Node.js调用Google Forms API创建Watch遇权限不足错误求助

我在Node.js应用中尝试通过Google Forms API设置Watch，收到权限不足的错误，错误类型为ACCESS_TOKEN_SCOPE_INSUFFICIENT。已经通过Google Cloud CLI配置了ADC，先后尝试https://www.googleapis.com/auth/forms和https://www.googleapis.com/auth/drive两种权限范围，但仍出现相同错误。

错误信息 #

[
  {
    '@type': 'type.googleapis.com/google.rpc.ErrorInfo',
    reason: 'ACCESS_TOKEN_SCOPE_INSUFFICIENT',
    domain: 'googleapis.com',
    metadata: {
      method: 'google.apps.forms.v1.FormsService.CreateWatch',
      service: 'forms.googleapis.com'
    }
  }
]

原始代码 #

const {Storage} = require('@google-cloud/storage');
async function authenticateImplicitWithAdc() {
  const storage = new Storage({
    projectId,
  });
  const [buckets] = await storage.getBuckets();
  console.log('Buckets:');

  for (const bucket of buckets) {
    console.log(`- ${bucket.name}`);
  }

  console.log('Listed all storage buckets.');
}
const projectId = '-';


const google = require('googleapis').google;
const auth = new google.auth.GoogleAuth({
  scopes: ['https://www.googleapis.com/auth/forms']
});
const formId = '1FAIpQLSfmoFbMA-qGs9LuPmBm0XMw1jGUzsDMm-Vv1jrMiyqaYvW5WQ'
const targetUrl = 'https://discord.com/api/webhooks/1092763536461148165/qh8wWVf0g9rSnmqkIB5I7gBEAzxvIAfrt2xTyszzQopyEzh6RPzio1x0i7JCS2OT-dbQ'


authenticateImplicitWithAdc();
async function createWatch() {
  const forms = google.forms({ version: 'v1', auth });
  const response = await forms.forms.watches.create({
    formId: formId,
    requestBody: {
      target: {
        url: targetUrl
      },
      eventType: 'RESPONSE'
    }
  });
  console.log(`Created watch with ID: ${response.data.id}`);
}

client.on('ready', async() => {
    console.log(`Logged in as ${client.user.tag}!`);
    client.user.setActivity(`over QLDRP members`, { type: ActivityType.Watching });
    try {
    await createWatch();
  } catch (error) {
    console.error(`Error creating watch: ${error}`);
    console.error(error)
    console.log(error.response.data.error.details)
  }
   
});

修改权限范围后的代码片段 #

const auth = new google.auth.GoogleAuth({
  scopes: ['https://www.googleapis.com/auth/drive']
});

修改后仍出现的错误 #

[
  {
    '@type': 'type.googleapis.com/google.rpc.ErrorInfo',
    reason: 'ACCESS_TOKEN_SCOPE_INSUFFICIENT',
    domain: 'googleapis.com',
    metadata: {
      service: 'forms.googleapis.com',
      method: 'google.apps.forms.v1.FormsService.CreateWatch'
    }
  }
]

解决方案 #

1. 使用正确的权限范围 #

创建Forms Watch需要的是**https://www.googleapis.com/auth/forms.body**权限范围，这是专门用于监听表单响应等事件的权限，之前的forms或drive范围都不满足CreateWatch接口的要求。

修改auth配置为：

const auth = new google.auth.GoogleAuth({
  scopes: ['https://www.googleapis.com/auth/forms.body']
});

2. 刷新ADC的权限缓存 #

修改权限范围后，需要清除Google Cloud CLI的ADC缓存，确保新的权限生效：

gcloud auth application-default revoke
gcloud auth application-default login

重新登录时会请求新的权限范围，确认勾选对应的表单权限。

3. 验证权限是否正确获取 #

可以在代码中添加调试代码，打印当前获取的token的权限范围，确认是否包含forms.body：

async function checkAuthScopes() {
  const client = await auth.getClient();
  const tokenInfo = await client.getTokenInfo(client.credentials.access_token);
  console.log('当前token权限范围:', tokenInfo.scope);
}
// 在createWatch前调用
await checkAuthScopes();

4. 确认Google Cloud项目的API启用状态 #

确保你的Google Cloud项目已经启用了Google Forms API：

• 进入Google Cloud控制台
• 搜索"Forms API"，确认状态为"已启用"

内容的提问来源于stack exchange，提问作者Wosca