Understanding Permissions in GAS‐ICS‐Sync

Overview

The GAS-ICS-Sync project requires specific permissions to function correctly. This document explains why these permissions are requested, what they are used for, and how they may be restricted manually.

Requested Permissions and Their Uses

1. googleapis.com/auth/script.scriptapp

Why is this requested?

This permission allows the script to manage and deploy itself, including setting up triggers and running automatically.

What it allows the script to do:

• Setting up triggers for automatic synchronization.
• Managing script properties.

Read more about it:

1. Google Apps Script: ScriptApp

2. googleapis.com/auth/tasks

Why is this requested?

This permission allows the script to create, edit and delete tasks in Google Tasks.

What it allows the script to do:

• Creating and removing tasks in Google Tasks.
• Reading task lists.

Read more about it:

1. Google Tasks API
2. Tasks API Authorization Scopes

3. googleapis.com/auth/script.send_mail

Why is this requested?

This permission enables the script to send emails on behalf of the user.

What it allows the script to do:

• Sending notification emails about new updates.
• Automating email summaries about changes done to your calendar.

Read more about it:

1. Google Apps Script: MailApp

4. googleapis.com/auth/calendar

Why is this requested?

This permission allows the script to access and manage all calendars and events the user can access using Google Calendar.

What it allows the script to do:

• Reading, updating, and deleting events from your Google Calendar.
• Creating new events in your Google Calendar.
• Reading and creating calendars.

Read more about it:

1. Google Calendar API
2. Calendar API Authorization Scopes

5. googleapis.com/auth/script.external_request

Why is this requested?

This permission enables the script to make external HTTP requests.

What it allows the script to do:

• Fetching ICS files from external URLs.
• Checking for new releases on github.

Read more about it:

1. Google Apps Script: URL Fetch Service

Restricting Permissions Manually

Google Apps Script automatically detects the necessary OAuth scopes for the code to run based on the APIs and services used in the script. However, you can explicitly define or restrict these scopes if needed.

Modify OAuth Scopes in the Script:

You can edit the OAuth scopes directly in the appsscript.json configuration file of your project. Available Scopes can be found in Google's developer resources linked above.

{
  "timeZone": "GMT",
  "dependencies": {
    "enabledAdvancedServices": [
      {
        "userSymbol": "Tasks",
        "serviceId": "tasks",
        "version": "v1"
      },
      {
        "userSymbol": "Calendar",
        "serviceId": "calendar",
        "version": "v3"
      }
    ]
  },
  "oauthScopes": [
    "https://www.googleapis.com/auth/script.scriptapp",
    "https://www.googleapis.com/auth/tasks",
    "https://www.googleapis.com/auth/script.send_mail",
    "https://www.googleapis.com/auth/calendar",
    "https://www.googleapis.com/auth/script.external_request"
  ],
  "exceptionLogging": "STACKDRIVER",
  "runtimeVersion": "V8"
}

Read more about it:

1. Authorization Scopes - Setting explicit scopes

Review and Approve the New Permissions:

When you run the script after modifying the scopes, Google will prompt you to review and approve the new set of permissions.

Potential Impact of Restricting Permissions

Restricting permissions may cause the script to not work properly. Full functionality requires the permissions as originally requested. Adjusting these permissions should be done with caution and an understanding of the potential limitations on the script's capabilities.