How to use narrower Google Apps Script Authorization Scope when accessing file from own drive

1
votes

I'm making a google sheets addon and I copy a template sheet from my google drive to the user's current google spreadsheet using:

let ss = SpreadsheetApp.getActive(); 
let source = SpreadsheetApp.openById(TemplateSpreadsheetId); //  <-- gets scope error
let newSheet = source.getSheetByName(mainSheetName).copyTo(ss);

It works when I specify scope https://www.googleapis.com/auth/spreadsheets" in appsscript.json, but is there a way to use a narrower Google Apps Script Authorization Scope ? Other than this I only need @OnlyCurrentDoc or https://www.googleapis.com/auth/spreadsheets.currentonly"

The reason this matters it that users will have to agree that my addon can "See, edit, create, and delete your spreadsheets in Google Drive", which sounds like kind of scary permissions to me.

1
google-apps-scriptgoogle-sheets
You can try adding .readonly to the general spreadsheets one, but I suspect you will still have issues. – tehhowch
I should have mentioned that I already tried .readonly – Steve
You can perhaps use a urlfetchapp request to request the specific template by name from a webapp/cloud function you control (i.e. query available templates from webapp, then request a specific one). Then you'd need only spreadsheets.currentonly and external_request. – tehhowch
I don't see how I would pass the sheet from the webapp to my add-on. – Steve
You would need to send a serialized representation, since you are correct, the Sheet class is not directly sendable. You alone know how you want to use the template, so you alone know what specific data you need to store in the template. – tehhowch

1 Answers

1
votes

According to https://developers.google.com/apps-script/reference/spreadsheet/spreadsheet-app#openbyidid

Authorization
Scripts that use this method require authorization with one or more of the following scopes:

I think that the ...currentonly scope only will work when the id is the one of the script container