google grant checkboxes unticked

[tomholub]

Roman:

I just signed up in the app, but after login with my gmail account I got these errors in console:

":information_source:[ERROR HANDLING] ErrorHandler should be used for this error ***** missedBackupQuery(FlowCrypt.GmailServiceError.providerError(Error Domain=com.google.GTLRErrorObjectDomain Code=403 "Request had insufficient authentication scopes." UserInfo={GTLRStructuredError=GTLRErrorObject 0x281c6a2e0: {code:403 errors:[1] message:"Request had insufficient authentication scopes." status:"PERMISSION_DENIED"}, NSLocalizedDescription=Request had insufficient authentication scopes.}))"
":information_source:[Setup][SetupInitialViewController] Changed to new state error(FlowCrypt.GmailServiceError.missedBackupQuery(FlowCrypt.GmailServiceError.providerError(Error Domain=com.google.GTLRErrorObjectDomain Code=403 "Request had insufficient authentication scopes." UserInfo={GTLRStructuredError=GTLRErrorObject 0x281c6a2e0: {code:403 errors:[1] message:"Request had insufficient authentication scopes." status:"PERMISSION_DENIED"}, NSLocalizedDescription=Request had insufficient authentication scopes.})))"

Me:

Did you untick any of the checkboxes during oauth grant maybe?

Roman:

No, I haven't unticked anything, just tapped "Allow"
I restarted app and checkbox was unticked by default
So probably Gmail needs user to manually tick checkboxes for allowing access

Me:

Not normal - very interesting. Most users first use the browser extension, where this is not needed. I wonder if they then use the iOS app second, it's already pre-checked. Let's move this conversation to GitHub, it would be good to have it documented. I'll file an issue.

[tomholub]

How to triage:

1. create a new vanilla Gmail account. Don't use it with any other FlowCrypt app
2. try to sign up with Continue with Gmail
3. are the checkboxes on the grant screen checked or unchecked by default?

Then try something similar on an account where FlowCrypt was already used (or same account after doing it at least once successfully)

[tomholub]

[tomholub]

I suppose the scope we pass into google auth request must be wrong, or there is some other similar problem. You could compare the code to Android or browser extension, or to other apps that use Google oauth with additional scopes, and see what went wrong.

[sosnovsky]

@tomholub I tried to change full mail access scope https://mail.google.com/ to scopes which are used in browser extension - https://www.googleapis.com/auth/gmail.compose and https://www.googleapis.com/auth/gmail.modify.
But now google auth screen shows security alert, maybe FlowCrypt app should pass some additional review before asking these permissions?

[sosnovsky]

Here more information about unverified apps - https://support.google.com/cloud/answer/7454865?hl=en

[tomholub]

I think we'll have to retain the full scope - we need more permissions on mobile because it's a full-fledged mail client, unlike the browser extension which is an add-on to an existing mail client (the Gmail webmail).

I suppose the better place to look may be the Android app then - since it's similar in scope to iOS.

What is the bundle id of the app that gets built from the IDE this way? Is it com.flowcrypt.ios.debug? Is the team id showing W57XRJ27NX?

Usage also looks ok (but unsure why still limited - will check)

Scopes look ok:

I went ahead and re-submitted it for verification. Maybe that will help. At the same time I added scope for contacts: #462 #283

Let's wait what that will bring us. Thanks for looking into this! I'll un-assign you until I have news regarding the verification.