使用带有 NodeJS 的 Google 日历 API 将事件添加到 Google 日历

Question

We are trying to add an event to Google Calendar using Google Calendar API with NodeJS, we created the service account, we have set the delegation on g suite on the service account, we invited the service account email to the calendar, we added the calendar api to the project and we added the role to the impersonification user to create the tokens and we did everything we hav read following this guide:

Google Calendar API Service Account Error

The only step we could not achieve was to add the delegation to the impersonification user because there is no button or switch to add it (but the service account user has the delecation active).

The code we are using is:

 async function generateMeet(discipline, { from, to }, { customer1, customer2 }) {
  const SCOPES = [
   'https://www.googleapis.com/auth/calendar',
   'https://www.googleapis.com/auth/calendar.events',
   'https://www.googleapis.com/auth/admin.directory.resource.calendar',
  ]

  const jwtClient = new google.auth.JWT(
    credentials.client_email,
    null,
    credentials.private_key,
    SCOPES,
    //we also tried to add the impersonification subject, but the authentication fails.
  )

  try {
    //authenticate request
    await jwtClient.authorize()
  } catch (e) {
    console.error('Error during google authenticaion', e)
    throw new Error(e)
  }

  const calendar = google.calendar({ version: 'v3', auth: jwtClient })
  const requestId = crypto.randomBytes(64).toString('hex')
  const event = {
    summary: `Title with ${discipline.label_it}`,
    description: 'Example.',
    start: {
      dateTime: from,
      timeZone: 'Europe/Rome',
    },
    end: {
      dateTime: to,
      timeZone: 'Europe/Rome',
    },
    conferenceData: {
      createRequest: { requestId },
    },
    attendees: [{ email: customer1 }, { email: customer2 }],
    reminders: {
      useDefault: false,
      overrides: [
        { method: 'email', minutes: 24 * 60 },
        { method: 'popup', minutes: 30 },
      ],
    },
  }

  return calendar.events.insert({
    auth: jwtClient,
    calendarId: process.env.MY_GOOGLE_CALENDAR_ID,
    resource: event,
  })
}

We receive this error:

code: 403,
errors: [
    {
      domain: 'calendar',
      reason: 'forbiddenForServiceAccounts',
      message: 'Service accounts cannot invite attendees without Domain-Wide Delegation of Authority.'
    }
  ]

Answer 1

Answer

You have to make some extra steps as the Identity Platform documentation says Although you can use service accounts in applications that run from a G Suite domain, service accounts are not members of your G Suite account and aren't subject to domain policies set by G Suite administrators .

In order to be granted you have to follow the steps as in the previous link.

Bear in mind:

• It usually takes a few minutes for impersonation access to be granted after the client ID was added, but in some cases, it might take up to 24 hours to propagate to all users of your Google Account.

Reference

Delegating domain-wide authority to the service account