value attribute for Permissions Resource not popul

Question

Looking at:

https://developers.google.com/drive/v2/reference/permissions#resource

the values attribute which contains the email address value for the ACL is not returned by the API. It's not clear why the value isn't returned, I assume it's a privacy issue but it means Drive SDK can't support document migration (from one Google account to another) use cases where the old Documents List API v3 can:

https://developers.google.com/google-apps/documents-list/#retrieving_the_acl_for_a_document_file_or_collection

for now I'm looking at adding both Drive API and Docs v3 API scopes for my project and just using the Docs API call to retrieve the ACLs but ideally I'd be able to use just Drive API calls. Am I missing anything? Could a special scope be added to Drive API that allows ACL email address retrieval or is there some other way to handle this?

Jay

Answer 1

You are absolutely correct, the email address is hidden for privacy. It is not right that a user should see the email addresses of all other users that have access to the file. But I'm not sure I quite get the problem. Are you migrating using service accounts, or are users individually authorizing the migration?

The value in the permissions feed is consistent for each user, and that value is available in the about feed for a user. I assume you know the email address of the users, so you can authorize for each of them With a service account, and you can migrate the data.

You should not need the Drive API scope and the Docs v3 API scope, they are pretty much the same scope.

Answer 2

Thanks for your question Jay and thanks your answer Ali Afshar!

Unfortunately I do not understand how Google believes the following scenario should work without the email address of the users:

In Documents List API v3 you could copy a file A to file B, retrieve the ACL-information of file A (including the users email adresses) and simply add them as ACL to file B.

With Drive API you can retrieve almost the same Permission information, but without the user email address, which is still required to re-share file B to the same users.

As a sidenote: If you use GAS DefaultService DocsList, you can still receive the editor/viewers with getEditors() or getViewers(). If you manually share a file you can see all email addresses as well.

So if you ask me, the privacy issue is a valuable argument, but it does simply not apply here.

Jan

Answer 3

Since this question was posted, Drive API has been updated to allow permissionId to be sent on permissions.insert() (the id attribute). This allows for migration of ACLs without ever needing to know the email addresses (just straight copy the permissionIds over to the new file).

Additionally:

• the permissions.getIdForEmail() API call provides a quick way to get the ID for a given email address

• when returning permissions for a file with permissions.get() or permissions.insert(), the domain attribute is included which should help determine if the ACL raises security concerns.

I believe these features cover most use cases where the actual ACL email address retrieval was needed.

Answer 4

Also resurrecting this old thread, I had the same issue while migrating documents.

A workaround:
- Create a temporary folder
- Insert a permission for the user 
- retrieve the id from the permission

Not nice, but works for me.