深入解析：Java REST服务中Gmail API的无用户干预访问策略

import com.google.api.client.googleapis.auth.oauth2.GoogleCredential;
import com.google.api.client.http.HttpTransport;
import com.google.api.client.http.javanet.NetHttpTransport;
import com.google.api.client.json.JsonFactory;
import com.google.api.client.json.jackson2.JacksonFactory;
import com.google.api.services.drive.DriveScopes; // 示例中使用DriveScopes，实际应使用Gmail API的Scope，如GmailScopes.GMAIL_SEND

import java.io.IOException;
import java.io.InputStream;
import java.util.Collections;

public class GmailApiAuthService {

    private static final HttpTransport HTTP_TRANSPORT = new NetHttpTransport();
    private static final JsonFactory JSON_FACTORY = JacksonFactory.getDefaultInstance();

    /**
     * 通过域范围授权（DWD）获取GoogleCredential。
     * 此方法适用于Google Workspace域账户，服务账户将模拟指定的用户。
     *
     * @param serviceAccountKeyPath 服务账户JSON密钥文件的路径（例如：classpath下的client_secrets.json）
     * @param userEmailToImpersonate 要模拟的Google Workspace域内用户的邮箱地址
     * @param scopes 应用程序所需的API权限范围列表
     * @return 认证后的GoogleCredential对象
     */
    public GoogleCredential authorizeWithDomainWideDelegation(
            String serviceAccountKeyPath,
            String userEmailToImpersonate,
            java.util.Collection<String> scopes) {

        GoogleCredential credential = null;
        try {
            // 从类路径加载服务账户JSON密钥文件
            InputStream jsonFileStream = getClass().getClassLoader().getResourceAsStream(serviceAccountKeyPath);
            if (jsonFileStream == null) {
                throw new IOException("Service account key file not found: " + serviceAccountKeyPath);
            }

            // 从JSON文件创建基本的GoogleCredential对象
            GoogleCredential baseCredential = GoogleCredential
                    .fromStream(jsonFileStream, HTTP_TRANSPORT, JSON_FACTORY)
                    .createScoped(scopes); // 初始作用域，通常在DWD场景下会再次指定

            // 构建最终的GoogleCredential，并指定要模拟的用户
            credential = new GoogleCredential.Builder()
                    .setTransport(baseCredential.getTransport())
                    .setJsonFactory(baseCredential.getJsonFactory())
                    .setServiceAccountId(baseCredential.getServiceAccountId())
                    .setServiceAccountUser(userEmailToImpersonate) // 关键：指定要模拟的用户
                    .setServiceAccountScopes(scopes) // 指定服务账户的作用域
                    .setServiceAccountPrivateKey(baseCredential.getServiceAccountPrivateKey())
                    .build();

        } catch (IOException e) {
            System.err.println("Error during GoogleCredential authorization: " + e.getMessage());
            e.printStackTrace();
        }
        return credential;
    }

    public static void main(String[] args) {
        // 示例用法
        GmailApiAuthService authService = new GmailApiAuthService();
        String serviceAccountKeyFile = "client_secrets.json"; // 确保此文件在classpath中
        String targetUserEmail = "user@your-workspace-domain.com"; // 替换为你的Google Workspace域内用户邮箱

        // Gmail API的发送邮件权限范围
        java.util.Collection<String> gmailScopes = Collections.singletonList("https://www.googleapis.com/auth/gmail.send");
        // 或者使用更全面的范围：Collections.singletonList(GmailScopes.GMAIL_COMPOSE) 或 GmailScopes.GMAIL_MODIFY

        GoogleCredential credential = authService.authorizeWithDomainWideDelegation(
                serviceAccountKeyFile,
                targetUserEmail,
                gmailScopes
        );

        if (credential != null) {
            System.out.println("GoogleCredential obtained successfully for user: " + targetUserEmail);
            // 此时可以使用此credential来构建Gmail服务客户端并发送邮件
            // 例如：Gmail service = new Gmail.Builder(HTTP_TRANSPORT, JSON_FACTORY, credential).setApplicationName("YourAppName").build();
            // service.users().messages().send(...).execute();
        } else {
            System.out.println("Failed to obtain GoogleCredential.");
        }
    }
}