How to authenticate a cloud functions with the Api https://www.googleapis.com/drive/v3/changes/watch?

user_13393502 0
Viewed 56

I am developing an application that interacts with Google Drive and will work as follows: When a user adds/modifies a file in Drive Share, my application will receive a notification and I will handle it. I did the development locally using Auth2 authentication and everything works perfectly, but this application will be hosted on a Cloud Functions and because of that I am not able to use Auth2 authentication, as user consent is required. Due to this problem, I went to the perspective of using a Service Account, where I added it as the manager of my share drive, used it to create the function, and gave it all the necessary permissions, but when I modify a file, the my endpoint that was supposed to receive the message, just doesn't. I did a search and saw that it's due to the service account not having access to user data, so it makes sense that no notification would be created. Below I am attaching the code I am using to create the watcher on the drive and the authentication process by SA:

Code responsible for get credentials to authentication

    SCOPES = [
    "https://www.googleapis.com/auth/drive",
    "https://www.googleapis.com/auth/drive.file",
    "https://www.googleapis.com/auth/drive.readonly",
    "https://www.googleapis.com/auth/drive.metadata.readonly"
]    

    credentials, project_id = google.auth.default(scopes=SCOPES)
                credentials.refresh(req.Request())

Code responsible for creating the watch

drive = discovery.build("drive", "v3", credentials=credentials)   

params = {
    "kind": "api#channel",
    "id": "id_watcher",
    "type": "webhook",
    "address": "address cloud functions"        
}

# r = drive.changes().watch(fileId=file_id, body=params, supportsAllDrives=True, supportsTeamDrives=True).execute()
r = drive.changes().watch(pageToken=1,
                        body=params, 
                        driveId=driverId, 
                        includeCorpusRemovals=True, 
                        includeItemsFromAllDrives=True, 
                        includePermissionsForView=None, 
                        includeRemoved=True, 
                        includeTeamDriveItems=True, 
                        pageSize=None, 
                        restrictToMyDrive=None, 
                        spaces=None, 
                        supportsAllDrives=True, 
                        # supportsTeamDrives=True, 
                        # teamDriveId=driverId
                        ).execute()

My question would be if there is a way to use Auth2 without the need for user consent, that is, without the step of opening the browser and allowing the generation of the token. If not, can you help me with a method that might work?

Remembering that this code will be in a cloud functions.

Thank you very much!

file-watcher service-accounts google-cloud-functions google-drive-api google-oauth
1 Answers

Two suggestions, one for the user consent scenario and one alternative for the notifications:

Domain Wide Delegation and Impersonation

If you are using Google Workspace and building the application for the organization. You can use Domain Wide Delegation if you are utilizing Service accounts. This would allow you to start the process of impersonation and avoid the consent of the users.

As suggested by the official documentation you can also apply and review the ways to grant the service account with the option to impersonate users.

Generating Notifications

Another suggestion could be utilizing Pub/Sub or push notifications to have your alerts. You would be able to utilize the Service account and your code and get the notifications and have them similar to an Audit log:

enter image description here

The image is a sample of a Gmail APi for watch and list.

References:

user_179264770
Related