How to not execute "onAddToSpace" when I add a OAUTH scope

Question

I'm trying to create a bot using GoogleChatAPI.

Here is what I am trying to do:

1. If a User adds the bot that I'm creating, I want the bot to show a message of caution for using the bot.

2. If a User posts a message in the bot, the bot will post that message to another chat room. The method of posting a message is "UrlFetchApp.fetch" (and add an OAUTH scope at the same time)

To achieve task 1, I have used the code onAddToSpace. To achieve task 2, I have used the code onMessage.

But when the Users add the bot, onAddToSpace does not get ignited. This event isn't in the Executions List. But when I delete the code UrlFetchApp.fetch (and delete an OAUTH scope at the same time), then onAddToSpace gets ignited.

How can I write the codes to achieve the two things I'm trying to do at the same time? Or is it even possible?

Code:

function onMessage(event) {
  var name = "";
  var message = "ご依頼承りました！情シスからご連絡いたしますので少々お待ち下さい。";
  postICTRoom(event);
  return { "text": message };
}

function onAddToSpace(event) {
  var message = "情シスへ質問、依頼ができるbotです。送信したメッセージは、ユーザー名付きですべて情シスチームチャットに送信されます。遊びが一切ないbotです、ご利用の際は十分ご注意ください。ここは万事屋ではありません。";
  return { "text": message };(*1)
}

function onRemoveFromSpace(event) {
  console.info("Bot removed from ",
      (event.space.name ? event.space.name : "this chat"));
}

function postICTRoom(event){
  var messageDate = new Date()  
  var url = "https://chat.googleapis.com/v1/spaces/...";
  var thread = "spaces/..."
  var payload = {
    "text" : event.user.displayName + " " + Utilities.formatDate(messageDate, "JST", 'yyyy/MM/dd_HH:mm:ss') + "\n" + event.message.text,
    "thread": {
    "name": thread
    }
  }
  var json = JSON.stringify(payload);
  var options = {
    'method': 'POST',
    'contentType': 'application/json; charset=UTF-8',
    "payload" : json
  };
  var response = UrlFetchApp.fetch(url, options);

Manifest:

{
  "timeZone": "Asia/Tokyo",
  "dependencies": {
  },
  "exceptionLogging": "STACKDRIVER",
  "runtimeVersion": "V8",
  "chat": {
  }
}

OAuthScope

https://www.googleapis.com/auth/script.external_request

Update

1. onAddToSpace wasn't executed when I added the bot.
2. I posted a message and approved OAuth, then onMessage got executed.
3. After when I approved OAuth, and I once removed the bot, I added it again, onAddToSpace was already executed as I have expected...

I want to know if it is possible and if so, how I can get onAddToSpace executed before I have to approve OAuth.

Update2

Example of onAddToSpace successed(1)

1. Set scopes script.external_request and chat.
2. Added the bot.onAddToSpace was not executed at that time, because the log didn't display on screen and the bot didn't post a message(point of (*1) in Code).
3. Posted a message. onMessage successed. At that time I approved OAuth.
4. Removed the bot and added it again. onAddToSpace was executed the first time.

Example of onAddToSpace successed(2)

1. Removed scopes script.external_request and chat. And removed "UrlFetchApp.fetch".
2. Added the bot. onAddToSpace is executed from the beginning. Of course, It was not OAuth.
3. Posted a message. onMessage successed.

I'd like to get onAddToSpace to be executed at the point of successed(1)-Step2. I don't know how I can make this work.

Update3

Manifest(modified):

{
  "timeZone": "Asia/Tokyo",
  "dependencies": {
  },
  "exceptionLogging": "STACKDRIVER",
  "runtimeVersion": "V8",
  "chat": {
    "addToSpaceFallbackMessage": "情シスへ質問、依頼ができるbotです。送信したメッセージは、ユーザー名付きですべて情シスチームチャットに送信されます。遊びが一切ないbotです、ご利用の際は十分ご注意ください。ここは万事屋ではありません。"
  }
}

Answer 1

For correct functioning of your code you need to include the necessary OAuth scopes into the manifest

For this please modify your manifest as following:

{
"timeZone": "Asia/Tokyo",
  "dependencies": {
  },
  "exceptionLogging": "STACKDRIVER",
  "oauthScopes": ["https://www.googleapis.com/auth/chat", "https://www.googleapis.com/auth/script.external_request"],
  "runtimeVersion": "V8",
  "chat": {
  }
}

UPDATE

I understand that you want to show a custom message before configuring your bot

---

---

---

---

This is not possible for security reasons

• It is part of the Google OAuth authenticatication concept that your bot cannot anything (not even writing a message) before being authorized by the user
• As states int he documentation

onAddToSpace(e)

This function is executed when your bot is added to a space.

• Before you authorize the access you bot is NOT added to a space

WORKAROUND

• You can customize the OAuth2 concent screen in your GCP console

---

---

---

• Unfortunately there is no way to add a custom message to the consent screen, but you can include / set it as the Application name:

---

---

• After doing so, your content screen will look as following:

---

---

HOW TO TEST

In order to trigger authorization again

• Go on https://myaccount.google.com/security
• Third party apps with account access

---

---

• Remove your bot

---

---

• Now you can test authorization with the new consent screen