javascript - 如何访问gmail API？

Question

我生成了 JWT，如果我的 token 正确，为什么不起作用？在 Google Developers Console 中我启用了 gmail plus youtube 和其他 API，在凭证中生成并下载 json

{
  "private_key_id": "22dcf",
  "private_key": "-----BEGIN PRIVATE KEY-----(remove)-----END PRIVATE KEY-----\n",
  "client_email": "<a href="https://stackoverflow.com/cdn-cgi/l/email-protection" class="__cf_email__" data-cfemail="413726272b2b227701252437242d2e3124336f26322433372822242022222e342f356f222e2c" rel="noreferrer noopener nofollow">[email protected]</a>",
  "client_id": "jc6.apps.googleusercontent.com",
  "type": "service_account"
} 

首先生成 token

 var sHead=JSON.stringify({"alg":"RS256","typ":"JWT"});    
           var iat=timeStampf();
           var exp=iat+3600;
           var sPayload=JSON.stringify({
                      "iss":client_email,
                      "scope":scope,//gmail scope  https://mail.google.com/                
                      "aud":"https://www.googleapis.com/oauth2/v3/token",
                      "exp":exp,
                      "iat":iat
                    });           
          var sJWS = KJUR.jws.JWS.sign("RS256", sHead,sPayload, private_key);
          var paramstoken="grant_type=urn%3Aietf%3Aparams%3Aoauth%3Agrant-ty

pe%3Ajwt-bearer&assertion="+sJWS   



   getToken("POST","/oauth2/v3/token",paramstoken,jsonData,replier);
 /*rest petition  return 200 OK 
       {
      "access_token" : "1bHLl5EOtu1pxz3fmmetKx9W8CV4t79M",
      "token_type" : "Bearer",
      "expires_in" : 3600
    }*/

接下来我测试我的 token

function testToken(accessToken,replier)
{
 //  /gmail/v1/users/me/messages    /plus/v1/people/me
    var client = vertx.createHttpClient().host(urlbase).port(443).ssl(true).maxPoolSize(10);    
    var request = client.request("GET", "/gmail/v1/users/me/messages", function(resp) {
        console.log('server returned status code: ' + resp.statusCode());
        console.log('server returned status message: ' + resp.statusMessage());
        resp.bodyHandler(function(body) {           
            replier(JSON.parse(body.toString()));
        });
    });
    request.headers()
    .set("Content-type", contentType)
    .set("Authorization", "Bearer "+accessToken);
    request.end();
    client.close();
}

如果我使用 google+ 范围并且此请愿书的答案是 200 ok

     https://www.googleapis.com/auth/plus.me /plus/v1/people/me
    {
"kind":"plus#person",
"etag":"\"LR9iFZQGXELLHS07eQ\"",
"objectType":"person","id":"1149981343","displayName":"","name":{"familyName":"","givenName":""},"image":{"url":"https://lh3.googleusercontent.com/-XdUIqdMkCWA/AAAAAAAAAAI/AAAAAAAAAAA/4252rscbv5M/photo.jpg?sz=50","isDefault":true},"isPlusUser":false,"language":"en_US","circledByCount":0,"verified":false}

但如果我尝试使用 gmail

{"error":{"errors":[{"domain":"global","reason":"failedPrecondition","message":"Bad Request"}],"code":400,"message":"Bad Request"}}

Answer 1

对于 GMail，您正在访问特定用户的数据，因此在创建 JWT 时，您需要指定您要模拟的用户，即您要访问其邮箱的用户。

您可以在形成 JWT 声明集时使用 sub:“用户电子邮件地址参数”来执行此操作

var sPayload=JSON.stringify({
                  "iss":client_email,
                  "sub":USER_EMAIL_ADDRESS
                  "scope":scope,//gmail scope  https://mail.google.com/                
                  "aud":"https://www.googleapis.com/oauth2/v3/token",
                  "exp":exp,
                  "iat":iat
                });