Google Shared Drives and Permissions in Cloud Storage

Requirements: Cloud Storage

Google shared drives are drives that belong to an organization rather than to an individual user, so their files remain available even when members leave. Access to a shared drive is controlled by its members, while access to individual files and folders (in a shared drive or in a user's "My Drive") is controlled by permissions. This article covers how to use the GoogleDrive component in Cloud Storage to work with shared drives and their contents, manage shared drive members, and manage file and folder permissions.

Contents

• Authorization
• Listing Shared Drives
• Working with Files in a Shared Drive
• Creating and Managing Shared Drives
• Managing Shared Drive Members
• Managing File and Folder Permissions
• Using Domain Administrator Access

Authorization

The GoogleDrive component uses OAuth 2.0 for authorization. The simplest approach is to configure the built-in OAuth property and call the Authorize method. The component's default scope (https://www.googleapis.com/auth/drive) provides full access to the user's files and shared drives.

GoogleDrive googledrive = new GoogleDrive(); googledrive.OAuth.ClientProfile = CloudOAuthClientProfiles.cocpApplication; googledrive.OAuth.GrantType = OAuthSettingsGrantTypes.cogtAuthorizationCode; googledrive.OAuth.ClientId = "CLIENT_ID"; googledrive.OAuth.ClientSecret = "CLIENT_SECRET"; googledrive.Authorize();

For more information about OAuth authorization, please see our OAuth Authorization in /n software Cloud Products article.

Listing Shared Drives

The ListSharedDrives method lists the shared drives that the current user is a member of, and populates the SharedDrives collection. Each shared drive in the collection includes its Id, Name, CreatedTime, and Hidden status, as well as its Capabilities and Restrictions (described below). If there are more results than fit in a single page, the SharedDriveMarker property will be populated. Continue calling ListSharedDrives until SharedDriveMarker is empty to accumulate all pages of results in the SharedDrives collection.

do { googledrive.ListSharedDrives(); } while (!string.IsNullOrEmpty(googledrive.SharedDriveMarker)); foreach (GDriveSharedDrive drive in googledrive.SharedDrives) { Console.WriteLine(drive.Name + " (" + drive.Id + ")"); }

The GetSharedDriveInfo method retrieves information about a single shared drive by its ID.

Working with Files in a Shared Drive

For the most common operations, there is very little difference between working with files in a shared drive and working with files in a user's "My Drive". The ID of a shared drive is also the ID of its root folder, so it can be passed to methods that take a folder ID, such as ListChildren and CreateFolder.

string sharedDriveId = "SHARED_DRIVE_ID"; // List the contents of the shared drive's root folder. do { googledrive.ListChildren(sharedDriveId); } while (!string.IsNullOrEmpty(googledrive.ChildMarker)); foreach (GDriveResource resource in googledrive.Children) { Console.WriteLine(resource.Name); } // Create a folder in the root of the shared drive. string folderId = googledrive.CreateFolder("Reports", sharedDriveId);

To upload a file into a folder in the shared drive, specify the folder's ID in the ParentIds field of the first item in the Resources collection before calling UploadFile.

// Upload a file into the "Reports" folder. googledrive.Resources.Clear(); googledrive.Resources.Add(new GDriveResource()); googledrive.Resources[0].ParentIds = folderId; googledrive.LocalFile = "C:\\reports\\summary.pdf"; string fileId = googledrive.UploadFile("summary.pdf", "");

To list all of the files and folders in a shared drive (rather than only the children of a specific folder), set the ListResourcesScope property to lrsSharedDrive and the SharedDrive property to the ID of the shared drive before calling ListResources. To list items from the user's "My Drive", "Shared with me", and all of their shared drives at once, set ListResourcesScope to lrsAllDrives instead.

googledrive.ListResourcesScope = GoogleDriveListResourcesScopes.lrsSharedDrive; googledrive.SharedDrive = sharedDriveId; do { googledrive.ListResources(); } while (!string.IsNullOrEmpty(googledrive.ResourceMarker));

Resources in a shared drive include the ID of their shared drive in the SharedDriveId field. Note that a resource in a shared drive must always have exactly one parent folder, and that only members with the file organizer or organizer roles can move files and folders within a shared drive.

Creating and Managing Shared Drives

The CreateSharedDrive method creates a new shared drive and returns its ID. In addition to the name of the shared drive, the method takes a request ID, which is a unique value that the server uses to ensure that repeated requests with the same name and request ID do not create duplicate shared drives.

// Create a shared drive. The request ID should be unique for each new shared drive. string newDriveId = googledrive.CreateSharedDrive("Marketing", Guid.NewGuid().ToString());

The UpdateSharedDrive method renames a shared drive and/or changes its restrictions. To keep the current name, pass an empty string for the new name. Restrictions are set and unset using the following flags, which can be combined:

// Rename the shared drive, and restrict access to its members. googledrive.UpdateSharedDrive(newDriveId, "Marketing Team", 0x0008, 0); // Later, remove the restriction while keeping the current name. googledrive.UpdateSharedDrive(newDriveId, "", 0, 0x0008);

Whether the current user is allowed to rename a shared drive or change its restrictions depends on their capabilities, which are available in the Capabilities field of each item in the SharedDrives collection. For example, the 0x08000 flag indicates that the user can rename the shared drive, and the 0x01000 flag indicates that the user can manage its members. Refer to the component documentation for the full list of capability flags.

The ToggleSharedDriveHidden method hides or unhides a shared drive in the Google Drive user interface. This setting is tracked separately for each member, and a hidden shared drive is otherwise still accessible.

The DeleteSharedDrive method deletes a shared drive. Only members with the organizer role can delete a shared drive, and the shared drive must be empty (or all of its items must be in the trash).

Managing Shared Drive Members

The members of a shared drive are determined by the permissions on the shared drive itself. For the common case of modifying one member at a time, the AddSharedDriveMember, UpdateSharedDriveMember, and RemoveSharedDriveMember convenience methods can be used. AddSharedDriveMember returns the ID of the permission that it creates, which is used to identify the member in the other two methods.

The member's role is specified using one of the following values:

The member can be either a single user (ptUser) or a group (ptGroup), identified by their email address.

// Add a user to the shared drive as a writer. string permId = googledrive.AddSharedDriveMember(newDriveId, (int)GDrivePermissionRoles.prWriter, (int)GDrivePermissionTypes.ptUser, "user@example.com"); // Later, change the user's role to commenter. googledrive.UpdateSharedDriveMember(newDriveId, permId, (int)GDrivePermissionRoles.prCommenter); // Or remove the user from the shared drive entirely. googledrive.RemoveSharedDriveMember(newDriveId, permId);

To list the current members of a shared drive, call ListPermissions with the ID of the shared drive, as described in the next section.

Managing File and Folder Permissions

The ListPermissions method lists the permissions on a file, folder, or shared drive, and populates the Permissions collection. Each permission in the collection includes its Id, Role, GranteeType, and Email (or Domain, for domain permissions). If there are more results than fit in a single page, the PermissionMarker property will be populated. Continue calling ListPermissions until PermissionMarker is empty to accumulate all pages of results in the Permissions collection.

// List who has access to a file. do { googledrive.ListPermissions(fileId); } while (!string.IsNullOrEmpty(googledrive.PermissionMarker)); foreach (GDrivePermission perm in googledrive.Permissions) { Console.WriteLine(perm.Email + ": " + perm.Role); }

The UpdatePermissions method creates, updates, and deletes permissions on a file, folder, or shared drive. Each item in the Permissions collection has a ModOp field, which specifies the operation to perform for that permission when UpdatePermissions is called:

• moNone (0): No change.
• moCreate (1): Create the permission.
• moUpdate (2): Update the permission's role.
• moDelete (3): Delete the permission.

After each operation completes successfully, the component resets the permission's ModOp field to moNone. Before updating or deleting permissions, call ListPermissions to ensure that the collection reflects the resource's current permissions.

// Share a file with one user as a reader and another as a writer. googledrive.ListPermissions(fileId); googledrive.Permissions.Add(new GDrivePermission() { Email = "reader@example.com", GranteeType = GDrivePermissionTypes.ptUser, Role = GDrivePermissionRoles.prReader, ModOp = GDrivePermissionModOps.moCreate }); googledrive.Permissions.Add(new GDrivePermission() { Email = "writer@example.com", GranteeType = GDrivePermissionTypes.ptUser, Role = GDrivePermissionRoles.prWriter, ModOp = GDrivePermissionModOps.moCreate }); googledrive.UpdatePermissions(fileId);

// Later, change the reader to a commenter, and remove the writer. googledrive.ListPermissions(fileId); for (int i = 0; i < googledrive.Permissions.Count; i++) { if (googledrive.Permissions[i].Email == "reader@example.com") { googledrive.Permissions[i].Role = GDrivePermissionRoles.prCommenter; googledrive.Permissions[i].ModOp = GDrivePermissionModOps.moUpdate; } else if (googledrive.Permissions[i].Email == "writer@example.com") { googledrive.Permissions[i].ModOp = GDrivePermissionModOps.moDelete; } } googledrive.UpdatePermissions(fileId);

The component performs the operations one at a time. If an operation fails, the component returns an error indicating the index of the permission that caused it, and does not attempt the remaining operations.

In addition to users (ptUser) and groups (ptGroup), permissions on files and folders can be granted to everyone in a domain (ptDomain, with the Domain field set) or to anyone (ptAnyone). Only user and group permissions are valid on a shared drive itself.

To transfer ownership of a file or folder in a user's "My Drive", create or update a permission with the prOwner role. Since doing so downgrades the previous owner to the writer role, the TransferOwnership configuration setting must be set to true before calling UpdatePermissions. Ownership transfer does not apply to shared drives or the resources in them, since those are owned by the organization.

// Transfer ownership of a file to another user. googledrive.Config("TransferOwnership=true"); googledrive.ListPermissions(fileId); googledrive.Permissions.Add(new GDrivePermission() { Email = "newowner@example.com", GranteeType = GDrivePermissionTypes.ptUser, Role = GDrivePermissionRoles.prOwner, ModOp = GDrivePermissionModOps.moCreate }); googledrive.UpdatePermissions(fileId);

Using Domain Administrator Access

Google Workspace domain administrators can manage shared drives that they are not members of. When the UseDomainAdminAccess configuration setting is enabled, the component instructs the server to treat requests as being made by a domain administrator. This applies to listing and updating permissions, managing shared drive members, and listing, retrieving, and updating shared drives.

// As a domain administrator, add a user as an organizer of a shared drive that the administrator is not a member of. googledrive.Config("UseDomainAdminAccess=true"); googledrive.AddSharedDriveMember(sharedDriveId, (int)GDrivePermissionRoles.prOrganizer, (int)GDrivePermissionTypes.ptUser, "user@example.com");

Note that domain administrator access does not apply to deleting a shared drive, which always requires the current user to be a member with the organizer role.