Google共享云端硬盘文件删除/覆盖/移动权限问题求助

问题分析 #

你遇到的403权限不足错误，即使作为云端硬盘管理员，可能由以下原因导致：

• 共享云端硬盘的组织策略限制了删除操作（如禁止删除外部所有者创建的文件）
• Access Token的权限范围不足（需包含https://www.googleapis.com/auth/drive或drive.file）
• 直接调用DELETE接口权限要求高，改为将文件移至回收站（设置trashed=true）可能更容易通过权限校验

以下是实现「删除→覆盖→移动到指定文件夹」降级逻辑的代码方案：

完整代码实现 #

class DriveHandler {
    const DRIVE_FILES_URI = "https://www.googleapis.com/drive/v3/files/";

    /**
     * 主入口：按优先级执行删除→覆盖→移动操作
     * @param string $access_token 授权令牌
     * @param string $file_id 目标文件ID
     * @param string $new_file_path 用于覆盖的新文件路径
     * @param string $trash_folder_id 目标垃圾文件夹ID
     * @return bool
     * @throws Exception
     */
    public function updateDriveFile($access_token, $file_id, $new_file_path, $trash_folder_id) {
        // 第一步：尝试删除/移至回收站
        try {
            if ($this->deleteOrTrashFile($access_token, $file_id)) {
                return true;
            }
        } catch (Exception $e) {}

        // 第二步：尝试覆盖文件
        try {
            if ($this->overwriteFile($access_token, $file_id, $new_file_path)) {
                return true;
            }
        } catch (Exception $e) {}

        // 第三步：尝试移动到指定垃圾文件夹
        try {
            return $this->moveFileToFolder($access_token, $file_id, $trash_folder_id);
        } catch (Exception $e) {
            throw new Exception("所有操作失败：" . $e->getMessage());
        }
    }

    /**
     * 先尝试移至回收站，失败则尝试彻底删除
     * @param string $access_token
     * @param string $file_id
     * @return bool
     * @throws Exception
     */
    private function deleteOrTrashFile($access_token, $file_id) {
        // 优先移至回收站（权限要求更低）
        $trashUrl = self::DRIVE_FILES_URI . $file_id . "?supportsAllDrives=true";
        $ch = curl_init();
        curl_setopt($ch, CURLOPT_URL, $trashUrl);
        curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
        curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, FALSE);
        curl_setopt($ch, CURLOPT_HTTPHEADER, [
            'Content-Type: application/json',
            'Authorization: Bearer ' . $access_token
        ]);
        curl_setopt($ch, CURLOPT_CUSTOMREQUEST, 'PATCH');
        curl_setopt($ch, CURLOPT_POSTFIELDS, json_encode(['trashed' => true]));

        $data = json_decode(curl_exec($ch), true);
        $http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
        curl_close($ch);

        if ($http_code == 200 || $http_code == 204) {
            return true;
        }

        // 移至回收站失败，尝试彻底删除
        $deleteUrl = self::DRIVE_FILES_URI . $file_id . "?supportsAllDrives=true&enforceSingleParent=false";
        $ch = curl_init();
        curl_setopt($ch, CURLOPT_URL, $deleteUrl);
        curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
        curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, FALSE);
        curl_setopt($ch, CURLOPT_HTTPHEADER, ['Authorization: Bearer ' . $access_token]);
        curl_setopt($ch, CURLOPT_CUSTOMREQUEST, 'DELETE');

        $data = json_decode(curl_exec($ch), true);
        $http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
        curl_close($ch);

        if ($http_code == 200 || $http_code == 204) {
            return true;
        }

        $error_msg = !empty($data['error']['message']) ? $data['error']['message'] : '删除操作失败';
        throw new Exception('Error ' . $http_code . ': ' . $error_msg);
    }

    /**
     * 覆盖已有文件
     * @param string $access_token
     * @param string $file_id
     * @param string $file_path
     * @return bool
     * @throws Exception
     */
    private function overwriteFile($access_token, $file_id, $file_path) {
        $apiURL = self::DRIVE_FILES_URI . $file_id . "?supportsAllDrives=true&uploadType=media";
        $file_data = file_get_contents($file_path);
        $mime_type = mime_content_type($file_path);

        $ch = curl_init();
        curl_setopt($ch, CURLOPT_URL, $apiURL);
        curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
        curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, FALSE);
        curl_setopt($ch, CURLOPT_HTTPHEADER, [
            'Authorization: Bearer ' . $access_token,
            'Content-Type: ' . $mime_type
        ]);
        curl_setopt($ch, CURLOPT_CUSTOMREQUEST, 'PUT');
        curl_setopt($ch, CURLOPT_POSTFIELDS, $file_data);

        $data = json_decode(curl_exec($ch), true);
        $http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
        curl_close($ch);

        if ($http_code == 200) {
            return true;
        }

        $error_msg = !empty($data['error']['message']) ? $data['error']['message'] : '覆盖文件失败';
        throw new Exception('Error ' . $http_code . ': ' . $error_msg);
    }

    /**
     * 将文件移动到指定文件夹
     * @param string $access_token
     * @param string $file_id
     * @param string $target_folder_id
     * @return bool
     * @throws Exception
     */
    private function moveFileToFolder($access_token, $file_id, $target_folder_id) {
        // 获取文件当前父目录
        $getUrl = self::DRIVE_FILES_URI . $file_id . "?supportsAllDrives=true&fields=parents";
        $ch = curl_init();
        curl_setopt($ch, CURLOPT_URL, $getUrl);
        curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
        curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, FALSE);
        curl_setopt($ch, CURLOPT_HTTPHEADER, ['Authorization: Bearer ' . $access_token]);

        $data = json_decode(curl_exec($ch), true);
        $http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
        curl_close($ch);

        if ($http_code != 200) {
            throw new Exception('获取文件父目录失败');
        }

        $current_parents = $data['parents'] ?? [];
        // 构造移动请求：添加新父目录，保留非重复的旧父目录
        $patchUrl = self::DRIVE_FILES_URI . $file_id . "?supportsAllDrives=true&enforceSingleParent=false";
        $post_fields = json_encode([
            'parents' => array_merge([$target_folder_id], array_diff($current_parents, [$target_folder_id]))
        ]);

        $ch = curl_init();
        curl_setopt($ch, CURLOPT_URL, $patchUrl);
        curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
        curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, FALSE);
        curl_setopt($ch, CURLOPT_HTTPHEADER, [
            'Content-Type: application/json',
            'Authorization: Bearer ' . $access_token
        ]);
        curl_setopt($ch, CURLOPT_CUSTOMREQUEST, 'PATCH');
        curl_setopt($ch, CURLOPT_POSTFIELDS, $post_fields);

        $data = json_decode(curl_exec($ch), true);
        $http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
        curl_close($ch);

        if ($http_code == 200) {
            return true;
        }

        $error_msg = !empty($data['error']['message']) ? $data['error']['message'] : '移动文件失败';
        throw new Exception('Error ' . $http_code . ': ' . $error_msg);
    }
}

关键注意事项 #

1. 权限校验：确保Access Token包含https://www.googleapis.com/auth/drive权限范围；若使用服务账号，需启用域范围委派并完成授权。
2. 目标文件夹准备：提前创建'trashed.file'文件夹，获取其ID传入updateDriveFile函数。
3. 参数说明：enforceSingleParent=false允许文件存在于多个文件夹，避免移动时因权限问题失败。
4. 组织策略限制：若组织禁止删除外部所有者文件，移至回收站或覆盖是可行的替代方案。

内容的提问来源于stack exchange，提问作者Ampopo