Google Apps Script to add an alias to Gmail

Question

I have a Google Apps Script that gives me the error "Delegation denied for jasonjurotich@school.edu.mx", and is not working in order to add an alias (another email) to an account within a domain. It may be because of Token headers or some URL that is missing that authorizes something, but I cannot find enough documentation that clarifies how to add it.

This should not be confused with creating an alias in the Google Admin console for the same email. Rather, this is adding another separate account to the first account so as to send emails on behalf of the second account.

All the necessary permissions have been activated (OAuth2, a Google Service account with domain-wide delegation, necessary APIs are activated, etc.)

The script I have is the following:

var JSON = {
  "private_key": "key",
  "client_email": "email",
  "client_id": "ID",
  "user_email": "teststudent@school.edu.mx"
};

function getOAuthService(user) {
  return OAuth2.createService('Service Account')
    .setAuthorizationBaseUrl('https://accounts.google.com/o/oauth2/auth')
    .setTokenUrl('https://accounts.google.com/o/oauth2/token')
    .setClientId('ID')
    .setPrivateKey(JSON.private_key)
    .setIssuer(JSON.client_email)
    .setSubject(JSON.user_email)
    .setPropertyStore(PropertiesService.getScriptProperties())
    .setParam('access_type', 'offline')
    .setParam('approval_prompt', 'force')
    .setScope('https://www.googleapis.com/auth/script.external_request https://www.googleapis.com/auth/gmail.settings.sharing');
}

function changeEmail() {
  var service = getOAuthService();
  service.reset();
  if (service.hasAccess()) {
    var userEmail = 'teststudent@school.edu.mx';   

    var alias = {
      sendAsEmail: 'aliastest1@school.edu.mx',
      displayName: 'TS',
      replyToAddress : 'aliastest1@school.edu.mx',
      treatAsAlias: true
    };

    Gmail.Users.Settings.SendAs.create(alias, userEmail);      
  }
}

Answer 1

It seems that you are using the older version of OAuth2 library for Google Apps Script. Please check the source code and make sure it doesn't invoke ScriptApp.getProjectKey(). For example, the version below utilizes ScriptApp.getScriptId() instead of the deprecated method:

https://github.com/gsuitedevs/apps-script-oauth2/blob/master/dist/OAuth2.gs

Try connecting the new version to your GAS project as a library or manually add the files to your script and see if that fixes things.

UPDATE

I believe what happens is that you override a permissive authorization scope with a more restrictive one. Looking at the source code of the 'setScope()' method, it doesn't look like you can call it in succession.

Service_.prototype.setScope = function(scope, optSeparator) {
  var separator = optSeparator || ' ';
  this.params_.scope = Array.isArray(scope) ? scope.join(separator) : scope;
  return this;
};

Rather, you must provide the list of scopes and the optional separator (the default one is space). As a result, the only authorization scope your script ends up using is https://www.googleapis.com/auth/gmail.settings.basic. Bottom line: call 'setScope()' once, passing the space-separated list of required scopes. Instead of 2 separate calls, try this:

setScope('https://www.googleapis.com/auth/gmail.settings.basic https://www.googleapis.com/auth/gmail.settings.sharing');

Answer 2

A colleague of mine posted something similar to this question here: Creates a custom "from" send-as alias with GAS and APIs. The following modified code is what finally worked taking into account what was put here and what they put there.

var service_account = {
"private_key": "-----BEGIN PRIVATE KEY-----",
"client_email": "changealiastest4@project-id-[].iam.gserviceaccount.com",
"client_id": "ID",
"user_email": "teststudent@school.edu.mx"
};

function getOAuthService(user) {
  return OAuth2.createService('Service Account')
    .setAuthorizationBaseUrl('https://accounts.google.com/o/oauth2/auth')
    .setTokenUrl('https://accounts.google.com/o/oauth2/token')
    .setClientId('ID')
    .setPrivateKey(service_account.private_key)
    .setIssuer(service_account.client_email)
    .setSubject(service_account.user_email)
    .setPropertyStore(PropertiesService.getScriptProperties())
    .setParam('access_type', 'offline')
    .setParam('approval_prompt', 'force')
    .setScope('https://www.googleapis.com/auth/script.external_request https://www.googleapis.com/auth/gmail.settings.sharing https://www.googleapis.com/auth/gmail.settings.basic');
}

function changeEmail() {
  var userEmail = 'teststudent@school.edu.mx'; 
  var aliasEmail = 'aliastest1@school.edu.mx';
  var aliasName = 'TS';

  var service = getOAuthService();
    service.reset();
    if (service.hasAccess()) {

  var url = 'https://www.googleapis.com/gmail/v1/users/me/settings/sendAs'
    var headers ={
      "Authorization": 'Bearer ' + service.getAccessToken(),
      "Accept":"application/json", 
      "Content-Type":"application/json",
      };

  var resource ={
     sendAsEmail: aliasEmail,
     displayName: aliasName,
     replyToAddress : aliasEmail,
     treatAsAlias: true,
     verificationStatus: 'accepted'
   };  

  var options = {
  'headers': headers,
  'method': 'POST',
  'payload': JSON.stringify(resource),
  'muteHttpExceptions': true
  };

Logger.log(options);
var response = UrlFetchApp.fetch(url, options);
Logger.log(response.getContentText()); 

  }
}