Google OAuth verification (exit test mode)

[Phoenix-]

Get the Google Cloud project out of "Testing" mode so Meridian works for non-test users without the 7-day token tax.

Why it matters

• Refresh tokens stop expiring after 7 days. This is the main pain. Note: the 7-day expiry is a property of Testing publishing status specifically — publishing to Production removes it even without verification (source). The re-auth UI exists as a workaround but it's a tax on every user.
• "Unverified app" warning goes away (only with full verification).
• Required before any non-test-user can use Meridian at scale.

Scope classification — CONFIRMED sensitive, not restricted

Google's canonical restricted-scopes list (support.google.com/cloud/answer/13464325) contains only Gmail, Drive, Fit, Chat, Data Portability, Photos Ambient, Health.

Calendar and Tasks are not on it — calendar, calendar.readonly, and all tasks scopes are sensitive, never restricted. Read-vs-write is a separate axis; full read-write calendar is still only sensitive.

➡️ CASA / third-party security assessment does NOT apply to us, ever. Verification is paperwork + a demo video, at $0.

Options (all $0, except a possible ~$10/yr domain for verification)

Path	Verification	CASA	User limit	7-day expiry	Notes
Stay in Testing (current)	no	no	100 test users	present	status quo
Production, unverified	no	no	100 / project lifetime, no reset (src)	gone	"unverified app" screen on first login
Production, verified	yes	no	none	gone	clean public release
BYO client_id (user makes own Cloud project)	not needed	no	none	gone	needs a setup wizard; most "in-spirit" for OSS

Process for full verification (clean public-release path)

1. OAuth consent screen filled completely: app name, logo, support + developer emails.
2. App homepage describing the app (github.io works).
3. Privacy policy hosted page — must include the Limited Use disclosure referencing the Google API Services User Data Policy. Our offline / no-backend design makes this short and honest (data stays in %APPDATA%\Meridian, nothing sent anywhere).
4. Domain verification in Search Console under the project-owning account. ⚠️ Only real snag: *.github.io is GitHub's domain — we generally can't verify ownership. Likely need a cheap custom domain (~$10/yr) CNAME'd to Pages just for this.
5. Demo video (YouTube): show the consent screen with client ID/URL visible + how each scope is used in-app.
6. Scope justification text for each scope.
7. Submit; expect weeks of back-and-forth — track here.

⚠️ Code currently requests readonly, not read-write

Meridian/Auth/GoogleOAuthClient.cs currently requests calendar.readonly + tasks.readonly + email + profile. If we want create/edit, widen scopes before Production/verification — changing scopes after users consent forces everyone to re-authorize. Decide read-vs-write first.

Recommendation

• Free offline pet tool → Production-unverified kills the 7-day pain at $0, capped at 100 lifetime users.
• Genuine public release → full verification is free (only blocker is the github.io domain snag). Makes the v1.0 milestone realistic.
• BYO client_id sidesteps Google gatekeeping entirely at the cost of a one-time user setup wizard.

[Phoenix-]

Decision: sequence locked in

Agreed plan (independent of each other — don't conflate publishing with verification):

1. Widen scopes to full calendar + tasks NOW, while still in Testing — done in code (GoogleOAuthClient.cs). Requested ahead of the read-write UI on purpose: while unverified the consent screen isn't under review, so asking for write early is harmless, and it means current/future users won't be forced to re-consent when create/edit features actually land. (Scope changes after consent = forced re-auth for every user — that's a user-UX cost, not a Google one.)
2. Publish App → Production (stay unverified) — do this soon, separately from verification. The 7-day refresh-token expiry is a property of Testing status only; publishing kills it immediately at $0. Trade-off while unverified: "unverified app" screen on first login + 100-user lifetime cap. Fine for the current phase.
3. Defer verification until read-write features (and optionally directory.readonly autocomplete) are actually in the UI — then do one clean round with the final scope set. Adding a scope later = another verification round (new demo video + justification, weeks), while already-approved scopes keep working. So we submit once, "по делу", and stick to it.

Note on email-autocomplete from org directory (future)

• Cheapest path needs no new scope: build an autocomplete index from attendees of past events (already in our calendar data). Works for everyone, zero verification impact. Do this first.
• True directory search = People API directory.readonly — sensitive, not restricted (no CASA), but only returns org directory for Workspace users; personal @gmail accounts have no directory. Add it only when the feature ships, not preemptively.
• Avoid Admin SDK admin.directory.* — admin-tier, broad, will draw reject questions; wrong tool for autocomplete.

[Phoenix-]

✅ Published to Production (unverified) — 2026-05-29

Step 2 of the plan is done. The 7-day refresh-token expiry — the whole reason this issue existed — is resolved. Status is now "In production".

What was done

• Scopes set on the consent screen (match the code in GoogleOAuthClient.cs):
  • auth/calendar (full, sensitive)
  • auth/tasks (full, sensitive)
  • auth/directory.readonly (People API, sensitive) — laid in early ahead of the autocomplete feature, same "avoid future re-consent" logic as RW. Confirmed planned feature (org-directory email autocomplete — useful in the Workspace setting).
  • Restricted scopes: none → no CASA, confirmed.
  • email/profile are openid/non-sensitive (Google doesn't list them in the table).
• Consent screen links (github.com blob URLs): homepage = repo, privacy = PRIVACY.md, TOS = TERMS.md. github.com added to Authorized domains.
• Published → Production, staying unverified.

Current state

• Works for any Google account, no more 7-day expiry.
• "Your app requires verification" banner is shown — reminder, not a blocker. Do NOT click "Submit for verification" yet.
• Trade-offs while unverified: "Google hasn't verified this app" screen on first login + 100-user lifetime cap (no reset).

Remaining for full verification (deferred — not started)

Submit once, with the final scope set, when these are ready:

1. Read-write features in the UI (create/edit/delete events + tasks) — needed for the demo video.
2. Directory autocomplete in the UI — so directory.readonly is demonstrably used.
3. Verifiable domain — github.com can't be domain-verified; need our own domain / github.io under a custom domain (Set up github.io site: homepage + privacy policy hosting #12).
4. Demo video + scope justification + logo (logo already prepared).

Keeping this issue open to track the eventual verification submission. The publishing milestone itself is met.