Google Cloud Platform: permission denied by accessing Apps Script - google-apps-script

I found plenty of questions regarding this issues, but no one answer that could solve my problem.
I have a project in Apps Script, which I deployed as API executable. I enabled Google App Script Execution API. I made OAuth 2.0 Client ID on developer console. I made everything step-by-step as described here: https://developers.google.com/apps-script/guides/rest/api
Then I try to execute code from Google API Explorer: https://developers.google.com/apis-explorer/#p/script/v1/
I fill in request body properly, fill in script id (take it from "File > Project properties" from App Script editor), but what I get is "Permission denied":
Well, I tried to do the same from PyCharm (Python). I fully followed the following instruction: https://developers.google.com/apps-script/guides/rest/quickstart/python
Guess, what I got... The same error!
The Apps Script project is saved in my corporate Google Drive. The scopes of the project are: https://www.google.com/calendar/feeds https://www.googleapis.com/auth/script.external_request , which I filled in correctly in Python and shouldn't fill in in API Explorer.
Many users recommend to check if the project is correctly associated with a project on Google Cloud Platform. When I try to change project, I get error: "The project number should not match." Probably because it is associated correctly...
I almost lost my hope... Again, I saw a lot of answers to this issue across StackExchange forums, but no one could have solved this problem.
One more note: I didn't sign up for the Google Cloud Platform (I don't have a work account there, although it sees my projects and I could have generated OAuth2 2.0 Client ID and API key.

Well, I deleted my python project along with the .credentials file and recreated the project - then it worked. So probably it didn't work, because I missed one of described steps at the first execution of the code and after I fulfilled all the requirements I went on using old creds.
So for all who faces the same problem:
Do everything what is described in the Google documentation and my question.
If you missed something, delete the .credentials file and run the code again. Then it should work.

Related

Embedded Script (Tasks List API Sample) throws "'Tasks' is not defined" error (works when run in Scripts)

When attempting to embed Google’s sample provided for the Tasks API (code found here) into Google's Classic Sites I get the dreaded “script.google.com refused to connect”. The logging error is "Tasks" is not defined at getTasksLists(simpleTasks:15). Details:
When I embed this same script into Google's New Sites, the UI does show, but the drop-down continues to display “Loading…” (see screenshot below), however if I click on the link provided to view my “Google Tasks” it does go to my Tasks in a new window.
This runs successfully directly from Google Apps Scripts, showing the “Authorization required” pop-up and allowing me to sign in and accept permissions. However, when embedded into both New and Classic sites, it does not request any authorization.
Steps I've taken embedding into Classic Sites (where it needs to be):
from URL provided above: copied code exactly as is into a new Scripts project (nothing altered or added).
from Scripts: deployed it as a Web App, copied the URL provided (the code provided in the link above has not been altered in any way by me)
from Scripts: enabled Tasks API though Resources, Advanced Google Services
from Sites: edit page, Insert Apps Script, pasted URL (i.e. https//script.google.com/macros/s/...5Ym41qn/exec)
Other things I've tried:
from Sites: embedding URL as an iFrame gadget (same results)
solution given here: How to add Google Drive Scripts project into Google Sites? (same results)
days of research into Google's documentation (for Sites, APIs, Scripts, Cloud Platform, you name it)... (various results but nothing productive)
I am very new to working with Sites, Scripts, the Cloud Platform, etc. so apologies if I am missing some obvious steps here. Any guidance would be truly appreciated!
Leora
UPDATE [03-21-19]:
I was able to get this working finally! Although not posting as answer just yet as I haven't figured out the exact change that was brought success.
I thought it was by changing the option within Sites' Publish / Deploy as web app... / Execute the app as: from 'ME' to 'USER' (after doing that it worked), but when I changed it back to make sure that was it, it still worked?
I will play around with it more this weekend and update when I come to a definitive solution.
Thanks to anyone who took the time to help me out here, and if anyone does have any guidance on what's happening here, I'd love to know.

Can't switch google cloud project on GAS Editor

I am not able to switch google cloud platform project in GAS editor.
What I am doing is…
Open the google sheet GAS editor
Open Resource --> Cloud Platform Project
Enter project number that I want to connect
With the process above, I was able to switch a cloud platform project but now it returns an error
‘Project does not exist, or you need edit access to it.’
I am using the same cloud project and same account(editor) that I used before and properly worked. I tried do the same with a owner account, but it didn’t work, either.
Also, this cloud project is not a default project nor a hidden project. (If it does, I guess it should not be able to access through GAS editor from the beginning)
I have checked documentation below, but it tells me only case when switching to a hidden project.
https://developers.google.com/apps-script/guides/cloud-platform-projects
Does anyone have a solution or suggestion??
Thank you for the help in advance.
Problem Solved.
I figured out that OAuth IDs which are generated when make connection docs to the cloud project are not be deleted even though delete actual document files.
What I have done is...
Login Google Cloud Platform
Go to APIs&Services --> Credentials
On OAuth 2.0 client IDs, delete unnecessary contents from the list
Back to your docs and switch the cloud project.

Publishing a Google Docs Add-on: Project Key is not associated with the current project

I am attempting to publish a simple Google Docs add-on, following these instructions: Publishing an Add-on
However when completing the configuration for Google Apps Marketplace SDK, I enter my script project key (found from file --> project properties) and receive the following error: 'Project Key is not associated with the current project.'
Only instance where I can find someone with the same problem (here) occurred when they created a project on the Google Developers Console instead of going through resources --> Advanced Google Services. This is not the reason for my error, can anyone shred any light onto my problem?
Any help would be gratefully received,
Connor
Kept trying, did not change the way I tried publishing nor the project key I was entering and it worked after so many retries. Wish I could give a more detailed answer...
I was able to fix by combining two successful responses from this post:
use version number, and only the number, e.g. "1" -- Do not use "v1.0" or "Version 1 on Oct 1, 6:10 AM" or your deployment's Description
After completing step 1, delete your entry in field 'Docs Add-On Project Script ID', then re-enter it -- the page seems to not re-evaluate your changes unless you do this; I had tried saving multiple times before doing this with no success using the correct version number and script ID.
For me I need to go Publish->Deploy as API. Select the correct version and then the publish screen worked
I needed to include a correct version number (1,2,3,4; not "v0.1") in addition to the script ID. The error suggested my script ID was wrong, but the error went away when I picked a valid version number.
For me, the Google App Script file needed to be associated with the project.
In the GAS, go to Resources > Cloud Platform Project.
Under Change Project, enter the project number (which can be found on the home page of the Google Cloud Platform Project in the Project info module), and click Set Project.
Confirm the notices (though make sure that is really what you want to do).
Once it has been set, go back to the App Configuration, and re-enter the information (if you are already on that page, refresh).
That's what worked for me, but maybe other developers get that error for other reasons.
Source: https://developers.google.com/apps-script/guides/cloud-platform-projects#switching_to_a_different_standard_gcp_project
Hmm I had issues as well. It didn't work with version 1 in "Docs Add-on script version" but while I tried a bunch of stuff I ended up deploying again and then I incremented version to "2" and then it worked.
I got the same error today, I made it finally work. I will go through the fields I checked.
App Integration [I'm deploying using deployment ID, you can get the ID from AppScript manage deployment]
Choose which workspace you are releasing [In my case Sheets], type the version from AppScript.
Enter all other general Credentials and save.
The above steps worked for me.
Try to use the Google Workspace Add On and enter the App Script Deployment ID. That accepted for me and showed it as a Sheets Add-On
It's different in deploy or test in legacy editor and new editor.
And I'm using legacy editor before
(because some following steps from documents is not work in new editor),
So when I lookup Mange deployment in new editor,
It wasn't exisisted,
And the deployment ID it's not work when I fill out App configuration in Google Workspace Market.
For me I just change to following the Legacy editor's following steps
https://developers.google.com/workspace/marketplace/enable-configure-sdk#legacy-editor_2
and It works.
Looks like it is not possible to change scriptId after a round of review. So you can just update only version. I changed to last number of deployment version like '6' and it is saved.

Accessing the Administrator Audit Log via Google Script

Despite fervent searches, I don't believe I have come up with quite the results I am needing. Within the Google Apps for Business Administrator console, under "Reports" there is the "Audit Log." This audit log nearly displays everything I need; however, I am needing the actual name of the file instead of the fileID provided in the report.
The ultimate endgame is to generate, via Google Script, an automated daily report that gives this same data to a few users daily. Is there any means by which I may access this data? I have been pouring over the APIs, and perhaps I've missed something, but I don't feel that I've found what I needed.
Any thoughts and help would be greatly appreciated. Thank you for your time and considerations.
This is possible using the Google Apps Admin Audit API. This uses OAuth and that is a bit tricky to setup sometimes. You can see the set up process in this video that we did. Except as the example shows, instead of the YouTube APIs enable the Apps Reporting and Audit APIs in the API Console.
I built out a simple example of this that you can see in operation. Access this URL after having been logged in as the domain admin. It will automatically create a Spreadsheet in your Drive with the latest Audit logs exported. This is a web app that is deployed as "Run as user".
I've open sourced this Github here. You should substitute in the right OAuth2 Client ID/Secret. The code is pretty rough so you'll want to clean it up. I am selectively logging a few columns but if you look at the API docs, there are other things you can log as well.
Once the OAuth token is set up you can have this run on a trigger as well as long as you refresh the token.
Hope this helps.

I am facing "The authenticated user has not installed the app with client id" error even after installing the app [duplicate]

I'm working on a Google Drive interface for Emacs. The concept is that Emacs could provide a platform-agnostic way to load, modify and save text documents stored in Google Drive. I've registered my app and can authenticate with OAuth2 and get a file listing with the Docs List API, but when I try to execute an Insert with the Google Drive API, I see an error:
"The authenticated user has not installed the app with client id ..."
Reading further, it seems I need to publish my Emacs application in the Chrome Web Store to get access to the Drive API. That doesn't make sense to me...I noticed that there is a FUSE project in development for Google Drive, which suggests that native development is possible. When I skimmed the code, however, I didn't see a Chrome Web Store component to getting it working.
Am I trying to misuse the API, or is there an route to make this work that makes more sense?
EDIT:
According to Ali Afshar, of the Google Drive team, installation is no longer required to use this API. So what follows may no longer be relevant, but will be left for historical purposes.
So, first off the API does not support application development in the sense that we are both doing it, I wouldn't use the word native though. The good news is I have been doing some research and Google Drive is really just a rebranding of Google Docs. So the Google Docs API could be a good choice as well for the same purposes.
Anyway, here's the steps to solve the error: "The authenticated user has not installed the app with client id ..." Which is a 403 error, for the sake of this answer. These steps assume you have set up an app in the chrome web store as is required, and installed it. I am working on my local machine too, with my project: http://github.com/tom-dignan/gdrive-cli which I have gotten past this error, so I think you should keep plugging away at your emacs version, because I think we can make this work.
a. Open the Google APIs console.
b. Confirm you've already enabled the apis under "API Access" both the API and SDK for Google drive should be enabled. There you get your client secrets/api keys and such. I am almost positive you've done this already, so go ahead to C. (this is here for others who may have missed it)
c. In the left navigation bar, under "Drive SDK" you will need to do the following:
Add a "Support URL" (required)
Add at least a small 16x16 application icon (required)
Add "OAuth Client ID (Required)" under Drive Integration (I was just tinkering and this seems to be the key field.)
Add "Open URL (Required) URL to open for your app from the google drive UI."
Check off "Multiple File Support"
Add some MIME types and file extensions, "text/plain", and txt for example
Add the the auth scopes:
https://www.googleapis.com/auth/userinfo.email
https://www.googleapis.com/auth/userinfo.profile
Don't bother trying to add the auth scopes for Google Docs here, because it won't work. Google does not want us to use it that way because files that drive apps create should be private to that app. Integration with Google Docs will have to be separate.
Now I know you must be thinking "why do I have to add some of these..." It's because the form makes them required fields. In mine, I put a couple URLs that point to static HTML pages.
Once you've done the above, clean up your state and reinstall your chrome app. Then try your code again, and it should stop giving you a 403.