From b7137114163874ed54b368a5af764a7d7291413a Mon Sep 17 00:00:00 2001 From: Andres Sabini Date: Sun, 29 Mar 2026 10:06:32 -0300 Subject: [PATCH] fix: maintain OAuth scopes during Google Antigravity token refresh --- pkg/auth/oauth.go | 18 ++++++++++++------ 1 file changed, 12 insertions(+), 6 deletions(-) diff --git a/pkg/auth/oauth.go b/pkg/auth/oauth.go index 2bf719dd4..28b785fcd 100644 --- a/pkg/auth/oauth.go +++ b/pkg/auth/oauth.go @@ -393,8 +393,12 @@ func RefreshAccessToken(cred *AuthCredential, cfg OAuthProviderConfig) (*AuthCre "client_id": {cfg.ClientID}, "grant_type": {"refresh_token"}, "refresh_token": {cred.RefreshToken}, - "scope": {"openid profile email"}, } + scopes := cfg.Scopes + if scopes == "" { + scopes = "openid profile email" + } + data.Set("scope", scopes) if cfg.ClientSecret != "" { data.Set("client_secret", cfg.ClientSecret) } @@ -545,11 +549,13 @@ func parseTokenResponse(body []byte, provider string) (*AuthCredential, error) { AuthMethod: "oauth", } - // Recent OpenAI OAuth responses may only include chatgpt_account_id in id_token claims. - if id := extractAccountID(tokenResp.IDToken); id != "" { - cred.AccountID = id - } else if id := extractAccountID(tokenResp.AccessToken); id != "" { - cred.AccountID = id + if accountID := extractAccountID(tokenResp.IDToken); accountID != "" { + cred.AccountID = accountID + } else if accountID := extractAccountID(tokenResp.AccessToken); accountID != "" { + cred.AccountID = accountID + } else if accountID := extractAccountID(tokenResp.IDToken); accountID != "" { + // Recent OpenAI OAuth responses may only include chatgpt_account_id in id_token claims. + cred.AccountID = accountID } return cred, nil