Share Google Docs Securely with a Google Apps Script
Add Additional Data Protections to G Suite with the Virtru SDK
I’m not a developer. I know a little JavaScript and Python — enough to write a couple of basic scripts to help with some of my more mundane tasks — but I certainly don’t have the skills or know-how to write actual software. What I do know, however, are my customers and the challenges they face in keeping their data secure. So when we released the Virtru SDK, touting its ease of use, I was skeptical. How hard is this going to be for my customers to integrate into their existing workflows? Could someone with my limited coding skills build something with this? Let’s find out!
TL; DR: Yes. It actually is really easy to add the Virtru SDK to your project, as I’ll demonstrate through the construction of a “Protect & Share” Google Docs add-on. See the completed project here.
Identifying a Project
To find a project that would both add value to my current workflows and demonstrate the functions of the Virtru SDK, I asked myself three questions:
What are my most common workflows?
Well, we’re a G Suite shop, so let’s start there. I spend a lot of time in Google Docs. Whether taking notes, writing reports, developing customer-facing documentation, or drafting this very blog post, it’s a rare day that I don’t work in at least one Google Doc. And since these documents can be internal-only or customer-facing, I’m always trying to figure out how best to share them.
Could these workflows use additional layers of data protection?
Google has some great protections and controls for sharing Docs content with other G Suite users, but the experience sharing outside the Google ecosystem has always been lacking. If you want to share a Doc with a non-Google user, you’re forced to make your data semi-public on the internet with no guarantee that it’ll only be accessed by authorized parties. Even for my least-sensitive documents, I’m not thrilled with this requirement; for my most sensitive content, it’s a showstopper.
What’s the lowest barrier to entry?
When I think “add features to G Suite”, I typically think “Chrome Extension”. But recently I’ve been experimenting with Google Apps Script, and it’s clearly the more compelling solution for this use case. The code runs directly within G Suite, so I won’t have to build and package an extension. It’s JavaScript & HTML-based, so it will support Virtru’s browser JS SDK. And it’s designed to do exactly what I ultimately want to do: build add-ons to extend Google Sheets, Docs, & Slides.
Goal
To build a Google Docs add-on that will allow me to generate a secure, encrypted copy of my Google Docs content and share it privately with authorized users. To that end, I’ll need to add the following functions to the Docs UI:
- Capture Google Doc content in a PDF.
- Encrypt that PDF with policy controls set by the user such as document watermarking, expiration date, and disable re-sharing.
- Download the encrypted PDF, OR
- Send the encrypted PDF as an email attachment.
The first, third, and fourth functions above are all straightforward and easily accomplished with the tools available in Google Apps Script. The only new functionality I need to add is to encrypt the document and apply my access controls.
Building It
When In Doubt, Copy & Paste
With zero experience writing a Docs add-on, I’ve decided to simply copy this sample translation project from Google’s own documentation, rip out the parts I don’t need, then add my own code.
A basic add-on has two parts: server-side code running within the Google Apps Script environment — ‘Code.gs’ — and client-side code running directly on the page — ‘virtruSidebar.html’. I want to encrypt client-side, so I can copy some sample code from the Virtru Developer Hub’s browser JS quick-start into my client-side HTML file to import the Virtru SDK and styling:
Next, I need to add the element that will actually perform the encryption step — the Virtru ‘client’. Again, the browser JS quick-start has some helpful code I can copy to generate the client:
This is a good start, but as-is, this client is configured to accept a simple string input and output an encrypted .txt file; I need to take a PDF as input and output an encrypted PDF before this will actually be useful.
Generating a PDF
As noted above, most of what this add-on will do can be accomplished with the native tools available in Google Apps Script, including the generation of a PDF from Google Docs content. First, I’ll add some server-side code to generate a blob from the current document and format as a base-64 string for easy transport to the client:
And then a client-side function to call the above server-side function and return the document data to the client:
Customizing the Quick Start
In order to encrypt a file rather than a simple text string, I’ll make two adjustments to the Virtru client:
- Change the data source for encryption from string to array buffer. With an array buffer input, the client can accept any file type so long as it has been appropriately converted beforehand.
- Change the output type to ensure the final encrypted file will render as and decrypt to PDF.
At this point, the add-on can generate an encrypted copy of the Google Doc. Great! However, it lacks any access controls or sharing options. By default, the document owner is the only authorized user. Let’s change that.
Adding Access Controls
Each data object protected by Virtru encryption is associated with a policy that dictates the authorized recipients and access controls such as expiration date & watermarking. Based on the data owner’s inputs, I can construct a policy object to pass to the encryption client. In the example below, user input is captured by a series of checkbox elements, but you can use whatever mechanism you like:
The policy is then passed to the encryption client. Authorized users can be included in the policy object itself, or added as an additional encryption parameter {array} as shown here:
Sending an Email
If I want to email the encrypted file to the authorized users rather than download it, I need to change the code a bit. Instead of encrypting directly to a file, I’ll encrypt to a string. That string includes the encrypted file ciphertext and the HTML data that allows a user to open it in the browser:
This string can then be passed to a server-side function to create an email with the encrypted file attached:
Tying It All Together
With all the components working as needed, the final step is to make this into something a human can actually use. I added some toggles, buttons, text input fields, and a little jQuery to allow users to perform the following actions:
- Choose “Encrypt & Download” or “Encrypt & Email”.
- Add authorized users.
- Add access controls.
- Include a custom message to email recipients.
This actually accounted for the majority of code that I wrote for this project. The protection-specific pieces — encrypting the file and adding access controls — account for a very small portion of the add-on. And of that portion, I copied and pasted most of it!
The entire project is available on GitHub, where you can take a look at all the additional elements I added. Here’s the full add-on in action:
Encrypt & Download:
Encrypt & Email:
Food for Thought
This ended up being easier to implement than I thought it would be. In fact, the steepest learning curve for me was figuring out where Google Apps Script and vanilla JavaScript differ and how they best interact. Adding encryption to the add-on was almost an afterthought. So while this project may not be directly applicable to you or your organization, it should illustrate how quickly you can integrate data protection into your own workflows.
With this under my belt, I think I’ll try to develop some additional functions or new add-ons to see how else I can leverage Google Apps Script in my day-to-day. Please let me know in the comments if you have any ideas for next projects or additional features!
About Me
I’m a Solutions Engineer at Virtru, where I work with our customers to identify areas of their environments where additional data protections are needed, and develop solutions using Virtru’s Data Protection Platform & SDKs to meet those needs. Our developer platform is built on our SaaS Key and Policy Infrastructure to support data security, audit, and control using the open standard TDF3.
