向 Cloud PubSub 發送測試消息時出錯，返回 403 授權錯誤

Question

我正在嘗試按照 Gmail API Users: watch 中的說明設置推送通知，但總是收到 403 錯誤，即

向 Cloud PubSub 發送測試消息時出錯.... 用戶無權執行此操作

. 我正在使用 Google PHP 庫並按照quickstart.php啟動此操作。 這是我的腳本如下：

require __DIR__ . '/vendor/autoload.php';

if (php_sapi_name() != 'cli') {
  throw new Exception('This application must be run on the command line.');
}

function getClient()
{
  $client = new Google_Client();
  $client->setApplicationName('Gmail API PHP Quickstart');
  $client->setScopes(array("https://mail.google.com/", "https://www.googleapis.com/auth/gmail.compose", "https://www.googleapis.com/auth/gmail.modify", "https://www.googleapis.com/auth/gmail.readonly", "https://www.googleapis.com/auth/cloud-platform", "https://www.googleapis.com/auth/pubsub"));
  $client->setAuthConfig('credentials.json');
  $client->setIncludeGrantedScopes(true);
  $client->setAccessType('offline');
  $client->setPrompt('select_account consent');
  $tokenPath = 'token.json';

  if (file_exists($tokenPath)) {
    $accessToken = json_decode(file_get_contents($tokenPath), true);
    $client->setAccessToken($accessToken);
  }

  if ($client->isAccessTokenExpired()) {

     if ($client->getRefreshToken()) {
        $client->fetchAccessTokenWithRefreshToken($client->getRefreshToken());
     } else {
        $authUrl = $client->createAuthUrl();
        printf("Open the following link in your browser:\n%s\n", $authUrl);
        print 'Enter verification code: ';
        $authCode = trim(fgets(STDIN));
        $accessToken = $client->fetchAccessTokenWithAuthCode($authCode);
        $client->setAccessToken($accessToken);
        if (array_key_exists('error', $accessToken)) {
            throw new Exception(join(', ', $accessToken));
        }
     }
     if (!file_exists(dirname($tokenPath))) {
        mkdir(dirname($tokenPath), 0700, true);
     }
     file_put_contents($tokenPath, json_encode($client->getAccessToken()));
  }
  return $client;
} 
$client = getClient();
$service = new Google_Service_Gmail($client);
$watchreq = new Google_Service_Gmail_WatchRequest();
$watchreq->setLabelIds(array('INBOX'));
$watchreq->setlabelFilterAction('include');
$watchreq->setTopicName('projects/gcl-gmail-2020/topics/php-example-topic');   
$msg = $service->users->watch('me', $watchreq);

在這方面的任何幫助將不勝感激。

Answer 1

您可以使用此示例代碼來測試主題的權限，因為錯誤消息指出服務帳戶沒有執行此操作所需的權限：

測試權限

use Google\Cloud\PubSub\PubSubClient;

/**
 * Prints the permissions of a topic.
 *
 * @param string $projectId  The Google project ID.
 * @param string $topicName  The Pub/Sub topic name.
 */
function test_topic_permissions($projectId, $topicName)
{
    $pubsub = new PubSubClient([
        'projectId' => $projectId,
    ]);
    $topic = $pubsub->topic($topicName);
    $permissions = $topic->iam()->testPermissions([
        'pubsub.topics.attachSubscription',
        'pubsub.topics.publish',
        'pubsub.topics.update'
    ]);
    foreach ($permissions as $permission) {
        printf('Permission: %s' . PHP_EOL, $permission);
    }
}

然后，只需向服務帳戶授予必要的權限：

為服務帳戶授予角色