Gmail API在Java REST服务中的无干预访问策略与实现

import com.google.api.client.googleapis.auth.oauth2.GoogleCredential;
import com.google.api.client.http.HttpTransport;
import com.google.api.client.http.javanet.NetHttpTransport;
import com.google.api.client.json.JsonFactory;
import com.google.api.client.json.jackson2.JacksonFactory;
import com.google.api.services.gmail.GmailScopes; // 导入Gmail API的Scope

import java.io.IOException;
import java.io.InputStream;
import java.util.Collections;

public class GmailServiceAccountAuth {

    private static final String SERVICE_ACCOUNT_KEY_FILE = "client_secrets.json"; // 服务账户私钥文件路径
    private static final String USER_TO_IMPERSONATE_EMAIL = "user@yourdomain.com"; // 需要模拟的域用户邮箱

    /**
     * 使用域范围委派授权服务账户。
     * @return 授权后的GoogleCredential对象
     */
    public GoogleCredential authorizeWithServiceAccount() {
        HttpTransport httpTransport = null;
        JsonFactory jsonFactory = JacksonFactory.getDefaultInstance();
        GoogleCredential credential = null;

        try {
            httpTransport = GoogleNetHttpTransport.newTrustedTransport();

            // 从资源文件中加载服务账户私钥
            InputStream jsonFileStream = getClass().getClassLoader().getResourceAsStream(SERVICE_ACCOUNT_KEY_FILE);
            if (jsonFileStream == null) {
                throw new RuntimeException("Service account key file not found: " + SERVICE_ACCOUNT_KEY_FILE);
            }

            // 构建基础的服务账户凭据，指定所需的API范围
            // 对于Gmail API，可以使用GmailScopes.GMAIL_SEND, GmailScopes.GMAIL_COMPOSE等
            credential = GoogleCredential.fromStream(jsonFileStream, httpTransport, jsonFactory)
                    .createScoped(Collections.singletonList(GmailScopes.GMAIL_SEND)); // 指定Gmail发送权限

            // 设置服务账户要模拟的用户邮箱
            // 这是实现域范围委派的关键一步，服务账户将代表此用户执行操作
            credential = new GoogleCredential.Builder()
                    .setTransport(credential.getTransport())
                    .setJsonFactory(credential.getJsonFactory())
                    .setServiceAccountId(credential.getServiceAccountId())
                    .setServiceAccountUser(USER_TO_IMPERSONATE_EMAIL) // 模拟的域用户
                    .setServiceAccountScopes(credential.getServiceAccountScopes())
                    .setServiceAccountPrivateKey(credential.getServiceAccountPrivateKey())
                    .build();

        } catch (IOException e) {
            System.err.println("Error during service account authorization: " + e.getMessage());
            e.printStackTrace();
        } catch (GeneralSecurityException e) {
            System.err.println("Security error during transport initialization: " + e.getMessage());
            e.printStackTrace();
        } finally {
            // 在实际应用中，确保HttpTransport被正确关闭或管理
            // 对于长期运行的服务，HttpTransport通常是单例或池化的
        }
        return credential;
    }

    // 示例用法
    public static void main(String[] args) {
        GmailServiceAccountAuth auth = new GmailServiceAccountAuth();
        GoogleCredential credential = auth.authorizeWithServiceAccount();

        if (credential != null) {
            System.out.println("Service Account Authorization successful!");
            // 此时，可以使用此credential构建Gmail服务客户端并发送邮件
            // 例如：Gmail service = new Gmail.Builder(httpTransport, jsonFactory, credential).setApplicationName("YourAppName").build();
            // 然后使用service对象进行邮件发送操作
        } else {
            System.out.println("Service Account Authorization failed.");
        }
    }
}