From 7a6dc7d9aed2dcac23882fc107bd056ef47ff1c7 Mon Sep 17 00:00:00 2001 From: Power BI Dev Date: Mon, 27 Jul 2026 22:16:31 +0700 Subject: [PATCH] fix invalid_scope error on token refresh MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Requesting a narrower scope explicitly (scopes=[...]) during refresh was rejected by Google as invalid_scope in the Airflow container's google-auth version, even though it worked locally with a newer one. Drop scopes= entirely — the refresh_token already carries the full granted scope (calendar + gmail.send), no need to request a subset. --- scripts/edoxid_calendar_gmail.py | 7 ++++++- scripts/edoxid_calendar_google.py | 5 ++++- 2 files changed, 10 insertions(+), 2 deletions(-) diff --git a/scripts/edoxid_calendar_gmail.py b/scripts/edoxid_calendar_gmail.py index af5d18d..b0bc631 100644 --- a/scripts/edoxid_calendar_gmail.py +++ b/scripts/edoxid_calendar_gmail.py @@ -15,13 +15,18 @@ class GmailService: langsung (scope gmail.send, akun OAuth yang sama dengan Calendar).""" def __init__(self, config: GoogleConfig): + # Sengaja TIDAK set `scopes=` di sini: refresh_token sudah membawa scope + # gabungan (calendar + gmail.send) dari OAuth consent aslinya. Meminta + # scope yang lebih sempit secara eksplisit saat refresh terbukti bisa + # ditolak Google dengan `invalid_scope` tergantung versi google-auth + # yang jalan (dites 2026-07-27: lolos di lokal, gagal di container + # Airflow karena google-auth versi lain via apache-airflow-providers-google). creds = Credentials( token=None, refresh_token=config.refresh_token, token_uri="https://oauth2.googleapis.com/token", client_id=config.client_id, client_secret=config.client_secret, - scopes=["https://www.googleapis.com/auth/gmail.send"], ) creds.refresh(Request()) diff --git a/scripts/edoxid_calendar_google.py b/scripts/edoxid_calendar_google.py index bcf3f91..08bb891 100644 --- a/scripts/edoxid_calendar_google.py +++ b/scripts/edoxid_calendar_google.py @@ -127,13 +127,16 @@ class GoogleCalendarService: def __init__(self, config: GoogleConfig): self._calendar_id = config.calendar_id + # Sengaja TIDAK set `scopes=` — lihat catatan di GmailService.__init__ + # (edoxid_calendar_gmail.py) soal `invalid_scope` yang muncul di + # container Airflow (google-auth versi lain) saat scope refresh + # diminta lebih sempit dari yang tercakup refresh_token aslinya. creds = Credentials( token=None, refresh_token=config.refresh_token, token_uri="https://oauth2.googleapis.com/token", client_id=config.client_id, client_secret=config.client_secret, - scopes=["https://www.googleapis.com/auth/calendar"], ) creds.refresh(Request())