Google Business Messaging OAuth权限范围无效及接口权限不足问题

需求背景 #

需要通过OAuth获取已开通Business Messaging的客户企业的Google My Business API权限，实现两个核心功能：回复商务消息、用户发送消息时将其标记为已读。根据官方文档，标记消息已读需使用权限范围 https://www.googleapis.com/auth/businessmessages。

问题现象 #

1. 权限范围添加失败：将https://www.googleapis.com/auth/businessmessages添加到OAuth同意设置时，系统提示该范围无效。
2. 接口调用权限不足：当前OAuth访问令牌包含的权限范围如下：

https://www.googleapis.com/auth/businesscommunications
https://www.googleapis.com/auth/userinfo.email
https://www.googleapis.com/auth/userinfo.profile
https://www.googleapis.com/auth/business.manage

调用标记已读接口时返回403权限错误：

{
    "error": {
        "code": 403,
        "message": "Request had insufficient authentication scopes.",
        "status": "PERMISSION_DENIED",
        "details": [
            {
                "@type": "type.googleapis.com/google.rpc.ErrorInfo",
                "reason": "ACCESS_TOKEN_SCOPE_INSUFFICIENT",
                "domain": "googleapis.com",
                "metadata": {
                    "method": "google.communications.businessmessages.v1.BusinessMessagesService.UpdateReceipt",
                    "service": "businessmessages.googleapis.com"
                }
            }
        ]
    }
}

相关截图与代码 #

OAuth同意界面截图 #

生成OAuth同意界面URL的代码 #

const { google } = require("googleapis");

const oauth2Client = new google.auth.OAuth2(
  "clientId",
  "clientSecret",
  "http://127.0.0.1"
);

const scopes = [
  "https://www.googleapis.com/auth/business.manage",
  "https://www.googleapis.com/auth/businesscommunications",
  "https://www.googleapis.com/auth/businessmessages",
  "https://www.googleapis.com/auth/userinfo.email",
  "https://www.googleapis.com/auth/userinfo.profile",
];

const authorizationUrl = oauth2Client.generateAuthUrl({
  access_type: "offline",
  scope: scopes,
  include_granted_scopes: true,
});

注：由于生成的URL会返回无效范围错误，实际scopes数组中并未包含https://www.googleapis.com/auth/businessmessages

标记消息已读的代码 #

async function initAuth() {
    const oauth2Client = new google.auth.OAuth2(
        "clientId", // 我方GCP配置信息，非客户方
        "clientSecret", // 我方GCP配置信息，非客户方
        "http://127.0.0.1" 
        );

    oauth2Client.setCredentials({
        access_token: 'token', // 从授权页面获取的令牌
        scope: 'https://www.googleapis.com/auth/businessmessages',
    });

    return oauth2Client;
}

async function sendReadReceipt(conversationId, messageId) {
    const auth = await initAuth();

  let apiParams = {
    auth: auth,
    name: 'conversations/' + conversationId + '/messages/' + messageId + '/receipt',
    resource: {
      receiptType:'READ'
    }
  };

  bmApi.conversations.messages.updateReceipt(apiParams,
    {auth: auth}, (err, response) => {
    console.log(err);
    console.log(response);
  });
}

内容的提问来源于stack exchange，提问作者DanailYordanov