Haupz Blog

GAM FTW

I want to sing some praise for GAM. This is a command line power tool for messing around in Google Drive (and then some).

A while back, I had been facing a bit of a tough time when all of a sudden files I had inherited appeared in my Google Drive root instead of in a dedicated folder with the original owner’s e-mail address as its name. Several thousands of folders and files made my Google Drive practically unusable. Moving everything away manually was not an option. Cream on top, a subset of these files (still thousands strong) were shared externally, which needed to be revoked.

GAM helped considerably, and saved me a lot of time. All in all, I spent about a day’s worth of time figuring it all out, but doing this manually would still have taken me longer.

Setting up GAM is a bit involved, and requires a lot of dancing around in the Google Admin Console, creating projects and assigning permissions. My wonderful internal IT team helped me with that, as proper super-admin rights are required for the setup. That makes GAM less than perfectly convenient: you can’t just download and start using it.

After that, I was working with a list of all the IDs of the files I had inherited, neatly assembled in a CSV file. I first had to reduce this list to the IDs of those in my Drive root. I used GAM to get a list of all file and folder IDs in the Drive root, and then some Unix command line magic to filter those that were inherited into another CSV file. Moving these to a dedicated folder was a one-liner using GAM:

gam \
    csv files_in_root.csv \
    fields "fileID" \
    showcmds \
    gam user <my_user_id> \
    update drivefile "~fileID" parentid <my_foleder_id>

That’s a mouthful. The gam csv command processes a CSV file line by line, and applies a degree of parallelism to save time. This is all automated, and works flawlessly. The fields "fileID" bit is because the CSV file is just a sequence of IDs, without a header row. The showcmds part makes the individual commands show up on the console.

The second part, starting with gam user, is the function applied to each line in the CSV file; update drivefile ... parentid is GAM’s way of saying “move this file to that folder”.

Running this took about 20 minutes.

Next, I had to unshare the inherited files, but not all of them: files shared with the mothership company should remain in that state. This I did in two steps. First, I obtained the ACLs of all inherited files, and stored them in a CSV file:

gam \
    redirect csv ./acl-collection.csv \
    multiprocess csv all_inherited_files.csv \
    fields "fileID" \
    showcmds \
    gam user <my_user_id> \
    print drivefileacls "~fileID" oneitemperrow

Again, it’s a mouthful, but in the end, acl-collection.csv contains all inherited files’ ACLs, one entry per row. Unsharing everything not shared inside my company or with the mothership goes like this:

gam \
    config csv_input_row_drop_filter
    "permission.domain:regex:(mycompany.com)|(mothership.com)" \
    csv ./acl-collection.csv \
    gam user <my_user_id> \
    delete drivefileacl "~id" "id:~~permission.id~~"

The first part instructs GAM to drop all rows from the ACL collection that indicate sharing with domains belonging to my company or the mothership. The remaining lines are then processed by deleting the respective ACL entries.

It took about 120 minutes to process all 23,000 inherited files like that.

Only one file was erroneously unshared, and was quickly added back.

I celebrate the power of the command line.

Tags: hacking