Google Cloud Datastore / Mobile Backend Starter - Permissions Failure On Update/updateall Calls

Using the Mobile Backend Starter (MBS) Android classes (those distributed as a sample project when creating a new project in Google Dev Console and demoed at Google I/O 2013) I'm a

Solution 1:

I've faced the similar error "Insuffient permission for updating a CloudEntity" when using cloudBackendAsync.update(cloudEntity). I resolved it by making sure the cloudEntity has it's createdAt field set. createdAt is autogenerated and I think I am not supposed to touch it. But it worked for me. In my case I am first obtaining list of cloud entities. This is when I get createdAt field of cloud entities. Then when I am updating I setting the createdAt field from previously obtained entities. Edit: Had to do similar thing for owner field also.

Solution 2:

Similar to one of the comments above, I successfully got around this by getting the original CloudEntity before doing the insert/update/delete function.

    CloudQuery cq = new CloudQuery("datastoretype");
    cq.setLimit(1);
    cq.setFilter(Filter.eq("_id",id));

    cloudEntity.setId(id);
    mProcessingFragment.getCloudBackend().get(cloudEntity, handler);

Thereafter it was trivial to do the following:

    mProcessingFragment.getCloudBackend().update(cloudEntity, handler);

The docs definitely ought to be more clear on this, whether it is a strict requirement or bug.

Solution 3:

The answers posted so far work around the problem if you don't mind all users being able to access the entity you are trying to update. However, a better solution that retains the access permissions is detailed by google here - https://cloud.google.com/cloud/samples/mbs/authentication

If you want to pass the user’s Google Account info to the backend on each call, use the CloudBackend#setCredential() method (also available on the subclasses, CloudBackendAsync and CloudBackendMessaging) to set a GoogleAccountCredential object before calling any Mobile Backend methods.

GoogleAccountCredentialcredential= GoogleAccountCredential.usingAudience(this, "<Web Client ID>");
credential.setSelectedAccountName("<Google Account Name>");
cloudBackend.setCredential(credential);

Setting credientials enables the client to operate when the backend is in “Secured by Client ID” mode and also sets createdBy/updatedBy/owner properties of CloudEntity automatically.