fix: add openid to OAuth SCOPES to unblock auth flow - #3
Conversation
Add a brainstorm design doc describing the single-line addition of "openid" to config.SCOPES to unblock multi-google-mcp-auth add against oauthlib's scope-change-as-Warning behavior. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Task-by-task plan for the single-line config edit, reinstall, and end-to-end auth-flow verification against the personal account. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Google implicitly grants the openid scope whenever userinfo.email (or any identity-bearing scope) is requested. oauthlib treats the resulting scope-set divergence as a Warning, which it raises as an exception via its warnings-as-errors path, aborting multi-google-mcp-auth add before the token is written to disk. Adding "openid" to the requested set keeps requested and granted aligned, silencing oauthlib without changing the API access we actually hold (we don't consume the OIDC id_token). Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
aria-teknal-studio
left a comment
aria-teknal-studio
left a comment
There was a problem hiding this comment.
No findings.
I reviewed the PR in code-review mode with emphasis on OAuth/auth behavior, security regressions, compatibility, config assumptions, and test coverage.
The runtime change is limited to adding openid to config.SCOPES, which is consistent with Google returning that scope alongside userinfo.email and should keep oauthlib's requested/granted scope comparison aligned. I did not find an authz expansion beyond the OIDC identity scope already implied by the userinfo email flow, and the code does not persist or consume an ID token.
Residual risk: CI covers the static surface and existing mocked auth CLI path, but it still cannot prove the real browser-based Google OAuth callback path. I verified locally:
uv run pytest-> 88 passeduv run ruff check .-> passeduv run mypy-> passed
The live multi-google-mcp-auth add <label> OAuth flow should remain the final verification gate for this fix.
2 participants
Summary
"openid"toSCOPESinsrc/multi_google_mcp/config.py.openidwheneveruserinfo.emailis requested.oauthlibraises the resulting scope-set divergence as aWarning(via its warnings-as-errors path), abortingmulti-google-mcp-auth addbefore the token is written.id_token).Test plan
uv run pytest— 88 passed.uv run ruff check .— All checks passed.uv run mypy— Success: no issues found in 14 source files.uv tool install --reinstall .— installedmulti-google-mcpandmulti-google-mcp-auth.multi-google-mcp-auth add personal— completed withoutoauthlibexception. Token file written at~/.config/multi-google-mcp/accounts/personal.jsonwith mode0o600and scopes[calendar, drive, gmail.modify, userinfo.email, openid].Notes
SCOPESrequires every existing account to be re-added. Onlypersonalexists locally; it was re-added as the verify step.docs/superpowers/specs/2026-05-20-openid-scope-fix-design.md. Plan:docs/superpowers/plans/2026-05-20-openid-scope-fix.md.🤖 Generated with Claude Code