I'm creating a Google Docs add-on in Google Apps Script, and some of the functionality requires that I use the Google Drive advanced service as described in https://developers.google.com/apps-script/guides/services/advanced. After enabling the advanced service, my script is now requesting the https://www.googleapis.com/auth/drive scope, which is way overbroad for what I'm trying to do - I only want to touch the files that the user is actually using this add-on with, not their whole drive! I'd much rather be using https://www.googleapis.com/auth/drive.file, which is restricted to files the user is actively using with the script.
I've tried setting the @OnlyCurrentDoc JSDoc tag as mentioned in https://developers.google.com/gsuite/add-ons/concepts/scopes#editor_add-on_scopes, but that only changes the broad https://www.googleapis.com/auth/documents scope to https://www.googleapis.com/auth/documents.currentonly - it doesn't change the Drive API scope.
Also, I've verified that the script does actually need the auth/drive scope, because when I went into the project manifest and explicitly requested auth/drive.file, I got a 404 response with API call to drive.revisions.list failed with error: File not found: 1Sj_oq93ny5q9348ncyo8934nyc at getAuthors(Code:54) at showSidebar(Code:20). That's exactly what I'd expect for a file that hasn't been "tagged" for use with this script.
Here's a very minimal gdocs addon that shows the issue:
function onOpen(e) {
var menu = DocumentApp.getUi().createAddonMenu();
menu.addItem("Get revisions", "getRevisions");
menu.addToUi();
}
function getRevisions() {
var docId = DocumentApp.getActiveDocument().getId();
Logger.log("Document id: "+docId);
var revs = Drive.Revisions.list(docId);
Logger.log("Found revisions: "+revs.items.length);
}
Again, this works just fine with the default auth/drive scope, but not with auth/drive.file.
The documentation for https://www.googleapis.com/auth/drive.file specifies that it grants "Per-file access to files created or opened by the app. File authorization is granted on a per-user basis and is revoked when the user deauthorizes the app." according to the docs at https://developers.google.com/drive/api/v2/about-auth#OAuth2Authorizing. What isn't clear is: how does Google determine what files have been "created or opened by the app", especially when it comes to editor addons? I would think that any document that has had the add-on enabled would count as "opened by the app", but I guess not. Is there any way to make this scope work?