fix invalid_scope error on token refresh

Requesting a narrower scope explicitly (scopes=[...]) during refresh
was rejected by Google as invalid_scope in the Airflow container's
google-auth version, even though it worked locally with a newer one.
Drop scopes= entirely — the refresh_token already carries the full
granted scope (calendar + gmail.send), no need to request a subset.

scripts/edoxid_calendar_gmail.py

@@ -15,13 +15,18 @@ class GmailService:
     langsung (scope gmail.send, akun OAuth yang sama dengan Calendar)."""
 
     def __init__(self, config: GoogleConfig):
+        # Sengaja TIDAK set `scopes=` di sini: refresh_token sudah membawa scope
+        # gabungan (calendar + gmail.send) dari OAuth consent aslinya. Meminta
+        # scope yang lebih sempit secara eksplisit saat refresh terbukti bisa
+        # ditolak Google dengan `invalid_scope` tergantung versi google-auth
+        # yang jalan (dites 2026-07-27: lolos di lokal, gagal di container
+        # Airflow karena google-auth versi lain via apache-airflow-providers-google).
         creds = Credentials(
             token=None,
             refresh_token=config.refresh_token,
             token_uri="https://oauth2.googleapis.com/token",
             client_id=config.client_id,
             client_secret=config.client_secret,
-            scopes=["https://www.googleapis.com/auth/gmail.send"],
         )
         creds.refresh(Request())
 

scripts/edoxid_calendar_google.py

@@ -127,13 +127,16 @@ class GoogleCalendarService:
     def __init__(self, config: GoogleConfig):
         self._calendar_id = config.calendar_id
 
+        # Sengaja TIDAK set `scopes=` — lihat catatan di GmailService.__init__
+        # (edoxid_calendar_gmail.py) soal `invalid_scope` yang muncul di
+        # container Airflow (google-auth versi lain) saat scope refresh
+        # diminta lebih sempit dari yang tercakup refresh_token aslinya.
         creds = Credentials(
             token=None,
             refresh_token=config.refresh_token,
             token_uri="https://oauth2.googleapis.com/token",
             client_id=config.client_id,
             client_secret=config.client_secret,
-            scopes=["https://www.googleapis.com/auth/calendar"],
         )
         creds.refresh(Request())