Google Sheets API v4 service_account - 禁止：调用者没有权限（Google::Apis::ClientError）

Question

Ruby：2.3.1

导轨：5.0.0

我需要通过 Google Sheets API 访问和更新我的私人 Google Sheet。 最终这将通过我的 Rails 应用程序中的重复后台作业来完成。因此，我在我的 Google Cloud Console 中设置了一个服务帐户。

但要开始使用 Google Sheets API，我创建了一个脚本：

require 'google/apis/sheets_v4'

ENV["GOOGLE_ACCOUNT_TYPE"] = 'service_account'
ENV["GOOGLE_CLIENT_EMAIL"] = '<client_email_from_downloaded_json_here>'
ENV["GOOGLE_PRIVATE_KEY"] = "<private_key_from_downloaded_json_here>"

SCOPE = Google::Apis::SheetsV4::AUTH_SPREADSHEETS

authorization = Google::Auth.get_application_default(SCOPE)

# Initialize the API
service = Google::Apis::SheetsV4::SheetsService.new
service.authorization = authorization

spreadsheet_id = '<MY SPREADSHEET ID HERE>'

sheet_name = 'Sheet1'

range = "#{sheet_name}!A2:B"

response = service.get_spreadsheet_values(spreadsheet_id, range)

puts 'No data found.' if response.values.empty?

response.values.each do |row|
  # Print columns A and B, which correspond to indices 0 and 1.
  puts "#{row[0]}, #{row[1]}"
end

当我运行该脚本时

$ rails runner -e development lib/scripts/google_sheets_api_demo.rb
/home/jignesh/.rvm/gems/ruby-2.3.1@my_integrations/gems/google-api-client-0.9.12/lib/google/apis/core/http_command.rb:211:in `check_status': forbidden: The caller does not have permission (Google::Apis::ClientError)
  from /home/jignesh/.rvm/gems/ruby-2.3.1@my_integrations/gems/google-api-client-0.9.12/lib/google/apis/core/api_command.rb:102:in `check_status'
  from /home/jignesh/.rvm/gems/ruby-2.3.1@my_integrations/gems/google-api-client-0.9.12/lib/google/apis/core/http_command.rb:179:in `process_response'
  from /home/jignesh/.rvm/gems/ruby-2.3.1@my_integrations/gems/google-api-client-0.9.12/lib/google/apis/core/http_command.rb:286:in `execute_once'
  from /home/jignesh/.rvm/gems/ruby-2.3.1@my_integrations/gems/google-api-client-0.9.12/lib/google/apis/core/http_command.rb:107:in `block (2 levels) in execute'
  from /home/jignesh/.rvm/gems/ruby-2.3.1@my_integrations/gems/retriable-2.1.0/lib/retriable.rb:54:in `block in retriable'
  from /home/jignesh/.rvm/gems/ruby-2.3.1@my_integrations/gems/retriable-2.1.0/lib/retriable.rb:48:in `times'
  from /home/jignesh/.rvm/gems/ruby-2.3.1@my_integrations/gems/retriable-2.1.0/lib/retriable.rb:48:in `retriable'
  from /home/jignesh/.rvm/gems/ruby-2.3.1@my_integrations/gems/google-api-client-0.9.12/lib/google/apis/core/http_command.rb:104:in `block in execute'
  from /home/jignesh/.rvm/gems/ruby-2.3.1@my_integrations/gems/retriable-2.1.0/lib/retriable.rb:54:in `block in retriable'
  from /home/jignesh/.rvm/gems/ruby-2.3.1@my_integrations/gems/retriable-2.1.0/lib/retriable.rb:48:in `times'
  from /home/jignesh/.rvm/gems/ruby-2.3.1@my_integrations/gems/retriable-2.1.0/lib/retriable.rb:48:in `retriable'
  from /home/jignesh/.rvm/gems/ruby-2.3.1@my_integrations/gems/google-api-client-0.9.12/lib/google/apis/core/http_command.rb:96:in `execute'
  from /home/jignesh/.rvm/gems/ruby-2.3.1@my_integrations/gems/google-api-client-0.9.12/lib/google/apis/core/base_service.rb:346:in `execute_or_queue_command'
  from /home/jignesh/.rvm/gems/ruby-2.3.1@my_integrations/gems/google-api-client-0.9.12/generated/google/apis/sheets_v4/service.rb:322:in `get_spreadsheet_values'
  from lib/scripts/google_sheets_api_demo.rb:35:in `<top (required)>'
  from /home/jignesh/.rvm/gems/ruby-2.3.1@my_integrations/gems/railties-5.0.0/lib/rails/commands/runner.rb:60:in `load'
  from /home/jignesh/.rvm/gems/ruby-2.3.1@my_integrations/gems/railties-5.0.0/lib/rails/commands/runner.rb:60:in `<top (required)>'
  from /home/jignesh/.rvm/gems/ruby-2.3.1@my_integrations/gems/railties-5.0.0/lib/rails/commands/commands_tasks.rb:138:in `require'
  from /home/jignesh/.rvm/gems/ruby-2.3.1@my_integrations/gems/railties-5.0.0/lib/rails/commands/commands_tasks.rb:138:in `require_command!'
  from /home/jignesh/.rvm/gems/ruby-2.3.1@my_integrations/gems/railties-5.0.0/lib/rails/commands/commands_tasks.rb:104:in `runner'
  from /home/jignesh/.rvm/gems/ruby-2.3.1@my_integrations/gems/railties-5.0.0/lib/rails/commands/commands_tasks.rb:49:in `run_command!'
  from /home/jignesh/.rvm/gems/ruby-2.3.1@my_integrations/gems/railties-5.0.0/lib/rails/commands.rb:18:in `<top (required)>'
  from bin/rails:9:in `require'
  from bin/rails:9:in `<main>'

如果我尝试访问公共工作表，它会起作用。我已经尝试了很多，但无法弄清楚是什么原因造成的。最初我使用 API Key 方法进行授权，但根据在 https://developers.google.com/api-client-library/ruby/auth/api-keys 找到的文档，它说

在调用不访问私有用户数据的 API 时，您可以使用 简单的 API 密钥。这些密钥用于验证您的应用程序 出于会计目的。 Google Developers Console 文档 还描述了 API 密钥。

注意：如果您确实需要访问私人用户数据，则必须使用 OAuth 2.0。请参阅将 OAuth 2.0 用于 Web 服务器应用程序、将 OAuth 2.0 用于已安装的应用程序和将 OAuth 2.0 用于服务器到服务器 申请以获取更多信息。

因此我切换到服务帐户方法。但这没有帮助。

谁能告诉我我错过了什么？

其他发现：

以下帖子 https://stackoverflow.com/a/38530755/936494 看起来很有帮助，但根据我的要求，我想避免 3-Legged oauth，因为应该通过后台作业访问和更新工作表。

Answer 1

已解决。感谢Steve Bazyl (Google member) 提供了以下宝贵建议，立即解决了问题：

您是否与服务帐户共享了工作表？服务帐户实际上是独立的用户，并且需要与任何其他用户一样在 ACL 上。

参考：https://github.com/google/google-api-ruby-client/issues/461#issuecomment-243328234