #58 below:

dashboard-summarization/restful-service/src/index.js

Lines 56 to 62 in af034be

	const verifyClientSecret = (req, res, next) => {
	const clientSecret = req.body.client_secret;
	console.log('checking client secret', clientSecret, storedClientSecret);
	if (clientSecret === storedClientSecret) {
	next();
	} else {
	res.status(403).send('Forbidden: Invalid client secret');

So obviously (clientSecret === storedClientSecret) but I cannot find where to update storedClientSecret.
Not sure how an old password from an early build attempt is still visible.
My .env file and the terraform variables.tf file are both correct and 'old_pasword' does not exist in my repository clone.
I confirmed 'current_passsword' exists in Secrets manager.

Also, in the manifest.lkml does line:
scoped_user_attributes: ["genai_client_secret"] need to be updated to match the name used in User Attribute?

This must be simple - maybe a cache thing?

Thanks!

[tendres]

This can be closed. After a purge of resources on GC and a rebuild all is good.