Exercise every Google scope against a real account

[fajarhide]

The consent screen makes you justify each restricted scope in writing and then demonstrate it on video. Both go better when the claims have been run rather than reasoned about, and a scope that quietly stopped working is worth finding before a reviewer does.

npm run check:google, with GATEWAY_URL and SELAT_TOKEN set. Fifteen calls in four groups:

calendar.calendarlist.readonly   list_calendars
calendar.events                  list_events, create_event, delete_event
drive                            list_files, get_file, create_folder,
                                 rename_file, delete_file
gmail.modify                     get_profile, list_messages, get_message,
                                 send_message, modify_message, trash_message

Everything it creates it removes: a scratch event a year out, a scratch folder, a message to the account's own address. It reads two existing rows and changes neither. The event sits in 2027 on purpose, so a run that dies before cleanup leaves something obviously synthetic rather than something in next week's view.

Run against api.selat.dev on v0.1.3, ids and names cut because this is a public repo:

calendar.calendarlist.readonly
  ok    gcal__list_calendars     3 rows
calendar.events
  ok    gcal__list_events        25 rows
  ok    gcal__create_event       created ...
  ok    gcal__delete_event       deleted ...
drive
  ok    gdrive__list_files       25 rows
  ok    gdrive__get_file         read ...
  ok    gdrive__create_folder    created ...
  ok    gdrive__rename_file      renamed to selat-scope-check-renamed
  ok    gdrive__delete_file      deleted ...
gmail.modify
  ok    gmail__get_profile       ...
  ok    gmail__list_messages     25 rows
  ok    gmail__get_message       read ...
  ok    gmail__send_message      sent ...
  ok    gmail__modify_message    labels UNREAD,STARRED,SENT,INBOX
  ok    gmail__trash_message     labels UNREAD,STARRED,TRASH,SENT

all scopes exercised, nothing left behind

The last two lines are the ones that matter. INBOX becoming TRASH after a send is what separates gmail.modify from gmail.readonly plus gmail.send.

It prints file ids and never file names. The output ends up in issues and on screen while recording, and a document title is the one field in the run that can carry something private.

Not in vitest: it needs a live gateway, a workspace credential and a connected Google account.