Gmail API Java REST服务无用户干预授权指南

import com.google.api.client.googleapis.auth.oauth2.GoogleCredential;
import com.google.api.client.http.HttpTransport;
import com.google.api.client.http.javanet.NetHttpTransport;
import com.google.api.client.json.JsonFactory;
import com.google.api.client.json.jackson2.JacksonFactory;
import com.google.api.services.drive.DriveScopes; // 示例中使用DriveScopes，实际应使用GmailScopes

import java.io.IOException;
import java.io.InputStream;
import java.util.Collections; // 导入Collections

public class GmailServiceAccountAuth {

    private static final String APPLICATION_NAME = "Your Notification Service";
    private static HttpTransport HTTP_TRANSPORT;
    private static final JsonFactory JSON_FACTORY = JacksonFactory.getDefaultInstance();

    /**
     * 构建GoogleCredential，用于通过域范围委派进行认证。
     *
     * @param userEmail 要模拟的用户邮箱地址（必须是Google Workspace域内的用户）
     * @return 授权后的GoogleCredential对象
     */
    public static GoogleCredential authorizeWithDomainWideDelegation(String userEmail) {
        GoogleCredential credential = null;
        try {
            HTTP_TRANSPORT = new NetHttpTransport(); // 初始化HTTP传输层

            // 从资源文件中加载服务账户的JSON密钥文件 (client_secrets.json)
            // 确保client_secrets.json文件位于classpath中
            InputStream jsonFileStream = GmailServiceAccountAuth.class.getClassLoader().getResourceAsStream("client_secrets.json");

            if (jsonFileStream == null) {
                throw new IOException("Service account key file (client_secrets.json) not found in classpath.");
            }

            // 从JSON密钥文件创建基础的GoogleCredential
            // 注意：这里使用了一个通用范围作为示例，实际应用中应使用Gmail API的相关范围，如 "https://www.googleapis.com/auth/gmail.send"
            GoogleCredential baseCredential = GoogleCredential
                    .fromStream(jsonFileStream, HTTP_TRANSPORT, JSON_FACTORY)
                    .createScoped(Collections.singletonList("https://www.googleapis.com/auth/gmail.send")); // 指定Gmail发送邮件的Scope

            // 构建最终的GoogleCredential，并设置要模拟的用户
            credential = new GoogleCredential.Builder()
                    .setTransport(baseCredential.getTransport())
                    .setJsonFactory(baseCredential.getJsonFactory())
                    .setServiceAccountId(baseCredential.getServiceAccountId())
                    .setServiceAccountUser(userEmail) // 关键：指定要模拟的用户邮箱
                    .setServiceAccountScopes(baseCredential.getServiceAccountScopes())
                    .setServiceAccountPrivateKey(baseCredential.getServiceAccountPrivateKey())
                    .build();

        } catch (IOException exception) {
            System.err.println("Error during GoogleCredential authorization: " + exception.getMessage());
            exception.printStackTrace();
        }
        return credential;
    }

    public static void main(String[] args) {
        // 示例用法：假设要模拟 user@yourdomain.com
        String targetUserEmail = "user@yourdomain.com"; // 替换为您的Google Workspace域内的实际用户邮箱
        GoogleCredential credential = authorizeWithDomainWideDelegation(targetUserEmail);

        if (credential != null) {
            System.out.println("GoogleCredential obtained successfully for user: " + targetUserEmail);
            // 此时可以使用此credential来构建Gmail服务客户端并发送邮件
            // 例如：Gmail service = new Gmail.Builder(HTTP_TRANSPORT, JSON_FACTORY, credential).setApplicationName(APPLICATION_NAME).build();
            // service.users().messages().send(...).execute();
        } else {
            System.out.println("Failed to obtain GoogleCredential.");
        }
    }
}