Deleted Shared Drive group permission is reused based on emailaddress?

Viewed 119

We are using Google.Apis.Drive.v3 v1.41.1.1734 NuGet package and have a test scenario that does the following:

1. Create a group and a user
2. Add the user to the group
3. Create a Shared Drive and add a group permission with the emailaddress of the created group
4. Confirm that the user has access to the Shared Drive
5. Clean all testdata in Google

A problem comes up when we run the test a second time.

According to the drive api, the group permission is set (a list request returns the permission). But when we log in to Google Admin, go to the Shared Drives and check the members of the created Shared Drive, it does not show the group permission. Also the page of the user does not show the user as member of a Shared Drive.

When we execute a list request to get all permissions of the shared drive, we see that the id of the group permission of test run #2 is exactly the same as the id of the group permission (that was created and deleted) in test run #1.

When we run the test again, but change the emailaddres of the group so the permission is created with a different emailaddress, then the id of the permission is different and all behaves as expected (the group permission is visible in Google Admin and the user page shows that the user is member of the Shared Drive).

Our conclusion so far

When creating a new permission with the same emailaddres as a previously deleted permission, a deleted permission is reused. This is causing problems and the Shared Drive is not accessible to the user.

Also worth noting, every first test run of the day works as expected. Maybe there's some caching involved?

Other things we tried

We created a group permission with the Drive Api Explorer. Surprisingly, this permission shows up in Google Admin and the user page shows the user as member of the Shared Drive.

When we execute a list request again, two permissions are returned that look exactly the same (except for the id, all properties and values are alike).

But, the Drive Api Explorer returned the id of the permission that was created with the drive api create request.

Sample code of our call

var permission = new Permission
{
    Type = "group",
    Role = "fileOrganizer",
    EmailAddress = "johndoe@example.com"
};
var sharedDriveId = "0ANZoYzwTXKG7Uk9PVA";

var request = driveService.Permissions.Create(permission, sharedDriveId);
request.UseDomainAdminAccess = true;
request.SupportsAllDrives = true;
request.SendNotificationEmail = false;
request.Fields = "id";

var result = await request.ExecuteAsync();

And we also recreated this call with the Drive API Explorer permissions Create method.

1 Answers

I have created a bug for you in Google Issue Tracker regarding this issue. You can click the star on the top left in the linked page if you want to keep track of this issue.

As far as I can see, the same situation happens if the permission is granted to a specific user instead of a group. It also doesn't seem to be related specifically to C# libraries.

For the time being, just try not to reuse email addresses which were recently deleted.

Related