Repository navigation
Calendar: Additional Scope enforced to be requested when it is not needed #17922
Description
Environment details
- Specify the API at the beginning of the title. Calendar API
- OS type and version: Android target SDK 33
- Java version: Android 13
- version(s): com.google.apis:google-api-services-calendar:v3-rev20230707-2.0.0
Steps to reproduce
- Sign-In to Google and request Scope CALENDAR_EVENTS_READONLY =
https://www.googleapis.com/auth/calendar.events.readonly" - Retrieve the Calendar Events List for a certain CalendarID
- Get warning [GoogleAuthUtil] isUserRecoverableError status: NEED_REMOTE_CONSENT, which triggers exception UserRecoverableAuthIOException
- Upon handling exception, Request_Permission is requesting Scope "https://www.googleapis.com/auth/calendar". This is not needed, as observed in https://developers.google.com/calendar/api/v3/reference/events/list, and selecting only the events.readonly scope
Code example (simplified)
GoogleSignInOptions mGoogleSignInOptions = new GoogleSignInOptions.Builder(GoogleSignInOptions.DEFAULT_SIGN_IN)
.requestEmail()
.requestScopes(new Scope(CalendarScopes.CALENDAR_EVENTS_READONLY)) //https://developers.google.com/identity/protocols/oauth2/scopes#calendar
.build();
// Build a GoogleSignInClient with the options specified by gso.
GoogleSignInClient mGoogleSignInClient = GoogleSignIn.getClient(MainActivity.this, mGoogleSignInOptions);
Intent signInIntent = mGoogleSignInClient.getSignInIntent();
startActivityForResult(signInIntent, SIGN_IN_REQUEST_CODE);
do {
page++;
Events events;
Log.i(appLogTAG, "Sending events request, page "+page);
events = calendarService.events().list(calendarID).execute();
List<Event> items = events.getItems();
for (Event event : items) {
//some work
}
pageToken = events.getNextPageToken();
syncToken = events.getNextSyncToken();
} while (pageToken != null);
}catch (UserRecoverableAuthIOException e) {
toastInUI("Error while retrieving data. ");
//request missing permissions
Intent intent = e.getIntent();
intent.addFlags(Intent.FLAG_ACTIVITY_NEW_TASK);
appContext.startActivity(intent);
} catch (GoogleJsonResponseException e) {
if (e.getStatusCode() == 410) {
// A 410 status code, "Gone", indicates that the sync token is invalid.
Log.e(appLogTAG,"Invalid sync token, clearing event store and re-syncing.");
} else {
throw new RuntimeException(e);
}
}catch (SocketTimeoutException e) {
Log.e(appLogTAG, "Timeout while retrieving data.");
toastInUI("Timeout while retrieving data.");
}catch (IOException e) {
Log.e(appLogTAG, "Unknown error.");
throw new RuntimeException(e);
}
Stack trace
W [GoogleAuthUtil] isUserRecoverableError status: NEED_REMOTE_CONSENT
External references such as API reference guides
Any additional information below
I have tried debugging to understand where the enforced permission request comes from without success. From the link in External References the requested Scope is enough to list all events in the Calendar.
Thanks!
Activity
blakeli0 commentedon Aug 25, 2023
@TimurSadykov Is this something you can help with?
suztomo commentedon Sep 1, 2023
@bunnis Would you attach the stacktrace? It tells file name and line number that causes the exception.
"W" at the beginning is warning.
bunnis commentedon Sep 1, 2023
@suztomo I don't have any indication of the line number that causes the exception, this is what I see in Logcat:
suztomo commentedon Sep 8, 2023
Can I see the stacktrace of this exception?
bunnis commentedon Sep 11, 2023
suztomo commentedon Sep 21, 2023
Thank you.
TimurSadykov commentedon Sep 25, 2023
@blakeli0 No, sorry, it looks like this code does not use GUAC auth libs.
bunnis commentedon Oct 9, 2023
any progress?
TimurSadykov commentedon Oct 27, 2023
@bunnis The main problem seems to be the "NEED_REMOTE_CONSENT" error. This seems to be service specific and related to app verification status or error handeling, do you have your app verified, have you tried to handle like in the example?
bunnis commentedon Oct 27, 2023
@TimurSadykov I handle the error correctly and everything works. The main problem is that using the API vs Web, the permissions are different. Via Web I only need read-only permission the access the data. Using the API, if I request the read-only permission then the Error Handling will force me to request read and write permissions. Obviously this is a different behaviour than the Web. Please refer to my initial description in 4:
Upon handling exception, Request_Permission is requesting Scope "https://www.googleapis.com/auth/calendar". This is not needed, as observed in https://developers.google.com/calendar/api/v3/reference/events/list, and selecting only the events.readonly scope
bunnis commentedon Jan 30, 2024
gentle nudge @TimurSadykov
bunnis commentedon Jun 26, 2024
Hello, can someone update the status of this?
bunnis commentedon Sep 22, 2024
Still no updates?
diegomarquezp commentedon Oct 10, 2025
Hi @bunnis, please note that you can ensure fast response times if you have a Google Cloud Support contract by using our Support Hub.
bunnis commentedon Oct 10, 2025
Hi @diegomarquezp
Thank you for the information. I would have expected that an issue reported over two years ago would have been reviewed by now, even without a support contract.
Regards