fix: request Drive scope in gwcli configure

pkg/gwcli/connection.go

@@ -30,16 +30,9 @@ import (
 )
 
 const (
-	// Scope for Gmail API. The full drive scope is required to
-	// export/download Drive artifacts linked from email bodies (see
-	// drive_artifacts.go), and leaves room for future write use (e.g.
-	// sending Drive files as attachments).
-	scope = "https://www.googleapis.com/auth/gmail.modify https://www.googleapis.com/auth/gmail.settings.basic https://www.googleapis.com/auth/gmail.labels https://www.googleapis.com/auth/drive"
-
 	pageSize = 100
 
-	accessType = "offline"
-	email      = "me"
+	email = "me"
 )
 
 // Different levels of detail to download.
@@ -132,22 +125,6 @@ func NewFake(client *http.Client) (*CmdG, error) {
 	return conn, conn.setupClients()
 }
 
-func readConf(fn string) (Config, error) {
-	f, err := ioutil.ReadFile(fn)
-	if err != nil {
-		return Config{}, err
-	}
-	var conf Config
-	if err := json.Unmarshal(f, &conf); err != nil {
-		return Config{}, errors.Wrapf(err, "unmarshalling config")
-	}
-	if conf.OAuth.ClientID == "" {
-		conf.OAuth.ClientID = DefaultClientID
-		conf.OAuth.ClientSecret = DefaultClientSecret
-	}
-	return conf, nil
-}
-
 // New creates a new CmdG with OAuth/service-account authentication.
 // configDir should point to the directory containing credentials.json and token.json
 // userEmail is only required when using service account authentication (for user impersonation)
@@ -345,12 +322,12 @@ func oauth2Config(credBytes []byte) (*oauth2.Config, error) {
 			AuthURL:  c.Installed.AuthURI,
 			TokenURL: c.Installed.TokenURI,
 		},
-		Scopes: []string{
-			"https://www.googleapis.com/auth/gmail.modify",
-			"https://www.googleapis.com/auth/gmail.settings.basic",
-			"https://www.googleapis.com/auth/gmail.labels",
-			"https://www.googleapis.com/auth/drive",
-		},
+		// Single source of truth: the same scope set the consent screen
+		// requested (see authScopes in oauth.go). For an already-issued
+		// token this is effectively cosmetic — the refresh endpoint does
+		// not re-request scopes — but keeping one list prevents the lists
+		// from silently diverging again.
+		Scopes: append([]string(nil), authScopes...),
 	}, nil
 }
 

pkg/gwcli/oauth.go

@@ -17,16 +17,24 @@ import (
 	"google.golang.org/api/tasks/v1"
 )
 
-// authScopes is the OAuth/JWT scope set shared by the Gmail, Tasks, and
-// Calendar clients. The Drive scope is requested separately (see
-// ServiceAccountAuthenticator.DriveService) because domain-wide-delegation
-// token exchange is all-or-nothing across the requested scope set.
+// authScopes is the OAuth scope set requested on the installed-app consent
+// screen (NewAuthenticator) and granted to the Gmail, Tasks, Calendar, and
+// Drive clients. Every scope the tool will ever need must be bundled here:
+// user-consent OAuth is not all-or-nothing, but Google will not add scopes
+// to an already-issued token, so anything omitted here can never be
+// consented to without re-running `gwcli configure`.
+//
+// Service accounts do NOT use this list: ServiceAccountAuthenticator
+// requests the Drive scope separately (see DriveService) because
+// domain-wide-delegation token exchange *is* all-or-nothing across the
+// requested scope set.
 var authScopes = []string{
 	gmail.GmailModifyScope,
 	gmail.GmailSettingsBasicScope,
 	gmail.GmailLabelsScope,
 	tasks.TasksScope,
 	calendar.CalendarScope,
+	drive.DriveScope,
 }
 
 // IsServiceAccount reports whether the credentials JSON is a service-account

pkg/gwcli/oauth_test.go

@@ -27,6 +27,7 @@ func TestNewAuthenticatorScopes(t *testing.T) {
 		"https://www.googleapis.com/auth/gmail.labels":         false,
 		"https://www.googleapis.com/auth/tasks":                false,
 		"https://www.googleapis.com/auth/calendar":             false,
+		"https://www.googleapis.com/auth/drive":                false,
 	}
 	for _, s := range a.cfg.Scopes {
 		if _, ok := want[s]; ok {