如何在我的Google Play开发者帐户中访问桶？

Question

我正在尝试以编程方式访问我的Google Play开发者帐户的Google云存储桶，以获取应用程序的统计信息。即使我已将我的服务帐户添加到play console并授予其管理员权限，我仍收到一个身份验证错误。

'use strict'

const { google } = require('googleapis')
const {Storage} = require('@google-cloud/storage');

const key = require('../Gcloud-service-account.json')
const scopes = 'https://www.googleapis.com/auth/devstorage.read_only'
const jwt = new google.auth.JWT(key.client_email, null, key.private_key, scopes)

process.env.GOOGLE_APPLICATION_CREDENTIALS = '../Gcloud-service-account.json';

jwt.authorize((err, response) => {

    const authCloudExplicit = async () => {
        // [START auth_cloud_explicit]
        // Imports the Google Cloud client library.



        const projectId = 'gplay-stats-nodejs'
        const keyFilename = '../Gcloud-service-account.json'
        const storage = new Storage({projectId, keyFilename});
        console.log('outside try')

        // Makes an authenticated API request.
        try {
          const [buckets] = await storage.getBuckets();
          console.log('inside try')
          buckets.forEach(bucket => {
            console.log(bucket.name);

          });
        } catch (err) {
          console.error('ERROR:', err);
        }
        // [END auth_cloud_explicit]
      };
      authCloudExplicit();

     //Reading data

      async function downloadFile() {
        // [START storage_download_file]
        // Imports the Google Cloud client library



      // Creates a client
        const storage = new Storage();

        /**
         * TODO(developer): Uncomment the following lines before running the sample.
         */
        const bucketName = 'pubsite__rev_05768497717432290806/stats/installs';
        const srcFilename = 'installs_package-id-of-my-app_201901_app_version.csv';
        const destFilename = '../download';

        const options = {

          destination: destFilename,
        };

        // Downloads the file
        await storage
          .bucket(bucketName)
          .file(srcFilename)
          .download(options);

        console.log(
          `gs://${bucketName}/${srcFilename} downloaded to ${destFilename}.`
        );

      }
      downloadFile();

    (err, result) => {
        console.log(err, result)
      }

  })

//Here is my service account json

{
  "type": "service_account",
  "project_id": "",
  "private_key_id": "",
  "private_key": "",
  "client_email": "",
  "client_id": "",
  "auth_uri": "https://accounts.google.com/o/oauth2/auth",
  "token_uri": "https://oauth2.googleapis.com/token",
  "auth_provider_x509_cert_url": "https://www.googleapis.com/oauth2/v1/certs",
  "client_x509_cert_url": "https://www.googleapis.com/robot/v1/metadata/x509/service-account-email"
}

删除了一些机密字段。

我得到这个错误：

code: 403,
  errors: [
    {
      domain: 'global',
      reason: 'forbidden',
      message: 'service-account-email' +
        'does not have storage.buckets.list access to project ' +
        '2763836207.'
    }
  ],
  response: PassThrough {
    _readableState: ReadableState {
      objectMode: false,
      highWaterMark: 16384,
      buffer: BufferList { head: null, tail: null, length: 0 },
      length: 0,
      pipes: null,
      pipesCount: 0,
      flowing: true,
      ended: true,
      endEmitted: true,
      reading: false,
      sync: false,
      needReadable: false,
      emittedReadable: false,
      readableListening: false,
      resumeScheduled: false,
      paused: false,
      emitClose: true,
      autoDestroy: false,
      destroyed: false,
      defaultEncoding: 'utf8',
      awaitDrain: 0,
      readingMore: false,
      decoder: null,
      encoding: null
    },
    readable: false,
    _events: [Object: null prototype] {
      prefinish: [Function: prefinish],
      error: [Array],
      data: [Function],
      end: [Function]
    },
    _eventsCount: 4,
    _maxListeners: undefined,
    _writableState: WritableState {
      objectMode: false,
      highWaterMark: 16384,
      finalCalled: false,
      needDrain: false,
      ending: true,
      ended: true,
      finished: true,
      destroyed: false,
      decodeStrings: true,
      defaultEncoding: 'utf8',
      length: 0,
      writing: false,
      corked: 0,
      sync: false,
      bufferProcessing: false,
      onwrite: [Function: bound onwrite],
      writecb: null,
      writelen: 0,
      bufferedRequest: null,
      lastBufferedRequest: null,
      pendingcb: 0,
      prefinished: true,
      errorEmitted: false,
      emitClose: true,
      autoDestroy: false,
      bufferedRequestCount: 0,
      corkedRequestsFree: [Object]
    },
    writable: false,
    allowHalfOpen: true,
    _transformState: {
      afterTransform: [Function: bound afterTransform],
      needTransform: false,
      transforming: false,
      writecb: null,
      writechunk: null,
      writeencoding: 'buffer'
    },
    statusCode: 403,
    statusMessage: 'Forbidden',
    request: {
      headers: [Object],
      href: 'https://www.googleapis.com/storage/v1/b?project=gplay-stats-nodejs'
    },
    body: '{\n "error": {\n  "errors": [\n   {\n    "domain": "global",\n    ' +
      '"reason": "forbidden",\n    "message": ' +
      '"service-account-email does ' +
      'not have storage.buckets.list access to project 2763836207."\n   }\n  ' +
      '],\n  "code": 403,\n  "message": ' +
      '"service-account-email does ' +
      'not have storage.buckets.list access to project 2763836207."\n }\n}\n',
    headers: {
      'alt-svc': 'quic=":443"; ma=2592000; v="46,43,39"',
      'cache-control': 'private, max-age=0',
      connection: 'close',
      'content-length': '400',
      'content-type': 'application/json; charset=UTF-8',
      date: 'Sun, 04 Aug 2019 21:46:39 GMT',
      expires: 'Sun, 04 Aug 2019 21:46:39 GMT',
      server: 'UploadServer',
      vary: 'Origin, X-Origin',
      'x-guploader-uploadid': 'AEnB2UqCDuQdbWsAmyTty5rImnOYxLB71xh5hf7-4boSY9c5d7cCZly5mQJsbJY57emgn9jyGDVKtlDM4jeUG07IJKl7I3RpxQ'
    },
    toJSON: [Function: toJSON]
  },
  message: 'service-account-email ' +
    'does not have storage.buckets.list access to project ' +
    '2763836207.'
}

Answer 1

你们服务号的角色是什么？它必须只有存储对象查看器，不是吗？此角色允许服务号查看桶中的对象。但是这里你也需要用这行列出桶

const[bucket]=wait storage.getbucket（）

顺便说一下，您的服务帐户还需要角色storageAdmin或projectViewer中包含的storage.bucket.list权限。就个人而言，我更喜欢并推荐projectViewer，因为这个角色不能创建/删除bucket，即使它可以查看项目的所有资源。

最好的解决方案是仅在具有正确权限的情况下创建自定义角色。使用您的代码并不总是一个好的解决方案，因为库有时会执行您不处理和/或不想要的调用。Python就是这样，node也可能是这样。