Error: 7 PERMISSION_DENIED: Missing or insufficient permissions. at Object.exports.createStatusError about express-oauth2-handlers

[timalanfarrow]

I actually already resolved this problem, but wanted to document it here for future devs. The following solution was derived from the answers in this stack overflow thread

It is important to understand that this error is actually being thrown by Google Cloud Datastore, and not by any OAuth related service. In order to resolve it, you must ensure that the permissions of the account running your Google Cloud Function include the scopes necessary to access Google Cloud Datastore. Follow these steps:

1. Determine the service account responsible for calling your Google Cloud Function.
   • Navigate to your function in the Google Cloud Console and click Edit.
   • Expand Runtime, build, connections, and security settings.
   • You will see a subsection called Runtime service account. Expand the dropdown and make note of the selected id written beneath the account title. If you haven't changed it, it is likely that it will be the App Engine default service account whose id looks like [email protected].
2. Add the necessary permissions to your project IAM.
   • In the Google Cloud Console left panel, navigate to IAM & Admin > IAM (Important: do not go to the Service Accounts, tab).
   • Locate the service account from step one in the table and click the pencil icon on the far right to edit that row.
     • Some developers report that the service account does not appear in the table. In this case, you can safely add the the service account to your IAM.
       • Click Add and use the id from step one as the new principal.
       • Select the roles from the next step and click Save.
   • You must ensure that this account has the following roles:
     • Editor (I thought this was surely an over assignment of permissions but I can't get the function to work without it.)
     • Cloud Datastore Owner
     • Storage Admin
   • Click Save.
3. Redeploy your Google Cloud Functions.

If you follow the above steps, your issue should be resolved.

Note: Some developers have reported that after following these steps their functions continued to fail until they were deleted from the Google Cloud Functions console and redeployed.