使用AppScript配置Gmail签名问题：无法覆盖及所有者账号失效

问题分析 #

• 无法覆盖已有签名：当前代码使用PATCH方法更新签名，部分场景下因请求逻辑或模板处理导致更新不生效；同时强制移除所有换行可能破坏签名HTML结构，导致写入失败。
• Workspace所有者账号无效：域委派需管理员为服务账号明确授予针对所有者账号的权限，且所有者账号的高权限属性可能限制服务账号的 impersonation 操作，需确认OAuth范围配置完整。

解决方案 #

1. 修复签名覆盖问题 #

• 将请求方法从PATCH改为PUT，确保完整替换现有签名资源
• 保留签名模板的HTML结构，仅移除不必要的换行（或直接保留模板原有格式）
• 在请求payload中明确指定sendAsEmail字段，确保更新目标准确

2. 修复所有者账号权限问题 #

• 在Google Workspace Admin控制台中，确认服务账号已关联以下OAuth范围：
  • https://www.googleapis.com/auth/gmail.settings.basic
  • https://www.googleapis.com/auth/gmail.settings.sharing
• 检查域宽委派配置（Admin控制台 > 安全 > API控制 > 域宽委派），确保服务账号客户端ID已添加并关联上述范围
• 确认所有者账号未启用限制第三方应用的高级安全设置

修改后的完整代码 #

function setSignatureTest() {
  var user = {
    primaryEmail: "admin@domain.do",
    name: {
      fullName:'Admin Name',
      familyName:'Admin Last Name',
      givenName:'Admin Name'
    }
  };
  var test = setSignature(user.primaryEmail, user);

  Logger.log('test result: ' + test);
}

function listAllUsers() {
  var pageToken;
  var page;
  do {
    page = AdminDirectory.Users.list({
      domain: 'domain.com',
      orderBy: 'givenName',
      maxResults: 500,
      pageToken: pageToken
    });
    var users = page.users;

    var accountsToIgnore = [
      'test@example.com',
      'testtest@example.com'
    ];

    if (users) {
      for (var i = 0; i < users.length; i++) {
        var user = users[i];
        if (accountsToIgnore.indexOf(user.primaryEmail) === -1) {
          var userName = user.name.fullName;
          var userEmail = user.primaryEmail;
          var userOrgRole = user.organizations ? user.organizations[0].title : ''
          Logger.log('-- %s (%s) %s', userName, userEmail, userOrgRole);
          setSignature(userEmail, user);
        }
      }
    } else {
      Logger.log('No users found.');
    }
    pageToken = page.nextPageToken;
  } while (pageToken);
}

function setSignature(email, userData) {
  var signatureSetSuccessfully = false;
  var authorizationScope = ['https://www.googleapis.com/auth/gmail.settings.sharing','https://www.googleapis.com/auth/gmail.settings.basic'];
  
  var service = getDomainWideDelegationService("Gmail: ", authorizationScope, email);

  if (!service.hasAccess()) {
    Logger.log("failed to authenticate as user " + email);
    Logger.log(service.getLastError());
    return service.getLastError();
  } else {
    Logger.log("successfully authenticated as user " + email);
  }
  
  // 保留模板原有HTML结构，仅替换变量
  var signatureTemplate = HtmlService.createHtmlOutputFromFile("signature").getContent();
  var userSig = signatureTemplate
          .replace(/{email}/g, userData.primaryEmail)
          .replace(/{firstName}/g, userData.name.givenName)
          .replace(/{lastName}/g, userData.name.familyName)
          .replace(/{jobTitle}/g, userData.organizations ? userData.organizations[0].title : '');
  
  var resource = { 
    signature: userSig,
    sendAsEmail: email
  };
  
  var requestBody = {
    headers: {
      "Authorization": "Bearer " + service.getAccessToken(),
      "Accept": "application/json", 
      "Content-Type": "application/json",
    },
    contentType: "application/json",
    method: "PUT",
    payload: JSON.stringify(resource),
    muteHttpExceptions: true
  };

  var emailForUrl = encodeURIComponent(email);
  var url = `https://www.googleapis.com/gmail/v1/users/${email}/settings/sendAs/${emailForUrl}`;

  try {
    var setSignatureResponse = UrlFetchApp.fetch(url, requestBody);
    var responseData = JSON.parse(setSignatureResponse.getContentText());
    signatureSetSuccessfully = true;
    Logger.log("Successfully updated signature for: " + responseData.sendAsEmail);
  } catch (e) {
    Logger.log("Set signature failed: " + e.message);
    if (e.response) {
      Logger.log("Error details: " + e.response.getContentText());
    }
  }
  
  return signatureSetSuccessfully;
}

// 替换为你的服务账号凭证
var OAUTH2_SERVICE_ACCOUNT_PRIVATE_KEY  = "-----BEGIN PRIVATE KEY-----\nYOUR_PRIVATE_KEY\n-----END PRIVATE KEY-----\n";
var OAUTH2_SERVICE_ACCOUNT_CLIENT_EMAIL = 'your-service-account@project-id.iam.gserviceaccount.com';

function getDomainWideDelegationService(serviceName, scope, email) {
  Logger.log('Starting authentication for: ' + email);

  return OAuth2.createService(serviceName + email)
      .setTokenUrl('https://accounts.google.com/o/oauth2/token')
      .setPrivateKey(OAUTH2_SERVICE_ACCOUNT_PRIVATE_KEY)
      .setIssuer(OAUTH2_SERVICE_ACCOUNT_CLIENT_EMAIL)
      .setSubject(email)
      .setPropertyStore(PropertiesService.getScriptProperties())
      .setScope(scope.join(' '));
}

额外注意事项 #

• 确保signature.html模板中的变量占位符与代码替换字段完全匹配
• 在Admin控制台中确认Gmail API已启用（API和服务 > 库 > Gmail API）
• 开启muteHttpExceptions: true后，可捕获详细错误响应，便于排查权限或请求格式问题

内容的提问来源于stack exchange，提问作者Jesus Enmanuel De La Cruz