G-Suite 用户访问 G-Suite 可信应用脚本时，如何避免脚本授权提示？

Question

I wrote an app script which provides a web UI for data entry into a team calendar. I published it using G-Suite super admin account and added it as Trusted App under Security/API Permissions. "Trust domain owned apps" is checked under "Internal App Settings".

When a G-Suite user in our organization tries to access the app, he sees

"The developer of ShiftSchedulingApp, admin@_our_organization_.org, needs your permission to access your data on Google."

Those brave enough to click "Review Permissions" are taken to the next message:

"ShiftSchedulingApp wants to access your Google Account. See, edit, share, and permanently delete all the calendars you can access using Google Calendar"

Of course nobody wants to risk losing all the calendars on their Google Account and this is where it ends.

How do I get rid of this misleading message? It's not Google account, it's their organization account on G-Suite. It's not all their calendars, it's the shared team calendar only. It's adding data, not permanently deleting calendars. It's published by their administrator in their G-Suite, not an unknown 3rd party.

I spent days trying to make this message go away but no luck. App must be executed as an accessing user and not as publishing user because their user ID determines what shifts they can fill on a calendar.

I'd appreciate any hints pointing me the right direction.

---

I experimented with variations of the two-app approach as suggested.

The app which provides the UI needs to read the calendar to display available shifts - so I can't get away from the user authorization prompt.

Another variation I tried was having one app do everything and run as me, and another do nothing but return Session.getActiveUser(). I tried calling the 2nd one from the 1st one on the client side via XMLHttpRequest. It would be ideal for my needs - but I hit CORS error as apps URL is script.google.com but it actually gets redirected to script.googleusercontent.com. There doesn't seem to be a way to set CORS in Google App Script.

Answer 1

Although I was not able to find a way to avoid prompting users for authorization when executing the app as accessing user, it turns out my reasons for doing that were based on a false premise.

I chose to publish app as accessing user because I thought that's the only way to get accessing user Id - which is true for non-G Suite accounts.

However, when app is published by a G Suite account, the app can get accessing user ids within the same G Suite domain even when it's set to execute as publishing user.

Thanks Niek and TheMaster for your help!

Answer 2

If you just need user ID , why do you ask for all those permissions?

Possible Solutions:

• 2 web-apps- One running as you and another as user accessing (with only profile) permission. The second one will be the actual web interface and POST necessary information to the first one with privileges. OR

• Implement your own web-app Google-sign in¹

• Use the least permissive ² scope ³