node.js - Google Cloud Storage 返回错误的身份

Question

在我的本地计算机上，我一直在使用不同的帐户等处理两个不同的项目，因此这些项目都不相关。

假设这两个项目有以下电子邮件:

first-project@gmail.comSecond-project@gmail.com

对于第二个项目(second-project@gmail.com)，我使用nodejs创建了一个API，其中我有一个上传文件的端点，所以我尝试使用postman(我的nodejs上的配置)将文件上传到存储桶端点具有 secondary-project@gmail.com 帐户的项目 ID，并且还具有 secondary-project@gmail.com 上存在的存储桶名称，这是我的上传文件的代码:

const GCStorage = require('@google-cloud/storage');
const Multer = require('multer');

const CLOUD_BUCKET = 'mybucketname';

const storage = new GCStorage.Storage({
  projectId: '1234657890'
});
const bucket = storage.bucket(CLOUD_BUCKET);

// Returns the public, anonymously accessable URL to a given Cloud Storage
// object.
// The object's ACL has to be set to public read.
// [START public_url]
function getPublicUrl(filename) {
  return `https://storage.googleapis.com/${CLOUD_BUCKET}/${filename}`;
}
// [END public_url]

// Express middleware that will automatically pass uploads to Cloud Storage.
// req.file is processed and will have two new properties:
// * ``cloudStorageObject`` the object name in cloud storage.
// * ``cloudStoragePublicUrl`` the public url to the object.
// [START process]
function sendUploadToGCS(req, res, next) {
  if (!req.file) {
    return next();
  }

  const gcsname = Date.now() + req.file.originalname;
  const file = bucket.file(gcsname);

  const stream = file.createWriteStream({
    metadata: {
      contentType: req.file.mimetype
    },
    resumable: false
  });

  stream.on('error', err => {
    req.file.cloudStorageError = err;
    next(err);
  });

  stream.on('finish', () => {
    req.file.cloudStorageObject = gcsname;
    file.makePublic().then(() => {
      req.file.cloudStoragePublicUrl = getPublicUrl(gcsname);
      next();
    });
  });

  stream.end(req.file.buffer);
}
// [END process]

// Multer handles parsing multipart/form-data requests.
// This instance is configured to store images in memory.
// This makes it straightforward to upload to Cloud Storage.
// [START multer]
const multer = Multer({
  storage: Multer.MemoryStorage,
  limits: {
    fileSize: 5 * 1024 * 1024 // no larger than 5mb
  }
});
// [END multer]

module.exports = {
  getPublicUrl,
  sendUploadToGCS,
  multer
};

但我收到以下错误:

{
      domain: 'global',
      reason: 'forbidden',
      message: 'first-project@gmail.com does not have storage.objects.create access to mybucketname/1578598638283DeveloperInPixelsLogo1.png.'
    }

正如您所看到的，该消息包含first-project@gmail.com的电子邮件地址，但这是不同的项目和帐户，所以我无法理解这里发生了什么，请提供帮助

Answer 1

您正在创建的存储对象是using Application Default Credentials (ADCs) ;它可能正在从您的第一个项目加载服务帐户的凭据。

如果您想始终使用第二个项目的服务帐户的凭据，则应该 ensure your environment is configured correctly ，或使用存储 constructor that allows passing in explicit credentials ，而不是尝试从默认源加载它们。