Unified · Split
| @@ -221,9 +221,14 @@ scenario( · 220 unmodified lines | ||
| 221 | 221 | expect(google.origin.allowedScopes).toContain( |
| 222 | 222 | "https://www.googleapis.com/auth/meetings.space.readonly", |
| 223 | 223 | ); |
| 224 | − expect(google.origin.allowedScopes).not.toContain( | |
| 225 | − "https://www.googleapis.com/auth/gmail.modify", | |
| 226 | − ); | |
| 224 | + // `gmail.modify` stays in the host-enforced allowlist on purpose: a | |
| 225 | + // connection created before the full-Gmail review still declares it, and | |
| 226 | + // `resolveFirstPartyScopes` filters discovered scopes through this list, | |
| 227 | + // so dropping it would break those reconnects — as the legacy-spec case | |
| 228 | + // further down this file asserts. The invariant that new Gmail presets | |
| 229 | + // request `mail.google.com` instead lives in the preset unit tests | |
| 230 | + // (packages/plugins/openapi/.../presets.test.ts), which is where the | |
| 231 | + // request-side scope choice is actually decided. | |
| 227 | 232 | expect(google.origin.allowedScopes).toContain("https://mail.google.com/"); |
| 228 | 233 | expect(google.origin.allowedScopes).toContain( |
| 229 | 234 | "https://www.googleapis.com/auth/gmail.settings.basic", |