Unified · Split
| @@ -221,9 +221,14 @@ scenario( · 220 unmodified lines | |||
| 221 | expect(google.origin.allowedScopes).toContain( | 221 | expect(google.origin.allowedScopes).toContain( |
| 222 | "https://www.googleapis.com/auth/meetings.space.readonly", | 222 | "https://www.googleapis.com/auth/meetings.space.readonly", |
| 223 | ); | 223 | ); |
| 224 | expect(google.origin.allowedScopes).not.toContain( | 224 | // `gmail.modify` stays in the host-enforced allowlist on purpose: a |
| 225 | "https://www.googleapis.com/auth/gmail.modify", | 225 | // connection created before the full-Gmail review still declares it, and |
| 226 | ); | 226 | // `resolveFirstPartyScopes` filters discovered scopes through this list, |
| 227 | // so dropping it would break those reconnects — as the legacy-spec case | ||
| 228 | // further down this file asserts. The invariant that new Gmail presets | ||
| 229 | // request `mail.google.com` instead lives in the preset unit tests | ||
| 230 | // (packages/plugins/openapi/.../presets.test.ts), which is where the | ||
| 231 | // request-side scope choice is actually decided. | ||
| 227 | expect(google.origin.allowedScopes).toContain("https://mail.google.com/"); | 232 | expect(google.origin.allowedScopes).toContain("https://mail.google.com/"); |
| 228 | expect(google.origin.allowedScopes).toContain( | 233 | expect(google.origin.allowedScopes).toContain( |
| 229 | "https://www.googleapis.com/auth/gmail.settings.basic", | 234 | "https://www.googleapis.com/auth/gmail.settings.basic", |