Secure Agentic AI with Quarkus and Google Gemini

<dependency>
    <groupId>io.quarkus</groupId>
    <artifactId>quarkus-websockets-next</artifactId> (1)
</dependency>
<dependency>
    <groupId>io.quarkus</groupId>
    <artifactId>quarkus-oidc</artifactId> (2)
</dependency>
<dependency>
    <groupId>io.quarkus</groupId>
    <artifactId>quarkus-rest-client-oidc-token-propagation</artifactId> (3)
</dependency>
<dependency>
    <groupId>io.quarkiverse.langchain4j</groupId>
    <artifactId>quarkus-langchain4j-oidc-model-auth-provider</artifactId> (4)
</dependency>
<dependency>
    <groupId>io.quarkiverse.langchain4j</groupId>
    <artifactId>quarkus-langchain4j-vertex-ai-gemini</artifactId> (5)
</dependency>

# Google OpenId Connect configuration:

quarkus.oidc.provider=google (1)
quarkus.oidc.client-id=${GOOGLE_CLIENT_ID} (2)
quarkus.oidc.credentials.secret=${GOOGLE_CLIENT_SECRET} (2)
quarkus.oidc.authentication.extra-params.scope=https://www.googleapis.com/auth/generative-language.retriever,https://www.googleapis.com/auth/cloud-platform,https://www.googleapis.com/auth/calendar (3)

# Gemini configuration

quarkus.langchain4j.vertexai.gemini.chat-model.model-id=gemini-2.0-flash (4)
quarkus.langchain4j.vertexai.gemini.location=europe-west1
quarkus.langchain4j.vertexai.gemini.project-id=${GOOGLE_PROJECT_ID} (5)
quarkus.langchain4j.vertexai.gemini.log-requests=true
quarkus.langchain4j.vertexai.gemini.log-responses=true

quarkus.rest-client.google-calendar-api.url=https://www.googleapis.com/calendar/v3 (6)

package org.acme.gemini;

import org.acme.gemini.PersonalAssistantResource.PersonalAssistantTools;

import dev.langchain4j.service.SystemMessage;
import dev.langchain4j.service.UserMessage;
import io.quarkiverse.langchain4j.RegisterAiService;
import jakarta.enterprise.context.SessionScoped;

@RegisterAiService(tools = { PersonalAssistantTools.class, GoogleCalendarClient.class })
@SessionScoped
public interface PersonalAssistantService {
    @SystemMessage("""  (1)
            You are a personal assistant.
            Your tasks are:
             - Provide the currently logged-in user with an information about the scheduled events after the {{timeMin}} but before the {{timeMax}} date and time.
             - Get the list of the available calendars and ask the user which calendar the user would like to check; remember the user's choice.
             - Use the calendar id field as a calendarId value in all the tool operations with the chosen calendar but show only calendar summary to the user.
             - Help the user to schedule other events during this period, advise about any event conflicts.
             - Let the user know which calendar contains a given event.
             - Be polite but do not hesitate to be informal sometimes to make the user smile.

             The event is represented as a JSON object and has the following fields:
               summary is the event summary
               description is the event description
               location is the event location
               start is the event start date and time JSON object
               end is the event end date and time JSON object
               id is the eventId that can be used for accessing, deleting or modifying this event.

             Both start and end JSON objects have the following fields:
             date date with the first 4 digits representing a year, next 2 ones - a month, and the last 2 ones - a day, for example, 2025-03-21.
             dateTime RFC3339 date and time timestamp with mandatory time zone offset, for example, 2011-06-03T10:00:00-07:00, 2011-06-03T10:00:00Z.
             timeZone time zone.

             The date and time is represented as a RFC3339 timestamp with mandatory time zone offset, for example, 2011-06-03T10:00:00-07:00, 2011-06-03T10:30:30Z.
             In the timestamp such as 2011-06-03T10:00:00Z, the year is 2011, the month - 06 (June), the day - 3rd day of the month, the hour is '10', the minutes - '30', and the seconds - '30'.
             'Z' indicates a GMT time zone.

             To calculate an event duration, deduct the event's start date and time from its end date and time.
             Typically, calculating a difference in hours and minutes is enough for most events.

             The calendar is represented as a JSON object and has the following fields:
               id is the calendarId
               summary is the calendar summary
               description is the calendar description
               location is the calendar location
               timeZone is the calendar time zone
               primary is the calendar primary boolean status
               """)
    String assist(@UserMessage String question, String timeMin, String timeMax); (2)
}

package org.acme.gemini;

import org.eclipse.microprofile.jwt.Claims;
import org.eclipse.microprofile.jwt.JsonWebToken;

import dev.langchain4j.agent.tool.Tool;
import io.quarkus.oidc.IdToken;
import io.quarkus.security.Authenticated;
import jakarta.inject.Inject;
import jakarta.inject.Singleton;

@Singleton
@Authenticated (1)
public class PersonalAssistantTools {

    @Inject
    @IdToken
    JsonWebToken identity; (2)

    @Tool("Returns the first name and the family name of the logged-in user.")
    public String getLoggedInUserName() { (3)
        return identity.getName();
    }

    @Tool("Returns email address of the logged-in user.")
    public String getEmailAddressOfLoggedInUser() { (4)
       return identity.getClaim(Claims.email);
    }
}

package org.acme.gemini;

import java.time.ZonedDateTime;
import java.util.List;

import org.eclipse.microprofile.rest.client.inject.RegisterRestClient;
import org.jboss.resteasy.reactive.RestQuery;

import dev.langchain4j.agent.tool.Tool;
import io.quarkus.oidc.token.propagation.AccessToken;
import jakarta.ws.rs.Consumes;
import jakarta.ws.rs.DELETE;
import jakarta.ws.rs.GET;
import jakarta.ws.rs.POST;
import jakarta.ws.rs.PUT;
import jakarta.ws.rs.Path;
import jakarta.ws.rs.PathParam;
import jakarta.ws.rs.Produces;
import jakarta.ws.rs.core.MediaType;

@RegisterRestClient(configKey = "google-calendar-api")
@AccessToken (1)
@Path("/")
public interface GoogleCalendarClient {

    @GET
    @Path("/users/me/calendarList")
    @Produces(MediaType.APPLICATION_JSON)
    @Tool("Get calendars list")
    Calendars getCalendars(); (2)

    @GET
    @Path("/calendars/{calendarId}/events")
    @Produces(MediaType.APPLICATION_JSON)
    @Tool("Get events")
    Events getEvents(@PathParam("calendarId") String calendarId, @RestQuery("timeMin") String timeMin, @RestQuery("timeMax") String timeMax); (3)

    @PUT
    @Path("/calendars/{calendarId}/events/{eventId}")
    @Produces(MediaType.APPLICATION_JSON)
    @Consumes(MediaType.APPLICATION_JSON)
    @Tool("Update or move event")
    Events updateEvent(@PathParam("calendarId") String calendarId, @PathParam("eventId") String eventId, Event event); (4)

    // Other methods are omitted for brewity

    public static record Calendars(List<Calendar> items) { (5)
    }

    public static record Calendar(String id, String summary, String description, String location, String timeZone, boolean primary) {
    }

    public static record Events(List<Event> items) { (5)
    }

    public static record Event(String summary, String description, String location, Start start, End end, String id) {
    }

    public static record Start(String date, ZonedDateTime dateTime, String timeZone) {
    }

    public static record End(String date, ZonedDateTime dateTime, String timeZone) {
    }
}

package org.acme.gemini;

import java.time.Instant;
import java.time.ZoneId;
import java.time.ZonedDateTime;
import java.time.format.DateTimeFormatter;

import org.eclipse.microprofile.jwt.Claims;
import org.eclipse.microprofile.jwt.JsonWebToken;
import org.jboss.logging.Logger;

import dev.langchain4j.agent.tool.Tool;
import io.quarkus.oidc.IdToken;
import io.quarkus.security.Authenticated;
import io.quarkus.security.identity.SecurityIdentity;
import io.quarkus.websockets.next.OnOpen;
import io.quarkus.websockets.next.OnTextMessage;
import io.quarkus.websockets.next.WebSocket;
import jakarta.inject.Inject;
import jakarta.inject.Singleton;

@WebSocket(path = "/assistant")
@Authenticated (1)
public class PersonalAssistantResource {

    private static final Logger log = Logger.getLogger(PersonalAssistantResource.class);

    PersonalAssistantService assistant;

    public PersonalAssistantResource(PersonalAssistantService assistant) {
        this.assistant = assistant;
    }

    @Inject
    SecurityIdentity identity;

    @OnOpen (2)
    public String onOpen() {
        return "Hello, " + identity.getPrincipal().getName() + ", I'm your Personal Assistant, how can I help you?";
    }

    @OnTextMessage (3)
    public String onMessage(String question) {
        DateTimeFormatter formatter = DateTimeFormatter.ofPattern("yyyy-MM-dd'T'HH:mm:ss'Z'");

        ZonedDateTime minDateTime = Instant.now().atZone(ZoneId.of("GMT"));
        String timeMin = minDateTime.format(formatter);

        ZonedDateTime maxDateTime = minDateTime.plusDays(30);
        String timeMax = maxDateTime.format(formatter);

        return assistant.assist(question, timeMin, timeMax);
    }
}

mvn quarkus:dev