The Google Sign-In flow now only requests basic profile scopes (openid,
email, profile) instead of also requesting Gmail API scopes. Users can
grant Gmail access separately via the "Connect Gmail" button in Settings.
- Remove GMAIL_SCOPES from GOOGLE_LOGIN_SCOPES in auth.py
- Remove Gmail credential auto-provisioning from google_oauth endpoint
- Simplify /auth/google/authorize-url (no offline access or forced consent)
- Clean up auth_service.py OAuth registration to only use login scopes
- Remove unused imports (GmailCredential, GmailService, encrypt_credential, etc.)
Agent-Logs-Url: https://github.com/christianlouis/InboxConverge/sessions/91d2db11-811f-46f5-ac89-29952ab358b5
Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com>
- Add gmail.readonly to GMAIL_SCOPES (gmail_service) and GMAIL_API_SCOPES (providers)
so users().getProfile() no longer returns 403 insufficientPermissions
- Consolidate Gmail scope list: GMAIL_SCOPES in gmail_service.py is the single
source of truth; auth.py and providers.py now import and spread it
- Add include_granted_scopes=true to both Gmail and login authorize URLs so
scope additions take effect for previously-connected users
- Add state=gmail_connect to the Gmail authorize URL; the shared /auth/callback
page routes to gmailApi.saveCallback() when this state is present, otherwise
falls through to the normal login flow
- Google Sign-In authorize URL now requests all six scopes (openid, email,
profile + 3 Gmail scopes) with access_type=offline, prompt=consent, and
include_granted_scopes=true
- POST /auth/google now stores Gmail credentials automatically after sign-in
(non-fatal: login succeeds even if credential storage fails)
- Settings Connect Gmail button now uses /auth/callback instead of
/auth/gmail-callback - only ONE redirect URI needed in Google Cloud Console
- URL-encode scope parameter in both authorize URL builders
- Update auth_service._register_google scope to include all Gmail scopes
- Update CHANGELOG.md and docs/TODO.md
Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com>
Agent-Logs-Url: https://github.com/christianlouis/pop_puller_to_gmail/sessions/d6e2de8b-088d-46f3-8127-137245c3ecdd
Backend (mypy - 56 errors fixed):
- database.py: Fix async generator return type to AsyncGenerator
- database_models.py: Add type annotations for SQLEnum columns
- middleware.py: Use explicit Optional for exempt_paths parameter
- mail_processor.py: Fix type narrowing in fetch_emails, add Dict type annotation for KNOWN_PROVIDERS
- users.py, auth.py, providers.py, tasks.py: Add type: ignore comments for SQLAlchemy Column assignment patterns
Frontend (eslint - 3 errors, 2 warnings fixed):
- login/page.tsx: Replace any with unknown + type narrowing, prefix unused vars with underscore
- register/page.tsx: Replace any with unknown + type narrowing
Add .github/copilot-instructions.md with lint-check requirements
Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com>
Agent-Logs-Url: https://github.com/christianlouis/pop_puller_to_gmail/sessions/dac7ab78-fe27-4fe4-890f-32c6c1c6d881
copilot-swe-agent[bot]