Failed to authenticate GDrive: "This app is blocked"

Description

When I use DVC commands with a gdrive remote storage configuration, I encounter an issue where it's impossible to authenticate with my Google account.

Reproduce

After initiating the command

dvc get https://github.com/my-data-registry data/samples

a browser window opens for authentication, but upon selecting my Google account, I'm directed to a page displaying the message:

This app is blocked

This app tried to access sensitive info in your Google Account. To keep your account safe, Google blocked this access.

Environment information

Output of dvc doctor:

$ dvc doctor

Platform: Python 3.11.6 on macOS-13.5-arm64-arm-64bit
Subprojects:
    dvc_data = 3.15.2
    dvc_objects = 5.1.0
    dvc_render = 1.0.2
    dvc_task = 0.4.0
    scmrepo = 3.3.7
Supports:
    gdrive (pydrive2 = 1.20.0),
    http (aiohttp = 3.10.2, aiohttp-retry = 2.8.3),
    https (aiohttp = 3.10.2, aiohttp-retry = 2.8.3)
Config:
    Global: /Users/myself/Library/Application Support/dvc
    System: /Library/Application Support/dvc

I'm not sure if this is a bug, but any help with this issue would be greatly appreciated!

fabricionarcizo commented 1 month ago

I have precisely the same issue.

JohnConnor123 commented 1 month ago

Same problem

shcheklein commented 1 month ago

TL;DR:

The DVC app (that is used by default by DVC) is blocked by Google because they changed some policies and we need pass the verifications again. There was nothing bad happening (like security breaches or violations) on our end. There is not easy way to pass it. For now the recommended way (and it was always the recommended way) - is to create a custom app. Here is the link. It's not very complicated and should work just fine for everyone.

Longer version

Tue, Nov 14, 2023 - Google reached out with this message:

As part of our commitment to user privacy and security, Google requires developers that use our APIs to demonstrate that their apps comply with our policies. We have identified that your app’s use of Restricted Drive API scopes may require additional verification steps.

DVC app indeed depends on the drive.files OAuth scope (that gives the full access to all the files / directories in the Google Drive). Since we don't know in advance which directory users would need to use a remote storage + for things like dvc import-url, dvc import (if a different remote is used).

all the tokens are stored locally, we don't use any servers, DVC team doesn't see them, etc. It is safe enough to our mind for the default mode, it's better of course to use the custom app otherwise as mentioned above.

Anyways, it would be better to have a more granular permissions. And it seems Google understand this, we also like it. The only issue is that there is no API or any way to let users pick a specific dir in CLI. Here is the relevant ticket for this. But it's not resolved yet.

So, we kinda stuck in limbo with this a bit - we can't pass verification (since they are requesting a video explainer where it's clear why we need drive.file), and we can't implement a granular scope management for the default app atm.

I'm open to any ideas on this.

Also a relevant discussion on the rclone forum - https://forum.rclone.org/t/google-drive-builtin-app-verification/43919/5 .

psaboia commented 1 month ago

@shcheklein, thank you for the clarification! We will proceed with the custom app option.