Hacktoberfest 2026: the issues maintainers tagged for October, open and beginner-friendly. Browse Hacktoberfest issues

Calendar: Additional Scope enforced to be requested when it is not needed

Open
  • Is something wrong?
#17,922 15 comments 0 reactions 0 assignees View on GitHub

Maintainers usually reply within 1 day

Nobody has claimed this yet.

Assessment

Difficulty
4/5
Estimated time
3-5 days
Newbie friendliness
35/100
Issue type
Bug
Clarity
Mostly clear
Activity status
Stale
Tech stack
java
Domain
api, authentication

Research direction

Start by tracing the GoogleSignInOptions requestScopes(CalendarScopes.CALENDAR_EVENTS_READONLY) flow into UserRecoverableAuthIOException and the recovery Intent. Compare that behavior with the Calendar events.list scope documented in the external reference; done means listing events with the readonly scope does not request the broader calendar scope.

Written by the indexing model from the issue text.

Description

api: calendar priority: p3 type: bug
Environment details
  1. Specify the API at the beginning of the title. Calendar API
  2. OS type and version: Android target SDK 33
  3. Java version: Android 13
  4. version(s): com.google.apis:google-api-services-calendar:v3-rev20230707-2.0.0
Steps to reproduce
  1. Sign-In to Google and request Scope CALENDAR_EVENTS_READONLY =
    https://www.googleapis.com/auth/calendar.events.readonly"
  2. Retrieve the Calendar Events List for a certain CalendarID
  3. Get warning [GoogleAuthUtil] isUserRecoverableError status: NEED_REMOTE_CONSENT, which triggers exception UserRecoverableAuthIOException
  4. Upon handling exception, Request_Permission is requesting Scope "https://www.googleapis.com/auth/calendar". This is not needed, as observed in https://developers.google.com/calendar/api/v3/reference/events/list, and selecting only the events.readonly scope
Code example (simplified)
        GoogleSignInOptions mGoogleSignInOptions = new GoogleSignInOptions.Builder(GoogleSignInOptions.DEFAULT_SIGN_IN)
                .requestEmail()
                .requestScopes(new Scope(CalendarScopes.CALENDAR_EVENTS_READONLY)) //https://developers.google.com/identity/protocols/oauth2/scopes#calendar
                .build();

        // Build a GoogleSignInClient with the options specified by gso.
        GoogleSignInClient mGoogleSignInClient = GoogleSignIn.getClient(MainActivity.this, mGoogleSignInOptions);
        Intent signInIntent = mGoogleSignInClient.getSignInIntent();
        startActivityForResult(signInIntent, SIGN_IN_REQUEST_CODE); 


            do {
                page++;
                Events events;
                Log.i(appLogTAG, "Sending events request, page "+page);

                events = calendarService.events().list(calendarID).execute();


                List<Event> items = events.getItems();

                for (Event event : items) {
                    //some work
                }

                pageToken = events.getNextPageToken();
                syncToken = events.getNextSyncToken();
            } while (pageToken != null);


        }catch (UserRecoverableAuthIOException e) {
            toastInUI("Error while retrieving data. ");

            //request missing permissions
            Intent intent = e.getIntent();
            intent.addFlags(Intent.FLAG_ACTIVITY_NEW_TASK);
            appContext.startActivity(intent);

        } catch (GoogleJsonResponseException e) {
            if (e.getStatusCode() == 410) {
                // A 410 status code, "Gone", indicates that the sync token is invalid.
                Log.e(appLogTAG,"Invalid sync token, clearing event store and re-syncing.");
            } else {
                throw new RuntimeException(e);
            }
        }catch (SocketTimeoutException e) {
            Log.e(appLogTAG, "Timeout while retrieving data.");
            toastInUI("Timeout while retrieving data.");
        }catch (IOException e) {
            Log.e(appLogTAG, "Unknown error.");
            throw new RuntimeException(e);
        }
Stack trace
W  [GoogleAuthUtil] isUserRecoverableError status: NEED_REMOTE_CONSENT
External references such as API reference guides
Any additional information below

I have tried debugging to understand where the enforced permission request comes from without success. From the link in External References the requested Scope is enough to list all events in the Calendar.

Thanks!

Dominant language
Java
Stars
725
Forks
395
Avg merge
36m
Merged PRs (30d)
212

Getting set up

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from googleapis/google-api-java-client-services

All issues in googleapis/google-api-java-client-services

Similar issues

More Java issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.