Showing the changes to apps/cloud/src/engine/execution-stack.ts (1 of 11 files). Show all
Unified · Split
| @@ -89,13 +89,14 @@ export const CloudPluginsProvider: Layer.Layer<PluginsProvider> = Layer.succeed( · 88 unmodified lines | |||
| 89 | */ | 89 | */ |
| 90 | export const CLOUD_MOUNT_PREFIX = "/api" as const; | 90 | export const CLOUD_MOUNT_PREFIX = "/api" as const; |
| 91 | 91 | ||
| 92 | // Initial Google launch boundary. Calendar + Sheets are sensitive scopes but | 92 | // Initial Google launch boundary. Gmail uses gmail.modify for read, send, and |
| 93 | // not restricted Workspace scopes; Gmail and account-wide Drive remain absent | 93 | // trash operations while immediate permanent deletion remains absent until the |
| 94 | // until their separate verification/security work is complete. The same scope | 94 | // broader mail.google.com scope is approved. Account-wide Drive remains absent. |
| 95 | // source builds the catalog auth templates, preventing config drift. | 95 | // The same scope source builds the catalog auth templates, preventing drift. |
| 96 | const GOOGLE_FIRST_PARTY_ALLOWED_SCOPES: readonly string[] = [ | 96 | const GOOGLE_FIRST_PARTY_ALLOWED_SCOPES: readonly string[] = [ |
| 97 | ...new Set([ | 97 | ...new Set([ |
| 98 | ...googleCatalogOAuthScopesForPreset("google-calendar"), | 98 | ...googleCatalogOAuthScopesForPreset("google-calendar"), |
| 99 | ...googleCatalogOAuthScopesForPreset("google-gmail"), | ||
| 99 | ...googleCatalogOAuthScopesForPreset("google-sheets"), | 100 | ...googleCatalogOAuthScopesForPreset("google-sheets"), |
| 100 | ]), | 101 | ]), |
| 101 | ]; | 102 | ]; |