Fix Google OAuth service policies

.changeset/gmail-settings-access.md

@@ -0,0 +1,5 @@
+---
+"@executor-js/plugin-openapi": patch
+---
+
+Request Gmail's basic-settings scope alongside full mailbox access so Google integrations can create and manage Gmail filters without including domain-admin-only sharing settings.

apps/marketing/src/pages/about-executor.astro

@@ -124,11 +124,11 @@ const pageDescription =
  person's instructions.
  </p>
  <ul>
- <li><strong>Google Calendar:</strong> read calendars and events, or create, update, and remove events.</li>
+ <li><strong>Google Calendar:</strong> read, create, update, or remove calendars and events, and manage calendar sharing rules.</li>
  <li><strong>Gmail:</strong> read and search messages, compose and send mail, manage labels, archive or trash messages, or permanently delete messages only when explicitly requested.</li>
- <li><strong>Google Sheets:</strong> read spreadsheet data and update cells, ranges, and worksheets.</li>
+ <li><strong>Google Sheets:</strong> read spreadsheet data, update cells, ranges, and worksheets, and write Drive-file smart chips.</li>
  <li><strong>Google Drive, Docs, Slides, and Forms:</strong> find and manage files and folders, edit documents and presentations, and create or read forms and responses.</li>
- <li><strong>Google Contacts and Tasks:</strong> read or update contacts and contact groups, read other contacts or an available Workspace directory, and manage task lists and tasks.</li>
+ <li><strong>Google Contacts and Tasks:</strong> read or update contacts and contact groups, read available profile fields, other contacts, or a Workspace directory, and manage task lists and tasks.</li>
  <li><strong>Google Meet:</strong> create and configure meeting spaces or read meeting records, participants, recordings, and transcripts.</li>
  <li><strong>Google Photos:</strong> upload and manage app-created media or read media explicitly selected through Google Photos Picker.</li>
  <li><strong>Google Search Console:</strong> inspect verified sites, sitemaps, indexed URLs, and search-performance data.</li>

apps/marketing/src/pages/google-oauth.astro

@@ -6,22 +6,22 @@ const googleServices = [
  index: "01",
  name: "Google Calendar",
  purpose:
- "Executor can read your calendars and events, then create, update, or remove events when you ask an agent to manage your schedule.",
+ "Executor can read, create, update, or remove calendars and events, and manage calendar sharing rules, when you ask an agent to manage your schedule.",
  scope: "googleapis.com/auth/calendar",
  },
  {
  index: "02",
  name: "Gmail",
  purpose:
- "Executor can read, search, compose, send, organize, trash, and permanently delete messages only when you explicitly instruct an agent to work with your email.",
- scope: "mail.google.com",
+ "Executor can read, search, compose, send, organize, trash, and permanently delete messages, and manage filters and other basic Gmail settings, only when you explicitly instruct an agent to work with your email.",
+ scope: "mail.google.com · gmail.settings.basic",
  },
  {
  index: "03",
  name: "Google Sheets",
  purpose:
- "Executor can read spreadsheet data and update cells, ranges, and worksheets when you ask an agent to work with a spreadsheet.",
- scope: "googleapis.com/auth/spreadsheets",
+ "Executor can read spreadsheet data, update cells, ranges, and worksheets, and write Drive-file smart chips when you ask an agent to work with a spreadsheet.",
+ scope: "googleapis.com/auth/spreadsheets · drive.file",
  },
  {
  index: "04",
@@ -41,8 +41,8 @@ const googleServices = [
  index: "06",
  name: "Google Contacts and Tasks",
  purpose:
- "Executor can read or update contacts and contact groups, read other contacts or an available Workspace directory, and manage task lists and tasks when you ask an agent to organize people or work.",
- scope: "contacts · contacts.other.readonly · directory.readonly · tasks",
+ "Executor can read or update contacts and contact groups, read available profile fields, other contacts, or a Workspace directory, and manage task lists and tasks when you ask an agent to organize people or work.",
+ scope: "contacts · user profile fields · directory.readonly · tasks",
  },
  {
  index: "07",

apps/marketing/src/pages/google-workspace.astro

@@ -3,17 +3,17 @@ const services = [
  {
  name: "Google Calendar",
  description:
- "Read calendars and events, and create, update, or remove events when you ask an agent to manage your schedule.",
+ "Read, create, update, or remove calendars and events, and manage calendar sharing rules, when you ask an agent to manage your schedule.",
  },
  {
  name: "Gmail",
  description:
- "Read, search, compose, send, label, archive, trash, or permanently delete messages when you explicitly ask an agent to work with your email.",
+ "Read, search, compose, send, label, archive, trash, or permanently delete messages, and manage filters and other basic Gmail settings, when you explicitly ask an agent to work with your email.",
  },
  {
  name: "Google Sheets",
  description:
- "Read spreadsheet data and update cells, ranges, or worksheets when you ask an agent to work with a spreadsheet.",
+ "Read spreadsheet data, update cells, ranges, or worksheets, and write Drive-file smart chips when you ask an agent to work with a spreadsheet.",
  },
  {
  name: "Google Drive, Docs, Slides, and Forms",
@@ -23,7 +23,7 @@ const services = [
  {
  name: "Google Contacts and Tasks",
  description:
- "Read or update contacts and contact groups, read other contacts or an available Workspace directory, and manage task lists and tasks when you ask an agent to organize people or work.",
+ "Read or update contacts and contact groups, read available profile fields, other contacts, or a Workspace directory, and manage task lists and tasks when you ask an agent to organize people or work.",
  },
  {
  name: "Google Meet",

apps/marketing/src/pages/privacy.astro

@@ -57,9 +57,9 @@ import LegalLayout from "../components/LegalLayout.astro";
  <p>
  If you connect a Google Workspace service, Executor uses the permissions you grant to perform the actions you
  request through that integration. Depending on the service and permissions you choose, this may include accessing
- or modifying Google Calendar events; Gmail messages, drafts, threads, attachments, labels, and settings; Google
+ or modifying Google Calendar calendars, events, and sharing rules; Gmail messages, drafts, threads, attachments, labels, and settings; Google
  Drive files and folders; Docs documents; Sheets spreadsheets; Slides presentations; Forms and responses; Contacts,
- other contacts, and an available Workspace directory; Tasks; Meet spaces, participants, recordings, and transcripts; app-created or user-selected Photos media; Search
+profile fields, other contacts, and an available Workspace directory; Tasks; Meet spaces, participants, recordings, and transcripts; app-created or user-selected Photos media; Search
  Console sites, sitemaps, indexed URLs, and performance data; or other Google content made available by the service
  you connect. For Gmail, this can include permanently deleting messages or threads only when you explicitly request
  that irreversible action.

e2e/scenarios/first-party-oauth.test.ts

@@ -221,9 +221,18 @@
  expect(google.origin.allowedScopes).toContain(
  "https://www.googleapis.com/auth/meetings.space.readonly",
  );
- expect(google.origin.allowedScopes).toContain("https://www.googleapis.com/auth/gmail.modify");
+ expect(google.origin.allowedScopes).not.toContain(
+ "https://www.googleapis.com/auth/gmail.modify",
+ );
  expect(google.origin.allowedScopes).toContain("https://mail.google.com/");
+ expect(google.origin.allowedScopes).toContain(
+ "https://www.googleapis.com/auth/gmail.settings.basic",
+ );
+ expect(google.origin.allowedScopes).not.toContain(
+ "https://www.googleapis.com/auth/gmail.settings.sharing",
+ );
  expect(google.origin.allowedScopes).toContain("https://www.googleapis.com/auth/spreadsheets");
+ expect(google.origin.allowedScopes).toContain("https://www.googleapis.com/auth/drive.file");
  expect(google.origin.allowedScopes).toContain("https://www.googleapis.com/auth/drive");
  expect(google.origin.allowedScopes).toContain("https://www.googleapis.com/auth/documents");
  expect(google.origin.allowedScopes).toContain(
@@ -241,6 +250,16 @@
  expect(google.origin.allowedScopes).toContain(
  "https://www.googleapis.com/auth/directory.readonly",
  );
+ for (const scope of [
+ "user.addresses.read",
+ "user.birthday.read",
+ "user.emails.read",
+ "user.gender.read",
+ "user.organization.read",
+ "user.phonenumbers.read",
+ ]) {
+ expect(google.origin.allowedScopes).toContain(`https://www.googleapis.com/auth/${scope}`);
+ }
  expect(google.origin.allowedScopes).toContain(
  "https://www.googleapis.com/auth/photoslibrary.appendonly",
  );
@@ -332,6 +351,7 @@
  "email",
  "profile",
  "https://mail.google.com/",
+ "https://www.googleapis.com/auth/gmail.settings.basic",
  ]),
  slug: fullGmail,
  },
@@ -351,7 +371,15 @@
  fullGmailStarted.status === "redirect" ? fullGmailStarted.authorizationUrl : "";
  expect(
  new Set(new URL(fullGmailAuthorizationUrl).searchParams.get("scope")?.split(" ") ?? []),
- ).toEqual(new Set(["openid", "email", "profile", "https://mail.google.com/"]));
+ ).toEqual(
+ new Set([
+ "openid",
+ "email",
+ "profile",
+ "https://mail.google.com/",
+ "https://www.googleapis.com/auth/gmail.settings.basic",
+ ]),
+ );
 
  const drive = IntegrationSlug.make(unique("google_drive"));
  yield* client.openapi.addSpec({

packages/plugins/openapi/src/providers/google/__snapshots__/presets.test.ts.snap

@@ -52,7 +52,7 @@ exports[`classifies every Google service for bundle OAuth UX 1`] = `
  },
  {
  "id": "google-chat",
- "oauthAudience": "workspace-admin",
+ "oauthAudience": "advanced-user",
  },
  {
  "id": "google-keep",