IssueTracker

Description

We are building a mail client and wish to be able to access emails that the user has had delegated to them by another user. (not domain wide delegation).

The user has access to view/edit/delete emails via the gmail.com UI but when we try and access delegated emails authenticated as the user who has been delegated to using OAuth2 (login through our website) we receive a http 403 error with the message: Delegation denied for user@example.com.

This is not related due to this issue: https://issuetracker.google.com/issues/290567932 as we are not using service accounts and domain wide delegation. We are acting as a logged in user's google account.

This feels like unexpected behaviour as the user does have access when acting as the UI, so a auth2client with the required scopes should also have access, to have parity with the gmail ui.

Code

// get Oauth client
const oauth2Client = new google.auth.OAuth2(
		GOOGLE_CLIENT_ID,
		GOOGLE_CLIENT_SECRET,
		GOOGLE_REDIRECT_URL,
	);

	oauth2Client.setCredentials({
		access_token: accessToken,
		refresh_token: refreshToken,
		scope: GOOGLE_SCOPES.join(' ')
	});

// Get emails
const res = await oauth2Client.users.messages.list({
        userId: "another.user@example.com"
});

return new Response(JSON.stringify(res));

Output

GaxiosError: Delegation denied for user@example.com
    at Gaxios._request (.../node_modules/gaxios/build/src/gaxios.js:141:23)
    at process.processTicksAndRejections (node:internal/process/task_queues:95:5)
    at async OAuth2Client.requestAsync (.../node_modules/google-auth-library/build/src/auth/oauth2client.js:379:18)

code: 403,
  errors: [
    {
      message: 'Delegation denied for user@example.com',
      domain: 'global',
      reason: 'forbidden'
    }
  ]