Auth login missing scopes for People and Meet APIs

[aaronsb]

Summary

gws auth login does not offer OAuth scopes for the People API (contacts.readonly) or Meet REST API (meetings.space.created) in its interactive scope selector, even though gws supports both people and meet as services with full API discovery.

Steps to reproduce

1. Run gws auth login
2. Observe the interactive scope selector — only 9 scopes offered:
   • Drive, Sheets, Gmail, Calendar, Docs, Slides, Tasks, Pub/Sub, Cloud Platform
3. Run gws schema people.people.searchContacts — shows it requires contacts or contacts.readonly scope
4. Run gws schema meet.spaces.create — shows it requires meetings.space.created scope
5. Try to call gws people people searchContacts ... — fails with "insufficient authentication scopes"
6. Try to call gws meet spaces create — fails with "insufficient authentication scopes"

Expected behavior

The auth login scope selector should include all scopes needed by the services gws supports, including:

• https://www.googleapis.com/auth/contacts.readonly (or contacts) for the People API
• https://www.googleapis.com/auth/meetings.space.created for the Meet API

Workaround attempted

Manually editing the OAuth authorization URL to include the missing scopes before submitting — Google's consent screen shows the additional permissions, but gws's local callback server does not capture them in the resulting credential.

Environment

• gws 0.13.3
• Linux x86_64

Context

We're building an MCP server on top of gws (google-workspace-mcp) and discovered this while expanding coverage to all gws-supported services. The factory architecture generates tools from gws's own API discovery, so it's natural to expect auth to cover the same services.

[aaronsb]

Reproduction evidence (gws 0.13.3, Linux x86_64)

Auth scopes granted (all 9 available in selector + cloud-platform)

$ gws auth status --format json | jq .scopes
[
  "https://www.googleapis.com/auth/calendar",
  "https://www.googleapis.com/auth/cloud-platform",
  "https://www.googleapis.com/auth/documents",
  "https://www.googleapis.com/auth/drive",
  "https://www.googleapis.com/auth/gmail.modify",
  "https://www.googleapis.com/auth/presentations",
  "https://www.googleapis.com/auth/pubsub",
  "https://www.googleapis.com/auth/spreadsheets",
  "https://www.googleapis.com/auth/tasks",
  "https://www.googleapis.com/auth/userinfo.email",
  "openid"
]

People API — gws knows the required scopes but can't grant them

$ gws schema people.people.searchContacts | jq .scopes
[
  "https://www.googleapis.com/auth/contacts",
  "https://www.googleapis.com/auth/contacts.readonly"
]

$ gws people people searchContacts \
    --params '{"query":"Aaron","readMask":"names,emailAddresses","sources":"READ_SOURCE_TYPE_CONTACT"}' \
    --format json
{
  "error": {
    "code": 403,
    "message": "Request had insufficient authentication scopes.",
    "reason": "unknown"
  }
}

Meet API — same pattern

$ gws schema meet.spaces.create | jq .scopes
[
  "https://www.googleapis.com/auth/meetings.space.created"
]

$ gws meet spaces create --format json
{
  "error": {
    "code": 403,
    "message": "Request had insufficient authentication scopes.",
    "reason": "unknown"
  }
}

Summary

gws schema correctly reports that People requires contacts/contacts.readonly and Meet requires meetings.space.created, but gws auth login does not offer these scopes. The cloud-platform super-scope also does not satisfy these APIs.

[anoblet]

I have authorized https://www.googleapis.com/auth/contacts to my project, though I still receive the error:

$ gws people people searchContacts --params '{"query":"","readMask":"names,emailAddresses"}'
{
  "error": {
    "code": 403,
    "message": "Request had insufficient authentication scopes.",
    "reason": "unknown"
  }
}

[jbasso-dev]

Came up with a PR for the Meet part. #736

In the mean time, you go around the issue by using gws auth login --scopes with exact list of scopes you are requesting

E.g.

gws auth login --scopes \
https://www.googleapis.com/auth/meetings.space.readonly,\
https://www.googleapis.com/auth/meetings.space.created,\
https://www.googleapis.com/auth/meetings.space.settings