Nano Banana Pro Vertex AI Permission Denied 完全解决指南【2025年12月】

# 初始化 gcloud（如果尚未完成）
gcloud init

# 为用户账号添加 Vertex AI User 角色
gcloud projects add-iam-policy-binding YOUR_PROJECT_ID \
  --member="user:your-email@example.com" \
  --role="roles/aiplatform.user"

# 或者为服务账号添加角色
gcloud projects add-iam-policy-binding YOUR_PROJECT_ID \
  --member="serviceAccount:your-sa@YOUR_PROJECT_ID.iam.gserviceaccount.com" \
  --role="roles/aiplatform.user"

# 创建服务账号
gcloud iam service-accounts create nano-banana-sa \
  --display-name="Nano Banana Pro Service Account"

# 授予 Vertex AI User 权限
gcloud projects add-iam-policy-binding YOUR_PROJECT_ID \
  --member="serviceAccount:nano-banana-sa@YOUR_PROJECT_ID.iam.gserviceaccount.com" \
  --role="roles/aiplatform.user"

# 下载密钥文件
gcloud iam service-accounts keys create ~/nano-banana-key.json \
  --iam-account=nano-banana-sa@YOUR_PROJECT_ID.iam.gserviceaccount.com

# 方法 1：设置环境变量（推荐用于生产环境）
export GOOGLE_APPLICATION_CREDENTIALS="$HOME/nano-banana-key.json"

# 方法 2：使用 gcloud 登录（推荐用于开发环境）
gcloud auth application-default login

# 方法 3：使用服务账号模拟（支持 Go、Java、Node.js、Python）
gcloud auth application-default login \
  --impersonate-service-account=nano-banana-sa@YOUR_PROJECT_ID.iam.gserviceaccount.com

# 检查当前认证状态
gcloud auth list

# 检查 ADC 配置
gcloud auth application-default print-access-token

# 测试 Vertex AI API 访问
gcloud ai models list --region=us-central1

#!/usr/bin/env python3
"""
Nano Banana Pro Vertex AI 权限诊断脚本
自动检测 API 启用状态、IAM 权限、ADC 配置等常见问题
"""

import os
import sys

def check_environment():
    """检查环境变量配置"""
    print("=" * 50)
    print("1. 检查环境变量")
    print("=" * 50)

    creds_path = os.environ.get('GOOGLE_APPLICATION_CREDENTIALS')
    if creds_path:
        print(f"✅ GOOGLE_APPLICATION_CREDENTIALS: {creds_path}")
        if os.path.exists(creds_path):
            print("✅ 凭据文件存在")
        else:
            print("❌ 凭据文件不存在，请检查路径")
            return False
    else:
        print("⚠️  GOOGLE_APPLICATION_CREDENTIALS 未设置")
        print("   将尝试使用 ADC 或用户凭据")

    return True

def check_authentication():
    """检查认证状态"""
    print("\n" + "=" * 50)
    print("2. 检查认证状态")
    print("=" * 50)

    try:
        import google.auth
        credentials, project = google.auth.default()
        print(f"✅ 认证成功")
        print(f"   项目 ID: {project}")
        print(f"   凭据类型: {type(credentials).__name__}")
        return True, project
    except Exception as e:
        print(f"❌ 认证失败: {e}")
        print("   请运行: gcloud auth application-default login")
        return False, None

def check_vertex_ai_api(project_id):
    """检查 Vertex AI API 是否启用"""
    print("\n" + "=" * 50)
    print("3. 检查 Vertex AI API 状态")
    print("=" * 50)

    try:
        from google.cloud import aiplatform
        aiplatform.init(project=project_id, location="us-central1")
        print("✅ Vertex AI API 已启用")
        return True
    except Exception as e:
        error_msg = str(e)
        if "has not been used" in error_msg or "disabled" in error_msg:
            print("❌ Vertex AI API 未启用")
            print("   请访问 Google Cloud Console 启用 API")
        else:
            print(f"❌ API 检查失败: {e}")
        return False

def check_model_access():
    """测试模型访问权限"""
    print("\n" + "=" * 50)
    print("4. 测试 Nano Banana Pro 模型访问")
    print("=" * 50)

    try:
        from google import genai
        from google.genai import types

        client = genai.Client(vertexai=True)

        # 尝试简单的模型调用
        response = client.models.generate_content(
            model="gemini-2.5-flash-image",
            contents="Generate a simple test image of a blue circle",
            config=types.GenerateContentConfig(
                response_modalities=["TEXT"]  # 先测试文本响应
            )
        )
        print("✅ 模型访问正常")
        return True
    except Exception as e:
        error_msg = str(e)
        if "PERMISSION_DENIED" in error_msg:
            print("❌ 权限不足，请添加 Vertex AI User 角色")
        elif "NOT_FOUND" in error_msg:
            print("❌ 模型不存在或地区不支持")
        else:
            print(f"❌ 模型访问失败: {e}")
        return False

def main():
    """主诊断流程"""
    print("\n🔍 Nano Banana Pro Vertex AI 权限诊断工具\n")

    results = []

    # 检查环境
    results.append(("环境变量", check_environment()))

    # 检查认证
    auth_ok, project_id = check_authentication()
    results.append(("认证状态", auth_ok))

    if auth_ok and project_id:
        # 检查 API
        results.append(("Vertex AI API", check_vertex_ai_api(project_id)))

        # 检查模型访问
        results.append(("模型访问", check_model_access()))

    # 输出总结
    print("\n" + "=" * 50)
    print("诊断结果总结")
    print("=" * 50)

    all_passed = True
    for name, passed in results:
        status = "✅ 通过" if passed else "❌ 失败"
        print(f"{name}: {status}")
        if not passed:
            all_passed = False

    if all_passed:
        print("\n🎉 所有检查通过！Vertex AI 配置正确。")
    else:
        print("\n⚠️  存在配置问题，请根据上述提示进行修复。")
        print("   如果问题持续，考虑使用 laozhang.ai API 中转服务。")

if __name__ == "__main__":
    main()

// 简化版诊断脚本 - Node.js
const { VertexAI } = require('@google-cloud/vertexai');

async function diagnose() {
  console.log('🔍 开始诊断 Vertex AI 配置...\n');

  // 检查环境变量
  const credsPath = process.env.GOOGLE_APPLICATION_CREDENTIALS;
  console.log(`凭据路径: ${credsPath || '未设置'}`);

  try {
    const vertexAI = new VertexAI({
      project: process.env.GOOGLE_CLOUD_PROJECT,
      location: 'us-central1',
    });

    const model = vertexAI.preview.getGenerativeModel({
      model: 'gemini-2.5-flash-image',
    });

    console.log('✅ Vertex AI 初始化成功');
    console.log('✅ 模型访问正常');
  } catch (error) {
    console.error('❌ 诊断失败:', error.message);
    if (error.message.includes('PERMISSION_DENIED')) {
      console.log('   建议: 添加 Vertex AI User 角色');
    }
  }
}

diagnose();

# 为当前登录用户添加权限
gcloud projects add-iam-policy-binding $(gcloud config get-value project) \
  --member="user:$(gcloud config get-value account)" \
  --role="roles/aiplatform.user"

# 批量启用所需 API
gcloud services enable aiplatform.googleapis.com
gcloud services enable generativelanguage.googleapis.com

# 完整的服务账号配置流程
export PROJECT_ID=$(gcloud config get-value project)
export SA_NAME="nano-banana-pro"

# 创建服务账号
gcloud iam service-accounts create $SA_NAME \
  --display-name="Nano Banana Pro Service Account"

# 授予权限
gcloud projects add-iam-policy-binding $PROJECT_ID \
  --member="serviceAccount:$SA_NAME@$PROJECT_ID.iam.gserviceaccount.com" \
  --role="roles/aiplatform.user"

# 生成密钥
gcloud iam service-accounts keys create credentials.json \
  --iam-account=$SA_NAME@$PROJECT_ID.iam.gserviceaccount.com

# 设置环境变量
export GOOGLE_APPLICATION_CREDENTIALS="$(pwd)/credentials.json"

from openai import OpenAI

# 使用 laozhang.ai API 中转
client = OpenAI(
    api_key="your-laozhang-api-key",
    base_url="https://api.laozhang.ai/v1"
)

# 调用 Nano Banana Pro 生成图像
response = client.images.generate(
    model="gemini-3-pro-image-preview",
    prompt="一只可爱的橘猫坐在窗台上看夕阳",
    size="1024x1024"
)

print(response.data[0].url)

import OpenAI from 'openai';

const client = new OpenAI({
  apiKey: 'your-laozhang-api-key',
  baseURL: 'https://api.laozhang.ai/v1',
});

const response = await client.images.generate({
  model: 'gemini-3-pro-image-preview',
  prompt: 'A cute orange cat sitting on a windowsill watching the sunset',
  size: '1024x1024',
});

console.log(response.data[0].url);

import time
from google.api_core import exceptions

def generate_image_with_retry(prompt, max_retries=3):
    """带重试机制的图像生成"""
    for attempt in range(max_retries):
        try:
            response = client.models.generate_content(
                model="gemini-2.5-flash-image",
                contents=prompt,
                config={"response_modalities": ["IMAGE"]}
            )
            return response
        except exceptions.PermissionDenied as e:
            # 权限错误不重试，直接抛出
            raise
        except exceptions.ResourceExhausted as e:
            # 配额耗尽，等待后重试
            wait_time = 60 * (attempt + 1)
            print(f"配额耗尽，等待 {wait_time} 秒后重试...")
            time.sleep(wait_time)
        except Exception as e:
            # 其他错误，短暂等待后重试
            wait_time = 2 ** attempt
            print(f"请求失败，{wait_time} 秒后重试: {e}")
            time.sleep(wait_time)

    raise Exception(f"重试 {max_retries} 次后仍然失败")

from google.api_core import timeout

# 设置 30 秒超时
timeout_config = timeout.ExponentialTimeout(
    initial=30.0,
    maximum=60.0,
    multiplier=2.0,
)

response = client.models.generate_content(
    model="gemini-2.5-flash-image",
    contents=prompt,
    timeout=timeout_config
)

import logging
from datetime import datetime

logging.basicConfig(level=logging.INFO)
logger = logging.getLogger(__name__)

def log_api_call(func):
    """API 调用日志装饰器"""
    def wrapper(*args, **kwargs):
        start_time = datetime.now()
        try:
            result = func(*args, **kwargs)
            duration = (datetime.now() - start_time).total_seconds()
            logger.info(f"API 调用成功 | 耗时: {duration:.2f}s")
            return result
        except Exception as e:
            duration = (datetime.now() - start_time).total_seconds()
            logger.error(f"API 调用失败 | 耗时: {duration:.2f}s | 错误: {e}")
            raise
    return wrapper

import os
from google.cloud import secretmanager

def get_api_key():
    """从 Secret Manager 获取 API 密钥"""
    # 开发环境：从环境变量读取
    if os.environ.get('ENV') == 'development':
        return os.environ.get('LAOZHANG_API_KEY')

    # 生产环境：从 Secret Manager 读取
    client = secretmanager.SecretManagerServiceClient()
    name = f"projects/{os.environ['PROJECT_ID']}/secrets/laozhang-api-key/versions/latest"
    response = client.access_secret_version(request={"name": name})
    return response.payload.data.decode("UTF-8")