DEV Community

Oleg Gulevskyy
Oleg Gulevskyy

Posted on

Gmail Addon / OAuth Scopes

Hello

and hope you are doing well, reader of this question.

I came up with my very own, very first small and simple Gmail addon that allows you to respond to multiple emails at the same time with the same text (should have seen my face when I realise it works, even if it is just locally).
Like a batch respond chrome extension that was existing back in a day but just a gmail addon.

Here is how the app works under the hood and what scopes it is using.

gmail.send - to send emails on user behalf (sensitive scope, but not restricted)
gmail.labels - find email threads based on certain label, that we will respond to with a loop (permitted scope)
•gmail.addons.execute* - just a scope to launch the app in the mailing list without a need for contextual triggers (as far as I was told, nobody cares about this scope in Google )
and the last but not least, I think scope gmail.metadata required, which is restricted scope. But I do not understand why this scope is required if my app finds threads by label just fine. All it needs to do is to reply to those threads.
But, whenever I try avoid this scope (metadata), I get this error

Exception: Access denied: : Missing access token for authorization. Request: MailboxService.GetThread.

Hence I am desperate to know, if this somehow can be worked around or this will never work without loads of cash for a security review?

Thank you for even reading this and have a blessed day!

Top comments (1)

Collapse
 
oleggulevskyy profile image
Oleg Gulevskyy

Thanks @Vladimir ! Appreciate your input.
That's really a shame, I was hoping to release this for others to benefit, but seems to be a dead end.