Chat scope expansion phase 2: memberships, delete, custom emoji, users.* (FULL only)

by adom

Drive your whole Google Workspace from the terminal, run by your AI. Read Gmail, write Google Docs, build Google Sheets and Google Slides, search Google Drive, manage Google Calendar and Google Tasks, and post to Google Chat, plus any Google API and a zero-setup personal Gmail.

Overview Files Skills Discover Packages Releases Dependencies Issues1 Breadcrumbs Pull Requests Activity

Closed general

John Lauer · 3mo ago ·closed by John Lauer

v0.8.5 widened FULL to chat.spaces (create + metadata) and SAFE to chat.spaces.create, per the wiki-notify-gchat thread's minimum ask. The rest of their proposed non-admin set is deferred and tracked here:

chat.memberships (add/remove members and managers)
chat.delete (FULL only, never SAFE - it is the only delete-all-flavored Chat scope)
chat.customemojis
chat.users.readstate / chat.users.spacesettings / chat.users.availability / chat.users.sections

chat.admin.* stays OUT permanently (consistent with the Admin/Directory opt-in policy). Each addition must also update docs/google-verification-justifications.md since the consent screen grows. Tokens issued before the widening need re-auth: adom-google scopes --require chat.spaces --auto-widen.

1 Reply

John Lauer · 3mo ago

Done in adom-google 0.8.8.

SCOPES_FULL now adds all seven: chat.memberships, chat.delete, chat.customemojis, and the chat.users.* family (readstate, spacesettings, availability, sections).

SCOPES_SAFE is unchanged, still create-only: no delete, no membership changes. chat.admin.* is permanently excluded, it is an org-wide admin surface rather than a drive-my-own-Chat capability.

The part worth recording. I validated every scope string against Google's authorize endpoint before it went anywhere near the constant, and control-tested the probe with deliberately bogus scopes to prove it actually detects failures. That matters more than it sounds: a single invalid scope string makes Google reject the whole auth request with invalid_scope, so a typo here breaks sign-in for every user, not just the new capability. chat.users.availability and chat.users.sections were the two I could not confirm from memory. Both are real. I then verified the combined 17-scope FULL set, plus SAFE and PERSONAL, each still produce a valid consent URL.

Nobody is forced to re-auth. A refresh token keeps the scopes it was granted, so existing tokens are untouched and keep working. Picking the new ones up is opt-in, per user, at the moment something actually needs them:

adom-google scopes --require chat.memberships --auto-widen

docs/google-verification-justifications.md has a justification for each added scope, including why chat.delete is full-mode-only and why chat.admin.* is never requested, since the consent screen grows and Google will ask.

Closing, the phase-2 list is fully shipped.