Google Drive integration

google_drive syncs the checked Google Drive folders, shared drives and files into the knowledge base, with scheduling, incremental runs, resume and deletion reconciliation. Google Docs, Sheets and Slides are imported as Word, Excel and PowerPoint. General flow: Data source import.

Create the service account (once)

The connector signs in as a Google Cloud service account, read-only (drive.readonly), with no sign-in window.

1. console.cloud.google.com → pick or create a project.
2. APIs & Services → Library → enable Google Drive API.
3. IAM & Admin → Service accounts → Create service account (no project role needed).
4. On the new account: Keys → Add key → Create new key → JSON. The downloaded file is the key to paste into GsKnora. Keep it safe.

If the organization blocks key creation (iam.disableServiceAccountKeyCreation), a Google Cloud admin must allow it for this project.

Grant access to documents

The service account has its own address, such as name@project.iam.gserviceaccount.com (client_email in the JSON file). It only sees what is shared with it:

• a folder: Share → add the address as Viewer;
• a shared drive (Google Workspace): Manage members → add the address as Viewer.

Workspace option: act on behalf of a person. If the Workspace admin grants domain-wide delegation to the service account (Admin console → Security → Access and data control → API controls → Domain-wide delegation, scope https://www.googleapis.com/auth/drive.readonly), enter a user's address in "Act on behalf of": the connector then reads that person's Drive without sharing. Use a dedicated account.

Setup in the knowledge base

1. Knowledge base settings → Data sources → New, "Google Drive".
2. Paste the whole JSON file, optionally the "Act on behalf of" address, then test the connection. The test gets a token and reads the account: it fails on a revoked key or a disabled Drive API.
3. Check shared drives, folders or files. The first level lists shared drives, then items shared with the service account; folders open lazily. One source can hold several items.
4. Pick the mode, schedule, conflict strategy and deletion sync, save, then run a manual sync to check.

Only importable files are offered (PDF, Office, text, images…) plus Docs, Sheets and Slides. Forms, drawings, Google Sites and shortcuts are skipped.

What a sync does

• Each file is identified by its Drive ID: renaming or moving it inside the selection does not re-import it.
• An unchanged file (same version, modification time and checksum) is not downloaded again; a changed file is re-imported.
• A file deleted, trashed, no longer shared or moved out of the selection is removed when deletion sync is on.
• If a checked item is no longer reachable, the sync stops without deleting anything and reports it.
• Files are stored as <checked item name>/<path>.
• Google caps Docs, Sheets and Slides exports at 10 MB: larger ones show as errors in the sync history.

Network and security

Request	Target	Token
Token	oauth2.googleapis.com	Assertion signed with the service account key
API, download and export	www.googleapis.com	Yes, Authorization: Bearer

Google endpoints are fixed: the token_uri field of the JSON file is ignored so a tampered key cannot send the assertion elsewhere. The key is encrypted at rest like other data source credentials.

Implementation reference

Package internal/datasource/connector/gdrive: client.go (RS256 JWT assertion, Drive v3 calls with retries on 429/5xx and Retry-After, new token on 401), connector.go (test, tree, ancestors), sync.go (breadth-first walk, download or export, deletion reconciliation), cursor.go (fingerprint per file ID). Resource IDs: Drive IDs.