GMail API设置非主发送签名返回错误403

Question

我正在制作一个应用程序，它应该为域中的每个用户设置签名。当我尝试在主别名上设置签名时，此解决方案可以正常工作，但此解决方案不适用于其他别名(非主别名)。

我使用一个工作良好的域范围的委托，因为我可以设置签名为所有主要发送作为域中的别名。为此，我使用请求:'www.googleapis.com/gmail/v1/users//settings/sendAs/'。当我对非主别名做同样的事情时，我收到一个错误403，其中有一条消息告诉我错过了'www.googleapis.com/auth/gmail.settings.sharing'范围。

Missing required scope "https://www.googleapis.com/auth/gmail.settings.sharing" for modifying non-primary SendAs

这些是我在代码中使用的作用域:

"oauthScopes": [
"https://www.googleapis.com/auth/gmail.settings.basic",
"https://www.googleapis.com/auth/gmail.settings.sharing",
"https://www.googleapis.com/auth/script.external_request",
"https://www.googleapis.com/auth/documents",
"https://www.googleapis.com/auth/admin.directory.user.readonly",
"https://www.googleapis.com/auth/drive.readonly"
]

可以看到'sharing'作用域存在

// The service that allow me to list send as alias
var serviceListe = getDomainWideDelegationService('Gmail: ', 'https://www.googleapis.com/auth/gmail.settings.basic', user.primaryEmail)
// THe service that allow me to edit send as signature
var serviceModif = getDomainWideDelegationService('Gmail: ', 'https://www.googleapis.com/auth/gmail.settings.sharing', user.primaryEmail)

返回域范围委托的代码:

function getDomainWideDelegationService(serviceName, scope, email) {
return OAuth2.createService(serviceName + email)
// Set the endpoint URL.
.setTokenUrl('https://oauth2.googleapis.com/token')
// Set the private key and issuer.
.setPrivateKey(OAUTH2_SERVICE_ACCOUNT_PRIVATE_KEY)
.setIssuer(OAUTH2_SERVICE_ACCOUNT_CLIENT_EMAIL)
// Set the name of the user to impersonate. This will only work for
// Google Apps for Work/EDU accounts whose admin has setup domain-wide
// delegation:
// https://developers.google.com/identity/protocols/OAuth2ServiceAccount#delegatingauthority
.setSubject(email)
// Set the property store where authorized tokens should be persisted.
.setPropertyStore(PropertiesService.getScriptProperties())
// Set the scope. This must match one of the scopes configured during the
// setup of domain-wide delegation.
.setScope(scope);
}

Answer 1

根据这里的文档:

scope-该字段指定了一个以空格分隔的访问范围列表，这些范围对应于应用程序可以代表用户访问的资源。这些值通知谷歌显示给用户的同意屏幕。

考虑到这一点，我建议您使用空格和而不是来分隔作用域。逗号。参考

• OAuth 2.0 for Client-side Web Applications.