Admin login fails if Google Drive permissions have been granted for the same Google user
- Dominant language
- Python
- Stars
- 53
- Forks
- 16
- Avg merge
- 14d 5h
- Merged PRs (30d)
- 14
Description
Google login to the admin pages at https://lms.staging.hypothes.is/admin breaks if the same Google account used for the login has previously been used to authorize Google Drive access as part of creating an assignment.
**Steps to reproduce:**
1. Create a Google Drive PDF assignment using the Hypothesis LMS staging app. Grant Google Drive access as part of this flow.
2. Go to https://lms.staging.hypothes.is/admin and attempt to login with the same Google account
**Expected:** Login succeeds
**Admin:** Login fails with 500 error
In this scenario, visiting https://lms.staging.hypothes.is/admin redirects to a Google login page with a URL that includes `openid`, `userinfo.email` and `userinfo.profile` scopes. After approving access, Google redirects back to the LMS app at https://lms.staging.hypothes.is/googleauth/login/callback with an authorization code. In the redirect URL the scopes include the requested ones but also have the existing Google Drive scope _added_.
The presence of these existing extra permissions causes an exception on our end ([Sentry](https://hypothesis.sentry.io/issues/6001427034/?project=259908&query=is%3Aunresolved%20issue.priority%3A%5Bhigh%2C%20medium%5D&referrer=issue-stream&stream_index=0)).
A workaround is to go to your Google account settings and revoke Google Drive permissions for the Hypothesis LMS app under security settings.
Contributor guide
No contributing guide indexed for this repository
Assessment
This issue has not been assessed yet.