如何處理精細的權限

const client = google.accounts.oauth2.initTokenClient({   client_id: 'YOUR_CLIENT_ID',   scope: 'https://www.googleapis.com/auth/calendar.readonly \   https://www.googleapis.com/auth/contacts.readonly',   callback: (response) => {     ...   }, });

import google.oauth2.credentials import google_auth_oauthlib.flow  # Use the client_secret.json file to identify the application requesting # authorization. The client ID (from that file) and access scopes are required. flow = google_auth_oauthlib.flow.Flow.from_client_secrets_file(     'client_secret.json',     scopes=['https://www.googleapis.com/auth/calendar.readonly',                     'https://www.googleapis.com/auth/contacts.readonly'])

const {google} = require('googleapis');  /**   * To use OAuth2 authentication, we need access to a CLIENT_ID, CLIENT_SECRET, AND REDIRECT_URI   * from the client_secret.json file. To get these credentials for your application, visit   * https://console.cloud.google.com/apis/credentials.   */ const oauth2Client = new google.auth.OAuth2(   YOUR_CLIENT_ID,   YOUR_CLIENT_SECRET,   YOUR_REDIRECT_URL );  // Access scopes for read-only Calendar and Contacts. const scopes = [   'https://www.googleapis.com/auth/calendar.readonly',   'https://www.googleapis.com/auth/contacts.readonly'] ];  // Generate a url that asks permissions const authorizationUrl = oauth2Client.generateAuthUrl({   // 'online' (default) or 'offline' (gets refresh_token)   access_type: 'offline',   /** Pass in the scopes array defined above.     * Alternatively, if only one scope is needed, you can pass a scope URL as a string */   scope: scopes,   // Enable incremental authorization. Recommended as best practices.   include_granted_scopes: true });

... document.querySelector('button').addEventListener('click', function () {   chrome.identity.getAuthToken({ interactive: true },       function (token) {           if (token === undefined) {             // User didn't authorize both scopes.             // Updating the UX and application accordingly             ...           } else {             // User authorized both or one of the scopes.             // It neglects to check which scopes users granted and assumes users granted all scopes.              // Calling the APIs, etc.             ...           }       }); });

... document.querySelector('button').addEventListener('click', function () {   chrome.identity.getAuthToken({ interactive: true, enableGranularPermissions: true },       function (token, grantedScopes) {           if (token === undefined) {             // User didn't authorize any scope.             // Updating the UX and application accordingly             ...           } else {             // User authorized the request. Now, check which scopes were granted.             if (grantedScopes.includes('https://www.googleapis.com/auth/calendar.readonly'))             {               // User authorized Calendar read permission.               // Calling the APIs, etc.               ...             }             else             {               // User didn't authorize Calendar read permission.               // Update UX and application accordingly               ...             }              if (grantedScopes.includes('https://www.googleapis.com/auth/contacts.readonly'))             {               // User authorized Contacts read permission.               // Calling the APIs, etc.               ...             }             else             {               // User didn't authorize Contacts read permission.               // Update UX and application accordingly               ...             }           }       }); });

... const oauth2Client = new google.auth.OAuth2(   YOUR_CLIENT_ID,   YOUR_CLIENT_SECRET,   YOUR_REDIRECT_URL );  // Access scopes for two non-Sign-In scopes - Google Calendar and Contacts const scopes = [   'https://www.googleapis.com/auth/contacts.readonly',   'https://www.googleapis.com/auth/calendar.readonly' ];  // Generate a url that asks permissions for the Google Calendar and Contacts scopes const authorizationUrl = oauth2Client.generateAuthUrl({   // 'online' (default) or 'offline' (gets refresh_token)   access_type: 'offline',   // Pass in the scopes array defined above   scope: scopes,   // Enable incremental authorization. Recommended as best practices.   include_granted_scopes: true });  async function main() {   const server = http.createServer(async function (req, res) {     // Example on redirecting user to Google OAuth 2.0 server.     if (req.url == '/') {       res.writeHead(301, { "Location": authorizationUrl });     }     // Receive the callback from Google OAuth 2.0 server.     if (req.url.startsWith('/oauth2callback')) {       // Handle the Google OAuth 2.0 server response       let q = url.parse(req.url, true).query;        if (q.error) {         // User didn't authorize both scopes.         // Updating the UX and application accordingly         ...       } else {         // User authorized both or one of the scopes.         // It neglects to check which scopes users granted and assumes users granted all scopes.          // Get access and refresh tokens (if access_type is offline)         let { tokens } = await oauth2Client.getToken(q.code);         // Calling the APIs, etc.         ...       }     }     res.end();   }).listen(80); }

... const oauth2Client = new google.auth.OAuth2(   YOUR_CLIENT_ID,   YOUR_CLIENT_SECRET,   YOUR_REDIRECT_URL );  // Access scopes for two non-Sign-In scopes - Google Calendar and Contacts const scopes = [   'https://www.googleapis.com/auth/contacts.readonly',   'https://www.googleapis.com/auth/calendar.readonly' ];  // Generate a url that asks permissions for the Google Calendar and Contacts scopes const authorizationUrl = oauth2Client.generateAuthUrl({   // 'online' (default) or 'offline' (gets refresh_token)   access_type: 'offline',   // Pass in the scopes array defined above   scope: scopes,   // Enable incremental authorization. Recommended as best practices.   include_granted_scopes: true,   // Set to true to enable more granular permissions for Google OAuth 2.0 client IDs created before 2019.   // No effect for newer Google OAuth 2.0 client IDs, since more granular permissions is always enabled for them.   enable_granular_consent: true });  async function main() {   const server = http.createServer(async function (req, res) {     // Redirect users to Google OAuth 2.0 server.     if (req.url == '/') {       res.writeHead(301, { "Location": authorizationUrl });     }     // Receive the callback from Google OAuth 2.0 server.     if (req.url.startsWith('/oauth2callback')) {       // Handle the Google OAuth 2.0 server response       let q = url.parse(req.url, true).query;        if (q.error) {         // User didn't authorize both scopes.         // Updating the UX and application accordingly         ...       } else {         // Get access and refresh tokens (if access_type is offline)         let { tokens } = await oauth2Client.getToken(q.code);         oauth2Client.setCredentials(tokens);          // User authorized the request. Now, check which scopes were granted.         if (tokens.scope.includes('https://www.googleapis.com/auth/calendar.readonly'))         {           // User authorized Calendar read permission.           // Calling the APIs, etc.           ...         }         else         {           // User didn't authorize Calendar read permission.           // Calling the APIs, etc.           ...         }          // Check which scopes user granted the permission to application         if (tokens.scope.includes('https://www.googleapis.com/auth/contacts.readonly'))         {           // User authorized Contacts read permission.           // Calling the APIs, etc.           ...         }         else         {           // User didn't authorize Contacts read permission.           // Update UX and application accordingly           ...         }       }     }     res.end();   }).listen(80); }