Fix Google OAuth: explicit IAM policy + strip OIDC scopes from credentials

2026-05-08 16:57:40 -05:00
parent d68ddab8a2
commit 9b56aa83df
11 changed files with 288 additions and 36 deletions
--- a/src/lambdas/oauth-handler/handler.py
+++ b/src/lambdas/oauth-handler/handler.py
@@ -174,7 +174,7 @@ def handle_callback(params: dict) -> dict:
        'token_uri': 'https://oauth2.googleapis.com/token',
        'client_id': client_id,
        'client_secret': client_secret,
-        'scopes': SCOPES.split(),
+        'scopes': [s for s in SCOPES.split() if s.startswith('https://')],
        'email': user_email,
        'user_email': user_email,
    }