Creating a Google App Script web app to upload files to google drive with minimum scope

Question

I want to create a Google App Script web app to allow users to upload files to a folder of my google drive.

The problem is that I've checked the drive scope list here,

in order to perform the upload action , this scope must be reviewed by the users

https://www.googleapis.com/auth/drive

and it comes with a scary description See, edit, create and delete all of your Google Drive files which is way too strong.

Is there any way to perform the upload action with a less stronger scope?

Thank you so much.

Answer 1

In your situation, for example, how about the following scope?

https://www.googleapis.com/auth/drive.file

The official document says as follows. Ref

Per-file access to files created or opened by the app. File authorization is granted on a per-user basis and is revoked when the user deauthorizes the app.

In this scope, only the files and folders created by this application can be accessed.

Reference:

• Authenticate your users

Added:

From your following replying,

Thank you for replying too, I have an update. When I run the code in the editor , it throws an error : ' { [Exception: You do not have permission to call DriveApp.Folder.createFile. Required permissions: googleapis.com/auth/drive] name: 'Exception' }' So I guess there is no solution to my problem T.T

I understood that you are using createFile with the Drive service (DriveApp). In this case, the scope of https://www.googleapis.com/auth/drive is requierd to be used. It seems that this is the current specification. In order to use the scope of https://www.googleapis.com/auth/drive.file, how about using Drive API at Advanced Google services? By this, you can use the scope by setting to appsscript.json which is the manifest file.

At first, please add https://www.googleapis.com/auth/drive.file as "oauthScopes": ["https://www.googleapis.com/auth/drive.file"] to the manifest file of appsscript.json. Ref

Although I'm not sure about your actual script, the sample script for creating a Spreadsheet is as follows.

Sample script:

Before you use this script, please enable Drive API at Advanced Google services.

function myFunction() {
  const obj = Drive.Files.insert({title: "sampleSpreadsheet", mimeType: MimeType.GOOGLE_SHEETS, parents: [{id: "###folderId###"}]});
  console.log(obj.id)
}

• When you run this script, new Spreadsheet is created to folderId by the scope of https://www.googleapis.com/auth/drive.file.

Note:

• If you are required to use other scopes, please add them to oauthScopes.

References:

• Manifests
• Manifest structure
• Related thread.
  • Can I use DocumentApp.openById() with read only permission?