Add new RRM scope and require it for the express setup

[hussain-t]

Feature Description

The new Reader Revenue Manager Express Setup flow performs write operations (creating a publication and a CTA), which need an additional OAuth scope beyond the current read-only one. Add the subscribewithgoogle.publications.entitlements.manage scope to the Reader Revenue Manager module, require it for express setup, and request it when the user enters the express setup flow.

For reference, see the Infrastructure section in the design doc.

---

Do not alter or remove anything below. The following sections will be managed by moderators only.

Acceptance criteria

• The Reader Revenue Manager module declares the new write scope https://www.googleapis.com/auth/subscribewithgoogle.publications.entitlements.manage.
• The scope is required only for express setup, gated on the rrmExpressSetup flag, so the standard RRM setup is unaffected.
• When the user enters the express setup flow, Site Kit requests the write scope via OAuth if it has not already been granted.
• With the flag off, the module's required scopes are unchanged.

Implementation Brief

• assets/js/modules/reader-revenue-manager/datastore/constants.js

  • Add READONLY_SCOPE and MANAGE_SCOPE constants for the two RRM OAuth scope strings.

• assets/js/hooks/useActivateModuleCallback.js

  • Accept an options second parameter and forward it into the activateModule dispatch call.

• assets/js/googlesitekit/modules/index.js

  • Pass options through in the activateModule wrapper so the extended signature reaches the data store action.

• assets/js/googlesitekit/modules/datastore/modules.js

  • Extend activateModule( slug, options ) action to destructure redirectQueryArgs and additionalScopes from options and include them in the SELECT_MODULE_REAUTH_URL control payload.
  • Update SELECT_MODULE_REAUTH_URL control to forward both options into the module's getAdminReauthURL selector call.

• assets/js/googlesitekit/modules/create-info-store.js

  • Extend getAdminReauthURL to accept redirectQueryArgs and additionalScopes alongside the existing reAuth option.
  • Merge redirectQueryArgs into the admin redirect URL construction.
  • Compute unsatisfiedAdditionalScopes by filtering additionalScopes through CORE_USER.hasScope.
  • Resolve to connect URL when needsReauthentication is true or unsatisfiedAdditionalScopes.length > 0, passing unsatisfiedAdditionalScopes into CORE_USER.getConnectURL.

• In SetupMainExpressReady.tsx (introduced by Scaffold the RRM express setup flow #12950):

  • When expressSetup=true is confirmed, check CORE_USER.hasScope( READER_REVENUE_MANAGER_MANAGE_SCOPE ).
  • If the scope is absent, call setPermissionScopeError with skipModal: true, scopes: [ READER_REVENUE_MANAGER_MANAGE_SCOPE ], and redirectURL: location.href — following the same immediate-OAuth-redirect pattern used in useEnableAudienceGroup.js.
  • This ensures AuthenticatedPermissionsModal redirects to OAuth without presenting a confirmation dialog.

• assets/js/modules/reader-revenue-manager/ — express setup entry point banner (Implement the RRM express setup dashboard entry point #12947) and RRM setup CTA banner (Update RRM setup CTA banner for express setup #12946)

  • Wire the RRM express setup CTA activation call via useActivateModuleCallback with:
    • redirectQueryArgs: { expressSetup: true, cta: 'newsletter-signup' }
    • additionalScopes: [ MANAGE_SCOPE ]

Test Coverage

• Update tests for create-info-store selector tests.
• Update core/modules activation tests:
• Update tests for setup CTA and entry point banners as per the changes.
• Add tests for SetupMainExpressReady related to the changes.

QA Brief

Changelog entry

[nfmohit]

AC ✅

[nfmohit]

Hi @ankitrox. Thank you for drafting the IB.

In includes/Modules/Reader_Revenue_Manager.php:

• In get_scopes(), append https://www.googleapis.com/auth/subscribewithgoogle.publications.entitlements.manage to the returned array when Feature_Flags::enabled( 'rrmExpressSetup' ) is true — matching the Feature_Flags gating pattern used in Analytics_4.php.

I'm afraid, this is not going to satisfy the ACs, because this would mean that the existing standard RRM module setup will also require this scope, which we do not want. We only want to ask for this scope when the user uses the express setup.

This will need a mostly client-side approach, with the useActivateModuleCallback hook, activateModule action, SELECT_MODULE_REAUTH_URL control, and getAdminReauthURL selector extended to optionally support:

1. Query arguments in the redirect URL, so that we can pass ?expressSetup=true&cta=newsletter-signup after module activation.
2. Accept additional scopes to be asked for when the user is sent to OAuth, as getConnectURL already supports it.

I have created a small PoC (#13070) to demonstrate my thoughts behind this. I'll also loop in @aaemnnosttv to review if this approach looks good.

Thanks!