Skip to content

fix(auth): include Gmail settings scope #794

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
Lubrsy706 wants to merge 3 commits into from
Closed

fix(auth): include Gmail settings scope #794

Changes from 1 commit
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
f82b602
fix(auth): include Gmail settings scope
Lubrsy706 May 13, 2026
3e42111
fix(auth): filter redundant Gmail settings scope
Lubrsy706 May 13, 2026
6528f7a
fix(auth): keep Gmail settings scope opt-in
Lubrsy706 May 14, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
12 changes: 12 additions & 0 deletions crates/google-workspace-cli/src/auth_commands.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -264,6 +264,7 @@ pub const MINIMAL_SCOPES: &[&str] = &[
"https://www.googleapis.com/auth/drive",
"https://www.googleapis.com/auth/spreadsheets",
"https://www.googleapis.com/auth/gmail.modify",
"https://www.googleapis.com/auth/gmail.settings.basic",
Copy link
Copy Markdown
Contributor

@gemini-code-assist gemini-code-assist Bot May 13, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

high

Adding https://www.googleapis.com/auth/gmail.settings.basic to the default scope sets requires an update to the filter_redundant_restrictive_scopes function (located around line 862). This function is designed to remove restrictive scopes that are redundant when broader scopes (like https://mail.google.com/) are present, preventing Google from enforcing the narrower scope's limitations on the access token. Please add an entry for this new scope to the RESTRICTIVE_SCOPES constant within that function to ensure it is filtered out when full Gmail access is granted.

Copy link
Copy Markdown
Author

@Lubrsy706 Lubrsy706 May 13, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for catching this. I added gmail.settings.basic to the redundant restrictive-scope filter when https://mail.google.com/ is present, with regression coverage for both filtering and keeping it when only gmail.modify is present.

Copy link
Copy Markdown
Contributor

@gemini-code-assist gemini-code-assist Bot May 13, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

high

Adding https://www.googleapis.com/auth/gmail.settings.basic to MINIMAL_SCOPES contradicts the documentation above (lines 258-262), which states that these scopes should never trigger Google's restricted_client or unverified-app blocks. This scope is explicitly classified as Restricted in setup.rs (line 194). While other restricted scopes like gmail.modify are already present, adding more restricted scopes increases the likelihood of authentication failures for users with unverified OAuth apps.

References
  1. Avoid introducing changes that are outside the primary goal of a pull request to prevent scope creep.

Copy link
Copy Markdown
Author

@Lubrsy706 Lubrsy706 May 14, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Good point. I removed gmail.settings.basic from MINIMAL_SCOPES so the default login set stays unchanged. The scope remains available in the picker and --full, which addresses the filters use case without making the default scope set broader.

"https://www.googleapis.com/auth/calendar",
"https://www.googleapis.com/auth/documents",
"https://www.googleapis.com/auth/presentations",
Expand All @@ -289,6 +290,7 @@ pub const FULL_SCOPES: &[&str] = &[
"https://www.googleapis.com/auth/drive",
"https://www.googleapis.com/auth/spreadsheets",
"https://www.googleapis.com/auth/gmail.modify",
"https://www.googleapis.com/auth/gmail.settings.basic",
"https://www.googleapis.com/auth/calendar",
"https://www.googleapis.com/auth/documents",
"https://www.googleapis.com/auth/presentations",
Expand Down Expand Up @@ -1549,6 +1551,10 @@ const SCOPE_ENTRIES: &[ScopeEntry] = &[
scope: "https://www.googleapis.com/auth/gmail.modify",
label: "Gmail",
},
ScopeEntry {
scope: "https://www.googleapis.com/auth/gmail.settings.basic",
label: "Gmail Settings",
},
ScopeEntry {
scope: "https://www.googleapis.com/auth/calendar",
label: "Google Calendar",
Expand Down Expand Up @@ -1745,6 +1751,9 @@ mod tests {
let scopes = run_resolve_scopes(ScopeMode::Default, None);
assert_eq!(scopes.len(), DEFAULT_SCOPES.len());
assert_eq!(scopes[0], "https://www.googleapis.com/auth/drive");
assert!(
scopes.contains(&"https://www.googleapis.com/auth/gmail.settings.basic".to_string())
);
}

#[test]
Expand Down Expand Up @@ -1789,6 +1798,9 @@ mod tests {
fn resolve_scopes_full_returns_full_scopes() {
let scopes = run_resolve_scopes(ScopeMode::Full, None);
assert_eq!(scopes.len(), FULL_SCOPES.len());
assert!(
scopes.contains(&"https://www.googleapis.com/auth/gmail.settings.basic".to_string())
);
}

#[test]
Expand Down
Loading