I have a query regarding accessing Skydrive folders programmatically through the Live SDK on Windows Phone.
So the scenario I have at hand is that a Windows phone app that I have built creates folders (and files) on your Skydrive. Now I want the following functionality which I haven’t been able to do so till now.
Is it possible that I can programmatically share my folder and files with View (and/or edit) permissions to my friends (as I know their user ID)?
If I am able to share such a folder can I access the content after logging in (with my live ID) from my phone. By accessing I mean download or stream content.
If in step 1, a person to whom the file is shared is provided edit permissions how can I programmatically edit such a file? The current problem I am facing in this step is that to update a shared folder the live sdk requests a wl.contacts_skydrive_update scope, but while logging in I am notified that no such scope exists.
This is the Error message I get when I try to get a shared_edit_link:
request_token_unauthorized: Microsoft.Live.LiveConnectException: The
provided access token does not have access to this resource. An access
token with one of the following scopes is required:
'wl.contacts_skydrive_update'.
Although the user does have edit permissions. Note: Such a scope doesn't exist.
There is a thread on this where it was listed as a bug in the beta. They said that now it should be fixed and you should only need this scope: 'wl.contacts_skydrive'.
here is the thread
Related
I have an internal app (not a published one, only used within our Google Workspace domain) which is a command line tool to update the contents of some Google Sheets. It currently uses the https://www.googleapis.com/auth/drive scope and works fine.
I want to minimize the privileges of the authorization token that this app caches, and by reading the documentation it seems that I should be able to use the https://www.googleapis.com/auth/drive.readonly scope to find the file I want, and also https://www.googleapis.com/auth/drive.file to grant write access to only a specific file.
With the reduced scopes, I am not surprised to get an error like:
appNotAuthorizedToFile: The user has not granted the app 566375348811 write access to the file 1UsItGhBHwRaodHbv5g1LCrSESUZBkskDvKDkbGjREjI
The only relevant documentation talks about integrating apps with Google Drive and using the Drive Picker UI which I expect does this authorization behind the scenes. Since this is an internal command line tool, I really don't want to go that route.
Hence the question:
How do I open a file in a command line application using the https://www.googleapis.com/auth/drive.file scope?
I'm OK even if I need to set some magic metadata on the file to make it accessible.
Update
As I got a couple of responses saying that when using drive.file it is not possible to access files which are not created by the application, I am putting some supporting documentation here to show why I think it is possible:
The API-specific auth info is the first document on the Google Drive API page, and it specifically mentions:
So, when possible, use non-sensitive scopes as they narrow access to
specific functionality needed by an app. In most cases, providing
narrow access means using the
https://www.googleapis.com/auth/drive.file per-file access scope.
Further down the page it mentions:
This scope enables users to select the specific files from Google
Drive, and through the Google Picker, that they want to allow your app
to access.
I understand this to mean that it is possible to open files which were not created by the app, even when using drive.file.
My problem is that the document goes on to explain:
Many apps work with per-file access without any changes. If you are
currently using your own file picker, we recommend switching to the
Google Picker which fully supports the drive.file scope.
Well, since I am using a command line app, I cannot use the Google Picker, so I am asking how to implement my own. I do understand that the picker itself needs to have access to all the files (hence the need for a drive.readonly scope), but to actually be able to write the files, it needs the elevated permission of drive or the more restrictive per-file access of drive.file.
If I simulate an authorization request for drive.file I get a prompt which explains that authorizing the request will grant my app to:
See, edit, create, and delete only the specific Google Drive files you use with this app ℹ️
Clicking on the information icon I get a more verbose explanation which reads like it support opening any file I authorize:
This app wants permission to create new files or change existing files
that you open with this app. Once authorized, the app can:
See these files
Upload and download these files
Delete these files
See the names and emails of people you share these files with
Share and stop sharing these files with others
Organize these files
There may be private information in your Google Drive, like financial
records, medical reports, photos or tax info.
There are also other examples of applications like ZIP Extractor or diagrams.net or Photo Editor which use the drive.file scope (based on the authorization prompt), and which I can use to open and edit files that were not created by them.
I am posting this as an answer, to demonstrate an ugly "workaround" for the issue.
TL;DR: Use a web based frontend to authorize access to files. Once the app is authorized, the command line app inherits the permissions.
More step by step instructions, assuming we already have a working command line project:
Go to https://myaccount.google.com/permissions and revoke all access I have granted to my app.
Follow the instructions at the Drive Picker API to update my current GCP project.
Create an API key. OK to be unrestricted, but I restricted it to https://localhost:9843
Create a new OAuth 2.0 client ID of a "Web application" type (my current one is "Desktop" type and that would not work). Authorize https://localhost:9843 as a JavaScript origin.
Copy the helloworld.html example at the bottom of the Drive Picker API guide which is also on GitHub with the following modifications:
Set developerKey to the API key created above
Set clientId to the new OAuth 2.0 client ID created abovce
Set appId to the numeric project ID of my GCP project
Add 'include_granted_scopes': true to the call to window.gapi.auth.authorize
Update createPicker to make it easier to find the files I want. E.g., set the mime type filter to application/vnd.google-apps.spreadsheet.
Host the example in a browser with ruby -rwebrick/https -e 'WEBrick::HTTPServer.new(:Port => 9843, :DocumentRoot => ".", :SSLEnable => true, :SSLCertName => "CN=localhost", :SSLCertComment => "Autogenerated" ).start'
Now, if my command line app fails to edit a file, I can use https://localhost:9843/helloworld.html to grant access to the file, and my command line app can then edit that file.
If you check the docs for the scope you will find it says.
https://www.googleapis.com/auth/drive.file View and manage Google Drive files and folders that you have opened or created with this app
This gives your app access to files that the app itself created or has previously opened.
You should also know that there is no way to limit authorization to a single file. Authorization is all or not thing.
How do I open a file in a command line application using the https://www.googleapis.com/auth/drive.file scope?
You make sure that the file was created by the app itself. using files.create. If the file was created by any other app the you cant access it using the drive.file scope
There is one note though if you have https://www.googleapis.com/auth/drive.read-only scope and you open that file to read it. the line where it says opened or created with this app implies to me that once you have opended it for read in this app that you would then be able to use it with https://www.googleapis.com/auth/drive.file but its not something I have tried.
Another thing is im not sure what you mean by open the google drive api is a file storage api its not going to let you see the contents of the file your going to have to download it and open it locally. Have you considered going though the Google sheets api if you want to read and write to it programmatically?
I'm requesting authorization codes using the Google API and specify https://www.googleapis.com/auth/drive.file as the required scope since I'm going to store files on the users drives.
However, when I'm authenticating it says my application requests permission for two scopes, both
View and manage Google Drive files and folders that you have opened or created with this app
and
View metadata for files in your Google Drive
I can verify that I indeed have access to list all files on the drive.
Is the drive.metadata automatically included/required for the scope i'm requesting?
I wish to ask for as few permissions as possible.
Drive v3 scopes
https://www.googleapis.com/auth/drive View and manage the files in your Google Drive
https://www.googleapis.com/auth/drive.appdata View and manage its own configuration data in your Google Drive
https://www.googleapis.com/auth/drive.file View and manage Google Drive files and folders that you have opened or created with this app
https://www.googleapis.com/auth/drive.metadata View and manage metadata of files in your Google Drive
https://www.googleapis.com/auth/drive.metadata.readonly View metadata for files in your Google Drive
https://www.googleapis.com/auth/drive.photos.readonly View the photos, videos and albums in your Google Photos
https://www.googleapis.com/auth/drive.readonly View the files in your Google Drive
https://www.googleapis.com/auth/drive.scripts Modify your Google Apps Script scripts' behavior
You cant view metadata on a file you dont have access to see. Yes you need to be able to see them. Google is smart they know if you want to want to see the metadata your going to have to also need the ability to see the file in question. So yes you are going to need to be able to list it.
I want to request the permissions that I need for my android wear app upfront as per this. So Programmatically where exactly I should put my permission request code. Also is the protocol to ask for Permission the same as the mobile app like this.
All of the permissions are controlled in the Androidmanifest. Here is an example of some permissions being declared in the Androidmanifest:
These permissions are used to get the weather from the device and relay the information to an Android Wear device. Google offers documentation for developers to use to determine what permissions should be used. Declaring permissions should happen in the Androidmanifest in the format provided in the image. In the sample code posted, it is not necessary to include watch permissions, they are only required if the app works with Android Wear.
Way back in the day Google added a feature in Android 4.3 that let the user control what permissions apps could access on a per app basis known as App Ops. This was a great feature that cut down on privacy issues and gave users the piece of mind knowing that random apps installed could not access the device’s location. When Google introduced Android 6.0 Marshmallow, This time when an app needs to use a permission a dialog box pops up on the screen and asks the user if it is OK that the app uses a certain permission. This may get a little annoying, but at least every permission used by an app has to go through the user first.
If your app doesn't already have the permission it needs, the app must call one of the [requestPermissions()](https://developer.android.com/reference/android/support/v4/app/ActivityCompat.html#requestPermissions(android.app.Activity, java.lang.String[], int)) methods to request the appropriate permissions. Your app passes the permissions it wants, and also an integer request code that you specify to identify this permission request. This method functions asynchronously: it returns
right away, and after the user responds to the dialog box, the system calls the app's callback method with the results, passing the same request code that the app passed to requestPermissions().
You should dynamically request the permissions from user on wearable devices just the same way you do on the phone side.
I'm trying to somehow allow other people to download uploaded files on QuickBase on a different website. I have files on QuickBase uploaded, but people need to sign-in to QuickBase to download it. Is there any other way around it?
You can grant what is essentially anonymous access to one of your Quickbase applications by giving "Everyone on the Internet" a role in your application. It gives anyone with a link to that application whatever access level is defined in the role given. If you want to only share files, you could create a role that has view only access of that specific file attachment field and assign that to "Everyone on the Internet". If you want to be selective about which records are available for download you can include a checkbox to "Make Public" and include that in the role's view logic.
You grant "Everyone on the Internet" access in the add user form for the application. If you start typing "Everyone on the Internet", you'll see it pop up as a recommended user name. If you do not see this as an option, that means that granting open access was disabled by one of your billing account administrators.
Just remember, whatever permissions you grant "Everyone on the Internet" applies to literally anyone on the Internet that has a link to your app. Of course, you can always use a separate file hosting service like Dropbox or Box if you want to avoid the Quickbase issue entirely.
You can allow file downloads for anyone with the link to the file. That's a setting for every file attachment field on QuickBase. Once you go to the specific attachment field setting you will find it under File Attachment field options. It's a checkbox called "Allow access to this file attachment from a Quickbase link without signing in". For me, that's prefered compared to giving everyone access to the app and restricting all the other fields by role.
I am creating an app which saves same files on dropBox, in the app folder. all the saved files uploaded by all app users should then be displayed in a table view. the result which I got is that only the user's files are shown, but I would like the data do be synchronized among all app users. I posted a question of this kind on dropbox developer forum and this was the answer:
"The Dropbox API is built to sync files within each specific authorized account, not between all authorized accounts.
If you do need to copy files between accounts, check out the new /copy_ref call:
https://www.dropbox.com/developers/reference/api#copy_ref"
...
"This really depends on the structure/use of your app. If it's just an iOS app, with no server side component, you'll need to build some way for users to send the copy references to each other."
I so tried to understand what the copy ref was, but It isn't very clear. do they mean that I need to build a server like mySql to do this, or can I integrate the ability to share all the data in the app itself??