无法使用服务号在谷歌日历中创建事件

Question

我有两个google workspace帐户用于测试。帐户A有一个服务帐户，在帐户B中，我添加了用于域范围委派的服务帐户，该帐户具有读取/写入帐户B中日历所需的权限。

阅读活动和日历很有效。但是，当尝试使用帐户B中的资源日历中的服务帐户创建事件时，我遇到以下错误：

{"error":{"errors":[{"domain":"calendar","reason":"requiredAccessLevel","message":"You need to have writer access to this calendar."}],"code":403,"message":"You need to have writer access to this calendar."}}

添加的权限：

如果我们在一个Google工作空间帐户中进行测试，它就可以工作。

这是密码

// clientMail is the service account id
// privateKey is the service account key
// subject is also the service account id

const jwtClient = new google.auth.JWT(
    clientMail,
    undefined,
    privateKey,
    [
      'https://www.googleapis.com/auth/calendar',
    ],
    subject,
  );

  let calendar = google.calendar({
    version: 'v3',
    auth: jwtClient,
  });
...

savedEvent = (await calendar.events.insert({ calendarId, requestBody: event })).data;
...

Answer 1

您似乎忘记指定要将服务帐户委派给哪个用户。

from google.oauth2 import service_account

SCOPES = ['https://www.googleapis.com/auth/calendar']
SERVICE_ACCOUNT_FILE = '/path/to/service.json'

credentials = service_account.Credentials.from_service_account_file(
        SERVICE_ACCOUNT_FILE, scopes=SCOPES)

delegated_credentials = credentials.with_subject('[e-mail]')