使用服务账户管理Google日历事件：解决403权限问题与最佳实践

import com.google.api.client.googleapis.auth.oauth2.GoogleCredential;
import com.google.api.client.googleapis.javanet.GoogleNetHttpTransport;
import com.google.api.client.json.JsonFactory;
import com.google.api.client.json.jackson2.JacksonFactory;
import com.google.api.services.calendar.Calendar;
import com.google.api.services.calendar.CalendarScopes;
import com.google.api.services.calendar.model.Event;
import com.google.api.services.calendar.model.EventDateTime;
import com.google.api.services.calendar.model.EventAttendee;

import java.io.File;
import java.io.FileInputStream;
import java.io.IOException;
import java.security.GeneralSecurityException;
import java.util.Arrays;
import java.util.Collections;
import java.util.List;

public class GoogleCalendarServiceAccountExample {

    private static final String APPLICATION_NAME = "Google Calendar API Service Account Example";
    private static final JsonFactory JSON_FACTORY = JacksonFactory.getDefaultInstance();
    // 定义所需的OAuth范围
    private static final List<String> SCOPES = Collections.singletonList(CalendarScopes.CALENDAR); 

    // 服务账户密钥文件的路径（从Google Cloud Console下载的JSON文件）
    private static final String SERVICE_ACCOUNT_KEY_FILE_PATH = "path/to/your/service_account_key.json";
    // 要模拟的Google Workspace用户的电子邮件地址
    private static final String USER_TO_IMPERSONATE_EMAIL = "user@your-domain.com"; 

    public static void main(String... args) throws IOException, GeneralSecurityException {
        // 1. 构建服务账户凭据
        // 使用fromStream方法加载JSON密钥文件，并指定作用域
        GoogleCredential credential = GoogleCredential.fromStream(new FileInputStream(SERVICE_ACCOUNT_KEY_FILE_PATH))
                .createScoped(SCOPES);

        // 2. 关键步骤：设置要模拟的用户
        // 这告诉Google API，服务账户将代表 USER_TO_IMPERSONATE_EMAIL 这个用户进行操作
        credential = credential.createDelegated(USER_TO_IMPERSONATE_EMAIL);

        // 3. 构建Google Calendar服务客户端
        Calendar service = new Calendar.Builder(GoogleNetHttpTransport.newTrustedTransport(), JSON_FACTORY, credential)
                .setApplicationName(APPLICATION_NAME)
                .build();

        // 4. 定义日历ID (可以是'primary'表示模拟用户的主日历，或特定日历的电子邮件地址)
        String calendarId = "primary"; 

        // 5. 创建日历事件对象
        Event event = new Event()
                .setSummary("Service Account Scheduled Meeting")
                .setDescription("This meeting was created by a service account via Domain-Wide Delegation.");

        // 设置事件开始时间
        EventDateTime start = new EventDateTime()
                .setDateTime(new com.google.api.client.util.DateTime("2024-12-25T09:00:00-07:00"))
                .setTimeZone("America/Los_Angeles");
        event.setStart(start);

        // 设置事件结束时间
        EventDateTime end = new EventDateTime()
                .setDateTime(new com.google.api.client.util.DateTime("2024-12-25T10:00:00-07:00"))
                .setTimeZone("America/Los_Angeles");
        event.setEnd(end);

        // 添加参与者（包括被模拟的用户，以及其他任何您希望邀请的人）
        EventAttendee[] attendees = new EventAttendee[] {
                new EventAttendee().setEmail(USER_TO_IMPERSONATE_EMAIL),
                new EventAttendee().setEmail("another_attendee@example.com") 
        };
        event.setAttendees(Arrays.asList(attendees));

        // 6. 插入事件到日历
        try {
            event = service.events().insert(calendarId, event).execute();
            System.out.printf("Event created successfully: %s\n", event.getHtmlLink());
        } catch (IOException e) {
            System.err.println("Error creating event: " + e.getMessage());
            if (e.getMessage().contains("403 Forbidden")) {
                System.err.println("Possible causes for 403 Forbidden:");
                System.err.println("1. Domain-Wide Delegation (DWD) not properly configured in Google Workspace Admin Console.");
                System.err.println("   - Ensure the service account's Client ID is authorized for the correct OAuth scopes (e.g., " + SCOPES.get(0) + ").");
                System.err.println("2. The 'USER_TO_IMPERSONATE_EMAIL' (" + USER_TO_IMPERSONATE_EMAIL + ") does not have 'writer' access to the specified calendar ('" + calendarId + "').");
                System.err.println("3. Attempting to use DWD with a standard @gmail.com account. DWD is for Google Workspace domains only.");
                System.err.println("4. The service account JSON key file path is incorrect or the file is corrupted.");
            }
        }
    }
}