From 8cbdf5d1f27cd65bc2305484040ce6361e7345bf Mon Sep 17 00:00:00 2001 From: Vishnuvardhan Reddy Date: Thu, 26 Feb 2026 15:22:17 +0000 Subject: [PATCH] fix(auth): include full scopes when refreshing Google OAuth token The refresh was using reduced scopes (openid profile email) instead of the original scopes (cloud-platform, userinfo.email, etc.). This caused Google to return tokens with insufficient permissions, resulting in 'Request had insufficient authentication scopes' errors. Now uses cfg.Scopes (the original OAuth scopes) when refreshing to maintain the full permission set. --- pkg/auth/oauth.go | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/pkg/auth/oauth.go b/pkg/auth/oauth.go index ba757ffd4..fa9170187 100644 --- a/pkg/auth/oauth.go +++ b/pkg/auth/oauth.go @@ -326,11 +326,17 @@ func RefreshAccessToken(cred *AuthCredential, cfg OAuthProviderConfig) (*AuthCre return nil, fmt.Errorf("no refresh token available") } + // Use the same scopes as the original OAuth flow to prevent scope reduction + scope := cfg.Scopes + if scope == "" { + scope = "openid profile email" + } + data := url.Values{ "client_id": {cfg.ClientID}, "grant_type": {"refresh_token"}, "refresh_token": {cred.RefreshToken}, - "scope": {"openid profile email"}, + "scope": {scope}, } if cfg.ClientSecret != "" { data.Set("client_secret", cfg.ClientSecret)