跨应用使用Autodesk Forge Viewer转换URN遇403权限问题求助

我正在将Autodesk Forge Viewer集成至Angular应用中，先参照官方教程搭建示例应用并成功查看图纸，随后尝试复用示例应用中生成的转换后URN：dXJuOmFkc2sub2JqZWN0czpvcy5vYmplY3Q6eXlpYnFqdW8yeW9yNTF2c2d2Y3VzcHlnbnk5amVhbnQtdmxmbTIyL0RDLUhRLTAxQVIlMjAoMTMpLmR3Zw到自身应用。通过以下代码获取2Legged Token并调用manifest接口时，请求返回403 (Forbidden)；直接访问该接口URL时，收到错误信息：

{ "developerMessage":"Token is not provided in the request.", "moreInfo": "https://forge.autodesk.com/en/docs/oauth/v2/developers_guide/error_handling/", "errorCode": "AUTH-010" }

前端代码 #

var contextObj = this;
var urn = "dXJuOmFkc2sub2JqZWN0czpvcy5vYmplY3Q6eXlpYnFqdW8yeW9yNTF2c2d2Y3VzcHlnbnk5amVhbnQtdmxmbTIyL0RDLUhRLTAxQVIlMjAoMTMpLmR3Zw";
this.objiWhiz.Token(function (resCallback) {
    contextObj.token = resCallback;
    var access_token = contextObj.token;
    jQuery.ajax({
        url: 'https://developer.api.autodesk.com/modelderivative/v2/designdata/' + urn + '/manifest',
        headers: { 'Authorization': 'Bearer ' + access_token },
        success: function (res) {
            if (res.status === 'success')
                this.launchViewer(urn);
        },
        error: function (err) {
            console.log("not sucessfull");
        }
    });
});

// 获取Token的方法
this.Token = function (resCallback) {
    try {
        var that = this;
        var data = "12";   // ViewablesRead = 12
        $.ajax({
            url:  '/6.8/api/iWhiz/Get2LeggedTokenAsync',
            type: "POST",
            headers: {  "__RequestVerificationToken": that.m_csrfToken },
            data: JSON.stringify([data]),
            contentType: 'application/json; charset=utf-8',
            success: function (returnObject) {
                resCallback(returnObject.access_token);                 
            }
        });
    } catch (e) {
        resCallback(9);
    }
};

后端C#代码 #

public async Task<dynamic> Get2LeggedTokenAsync(List<string> Val)
{
    TwoLeggedApi oauth = new TwoLeggedApi();
    string grantType = "client_credentials";
    dynamic bearer = await oauth.AuthenticateAsync(
        "FORGE_CLIENT_ID", "FORGE_CLIENT_SECRET",
        grantType,
        new Scope[] { Scope.DataWrite });
    return bearer;
}

核心问题：Token权限范围不匹配 #

后端获取Token时请求的是Scope.DataWrite权限，但调用Model Derivative的manifest接口需要ViewablesRead权限，权限缺失导致接口返回403 Forbidden。

解决方案 #

1. 修正后端Token的权限范围
   修改后端AuthenticateAsync的Scope参数，添加ViewablesRead权限：

   dynamic bearer = await oauth.AuthenticateAsync(
       "FORGE_CLIENT_ID", "FORGE_CLIENT_SECRET",
       grantType,
       new Scope[] { Scope.ViewablesRead, Scope.DataWrite }); // 若无需DataWrite权限可只保留ViewablesRead
   

2. 修复前端回调的上下文问题
   前端ajax的success回调中this指向请求对象而非组件实例，导致launchViewer无法调用，可改用contextObj或箭头函数：

   // 方案一：使用contextObj
   success: function (res) {
       if (res.status === 'success')
           contextObj.launchViewer(urn);
   }
   // 方案二：使用箭头函数
   success: (res) => {
       if (res.status === 'success')
           this.launchViewer(urn);
   }
   

3. 验证Token权限有效性
   获取Token后可解码JWT，查看payload中的scope字段，确认包含viewables:read权限，确保权限配置正确。

注：直接访问接口URL时未携带Token，返回AUTH-010错误属于正常情况，接口必须通过请求头传递Authorization: Bearer <token>才能访问。

内容的提问来源于stack exchange，提问作者Soumya