googleapis / googleapis/gapic-generator-ruby
[Ruby] Consider limiting scopes for cloud services to cloud-platform
- Dominant language
- Ruby
- Stars
- 50
- Forks
- 36
- Avg merge
- 1d 1h
- Merged PRs (30d)
- 6
Description
The generated credentials class currently copies the scopes listed in the discovery doc. However, the discovery doc lists scopes that _could_ be used, whereas the credentials class specifies scopes that _must_ be present. As a result of this semantic mismatch, cloud services often require redundant scopes—typically both `"https://www.googleapis.com/auth/cloud-platform"` _and_ service-specific scopes—in their credentials request. For example, currently, the generated trace client specifies these scopes:
```ruby
SCOPE = [
"https://www.googleapis.com/auth/cloud-platform",
"https://www.googleapis.com/auth/trace.append",
"https://www.googleapis.com/auth/trace.readonly"
].freeze
```
For cloud platform services, we should require only `cloud-platform` if that is sufficient (which it usually should be):
```ruby
SCOPE = [
"https://www.googleapis.com/auth/cloud-platform"
].freeze
```
Contributor guide
Assessment
This issue has not been assessed yet.