使用服务账户管理Google日历事件：解决403权限问题与最佳实践

import com.google.api.client.googleapis.auth.oauth2.GoogleCredential; import com.google.api.client.googleapis.javanet.GoogleNetHttpTransport; import com.google.api.client.json.JsonFactory; import com.google.api.client.json.jackson2.JacksonFactory; import com.google.api.services.calendar.Calendar; import com.google.api.services.calendar.CalendarScopes; import com.google.api.services.calendar.model.Event; import com.google.api.services.calendar.model.EventDateTime; import com.google.api.services.calendar.model.EventAttendee;  import java.io.File; import java.io.FileInputStream; import java.io.IOException; import java.security.GeneralSecurityException; import java.util.Arrays; import java.util.Collections; import java.util.List;  public class GoogleCalendarServiceAccountExample {      private static final String APPLICATION_NAME = "Google Calendar API Service Account Example";     private static final JsonFactory JSON_FACTORY = JacksonFactory.getDefaultInstance();     // 定义所需的OAuth范围     private static final List<String> SCOPES = Collections.singletonList(CalendarScopes.CALENDAR);       // 服务账户密钥文件的路径（从Google Cloud Console下载的JSON文件）     private static final String SERVICE_ACCOUNT_KEY_FILE_PATH = "path/to/your/service_account_key.json";     // 要模拟的Google Workspace用户的电子邮件地址     private static final String USER_TO_IMPERSONATE_EMAIL = "user@your-domain.com";       public static void main(String... args) throws IOException, GeneralSecurityException {         // 1. 构建服务账户凭据         // 使用fromStream方法加载JSON密钥文件，并指定作用域         GoogleCredential credential = GoogleCredential.fromStream(new FileInputStream(SERVICE_ACCOUNT_KEY_FILE_PATH))                 .createScoped(SCOPES);          // 2. 关键步骤：设置要模拟的用户         // 这告诉Google API，服务账户将代表 USER_TO_IMPERSONATE_EMAIL 这个用户进行操作         credential = credential.createDelegated(USER_TO_IMPERSONATE_EMAIL);          // 3. 构建Google Calendar服务客户端         Calendar service = new Calendar.Builder(GoogleNetHttpTransport.newTrustedTransport(), JSON_FACTORY, credential)                 .setApplicationName(APPLICATION_NAME)                 .build();          // 4. 定义日历ID (可以是'primary'表示模拟用户的主日历，或特定日历的电子邮件地址)         String calendarId = "primary";           // 5. 创建日历事件对象         Event event = new Event()                 .setSummary("Service Account Scheduled Meeting")                 .setDescription("This meeting was created by a service account via Domain-Wide Delegation.");          // 设置事件开始时间         EventDateTime start = new EventDateTime()                 .setDateTime(new com.google.api.client.util.DateTime("2024-12-25T09:00:00-07:00"))                 .setTimeZone("America/Los_Angeles");         event.setStart(start);          // 设置事件结束时间         EventDateTime end = new EventDateTime()                 .setDateTime(new com.google.api.client.util.DateTime("2024-12-25T10:00:00-07:00"))                 .setTimeZone("America/Los_Angeles");         event.setEnd(end);          // 添加参与者（包括被模拟的用户，以及其他任何您希望邀请的人）         EventAttendee[] attendees = new EventAttendee[] {                 new EventAttendee().setEmail(USER_TO_IMPERSONATE_EMAIL),                 new EventAttendee().setEmail("another_attendee@example.com")          };         event.setAttendees(Arrays.asList(attendees));          // 6. 插入事件到日历         try {             event = service.events().insert(calendarId, event).execute();             System.out.printf("Event created successfully: %sn", event.getHtmlLink());         } catch (IOException e) {             System.err.println("Error creating event: " + e.getMessage());             if (e.getMessage().contains("403 Forbidden")) {                 System.err.println("Possible causes for 403 Forbidden:");                 System.err.println("1. Domain-Wide Delegation (DWD) not properly configured in Google Workspace Admin Console.");                 System.err.println("   - Ensure the service account's Client ID is authorized for the correct OAuth scopes (e.g., " + SCOPES.get(0) + ").");                 System.err.println("2. The 'USER_TO_IMPERSONATE_EMAIL' (" + USER_TO_IMPERSONATE_EMAIL + ") does not have 'writer' access to the specified calendar ('" + calendarId + "').");                 System.err.println("3. Attempting to use DWD with a standard @gmail.com account. DWD is for Google Workspace domains only.");                 System.err.println("4. The service account JSON key file path is incorrect or the file is corrupted.");             }         }     } }