`DW-Agents/dw-agents/GOOGLE-DRIVE-FIX-SUMMARY.md`

178 lines
# 🔧 Google Drive File Access - Fix Summary

## 📊 Current Status

**Problem:** Google Drive files are **NOT showing up** next to SKUs in the digital samples dashboard

**Root Cause:** OAuth refresh token lacks Google Drive API scopes

**Error:** `Request had insufficient authentication scopes`

**Test Results:**
```
❌ Service Account: NOT CONFIGURED
❌ OAuth: CONFIGURED BUT FAILING (missing scopes)
```

---

## 🎯 Three Solutions Available

### ✅ **OPTION 1: Quick OAuth Fix (5 minutes)**

**Best for:** Getting it working quickly right now

**Steps:**
```bash
cd /root/DW-Agents
npx tsx setup-google-drive-auth.ts
```

1. Script will show you a Google authorization URL
2. Open it in your browser
3. Sign in and authorize
4. Copy the code from redirect URL
5. Paste into terminal
6. Copy new `GOOGLE_REFRESH_TOKEN` to `.env`
7. Restart: `pm2 restart dw-digital-samples`

**Tools Created:**
- `/root/DW-Agents/setup-google-drive-auth.ts` ← Run this
- Automatically requests correct Drive scopes
- Tests access after setup

---

### 🔐 **OPTION 2: Service Account (15 minutes)**

**Best for:** Long-term reliability, production use

**Why better:**
- Never expires (OAuth tokens can expire)
- More secure for server-to-server
- No manual re-authorization needed
- Industry best practice

**Steps:**
1. Go to https://console.cloud.google.com/
2. Navigate to "IAM & Admin" > "Service Accounts"
3. Click "Create Service Account"
4. Name it `dw-digital-samples-drive`
5. Create and download JSON key
6. Save as: `/root/DW-Agents/google-drive-service-account.json`
7. Share your Google Drive folder with the service account email
8. Restart: `pm2 restart dw-digital-samples`

**Tools Created:**
- `/root/DW-Agents/google-drive-service-account-example.ts` ← Implementation code
- Auto-detects service account and uses it
- Falls back to OAuth if service account not found

---

### 🔧 **OPTION 3: Fix Existing OAuth (10 minutes)**

**Best for:** If you want to keep current setup but fix scopes

**Steps:**
1. Go to https://console.cloud.google.com/apis/credentials
2. Find OAuth Client ID: `691474590551-a3bm0ckfoi7lnc0hk0vbuqhkcsv9pru7`
3. Verify these APIs are enabled in the project:
   - Google Drive API
4. Run regeneration script:
   ```bash
   cd /root/DW-Agents
   npx tsx setup-google-drive-auth.ts
   ```
5. Update `.env` with new token
6. Restart service

---

## 🧪 Testing

### Test current status:
```bash
cd /root/DW-Agents
npx tsx test-google-drive-access.ts
```

### Test API endpoint:
```bash
curl -s http://45.61.58.125:9879/api/drive/search?query=DIG | jq '.'
```

**Expected when working:**
```json
{
  "success": true,
  "files": [
    {
      "id": "...",
      "name": "DIG-12345-Sample.jpg",
      "mimeType": "image/jpeg",
      "size": "1234567"
    }
  ],
  "total": 5
}
```

**Current broken state:**
```json
{
  "success": true,
  "files": [],
  "total": 0
}
```

---

## 📁 Files Created for You

| File | Purpose |
|------|---------|
| `setup-google-drive-auth.ts` | OAuth token generator with Drive scopes |
| `test-google-drive-access.ts` | Test all auth methods and diagnose issues |
| `google-drive-service-account-example.ts` | Service account implementation |
| `GOOGLE-DRIVE-SETUP.md` | Detailed step-by-step instructions |
| `GOOGLE-DRIVE-FIX-SUMMARY.md` | This summary document |

---

## 🎬 Recommended Action Plan

**For immediate fix:**
1. Run `npx tsx setup-google-drive-auth.ts`
2. Follow prompts to get new OAuth token
3. Update `.env`
4. Restart service
5. Test: `curl http://45.61.58.125:9879/api/drive/search?query=DIG`

**For long-term solution:**
1. Create service account in Google Cloud Console
2. Download JSON key to `/root/DW-Agents/google-drive-service-account.json`
3. Share Drive folder with service account email
4. Service will auto-detect and use it
5. Much more reliable!

---

## 💡 Why This Happened

The original OAuth token was created with limited scopes (probably just Gmail). When the digital-samples-agent was built, it needed Drive access, but the token didn't have those permissions.

**Original scopes:** Gmail only
**Needed scopes:** Gmail + Drive read access

This is common when reusing OAuth tokens across different services.

---

## ✅ Next Steps

Choose your option above and follow the steps. All tools are ready to use!

**Need help?** All scripts have built-in instructions and error messages.