feat: adds the ability to extend the scopes for google api tools that require more than the discovery doc requires

Author: tonycoco

src/google/adk/tools/base_toolset.py

@@ -192,7 +192,7 @@ def from_config(
     raise ValueError(f"from_config() not implemented for toolset: {cls}")
 
   def _is_tool_selected(
-      self, tool: BaseTool, readonly_context: ReadonlyContext
+      self, tool: BaseTool, readonly_context: Optional[ReadonlyContext]
   ) -> bool:
     if not self.tool_filter:
       return True

src/google/adk/tools/google_api_tool/google_api_toolset.py

@@ -24,6 +24,7 @@
 from ...agents.readonly_context import ReadonlyContext
 from ...auth.auth_credential import ServiceAccount
 from ...auth.auth_schemes import OpenIdConnectWithConfig
+from ...tools.base_tool import BaseTool
 from ...tools.base_toolset import BaseToolset
 from ...tools.base_toolset import ToolPredicate
 from ..openapi_tool import OpenAPIToolset
@@ -48,6 +49,7 @@ class GoogleApiToolset(BaseToolset):
     tool_name_prefix: Optional prefix to add to all tool names in this toolset.
     additional_headers: Optional dict of HTTP headers to inject into every request
       executed by this toolset.
+    additional_scopes: Optional list of additional scopes to request.
   """
 
   def __init__(
@@ -61,6 +63,7 @@ def __init__(
       tool_name_prefix: Optional[str] = None,
       *,
       additional_headers: Optional[Dict[str, str]] = None,
+      additional_scopes: Optional[List[str]] = None,
   ):
     super().__init__(tool_filter=tool_filter, tool_name_prefix=tool_name_prefix)
     self.api_name = api_name
@@ -69,12 +72,13 @@ def __init__(
     self._client_secret = client_secret
     self._service_account = service_account
     self._additional_headers = additional_headers
+    self._additional_scopes = additional_scopes
     self._openapi_toolset = self._load_toolset_with_oidc_auth()
 
   @override
   async def get_tools(
       self, readonly_context: Optional[ReadonlyContext] = None
-  ) -> List[GoogleApiTool]:
+  ) -> list[BaseTool]:
     """Get all tools in the toolset."""
     return [
         GoogleApiTool(
@@ -95,11 +99,17 @@ def _load_toolset_with_oidc_auth(self) -> OpenAPIToolset:
     spec_dict = GoogleApiToOpenApiConverter(
         self.api_name, self.api_version
     ).convert()
-    scope = list(
+    discovery_scopes = list(
         spec_dict['components']['securitySchemes']['oauth2']['flows'][
             'authorizationCode'
         ]['scopes'].keys()
-    )[0]
+    )
+    default_scope = discovery_scopes[0] if discovery_scopes else None
+
+    scopes = ([default_scope] if default_scope else []) + (
+        self._additional_scopes or []
+    )
+
     return OpenAPIToolset(
         spec_dict=spec_dict,
         spec_str_type='yaml',
@@ -117,7 +127,7 @@ def _load_toolset_with_oidc_auth(self) -> OpenAPIToolset:
                 'client_secret_basic',
             ],
             grant_types_supported=['authorization_code'],
-            scopes=[scope],
+            scopes=scopes,
         ),
     )
 

tests/unittests/tools/google_api_tool/test_google_api_toolset.py

@@ -158,6 +158,35 @@ def test_init(
     assert isinstance(kwargs["auth_scheme"], OpenIdConnectWithConfig)
     assert kwargs["auth_scheme"].scopes == [DEFAULT_SCOPE]
 
+  @mock.patch(
+      "google.adk.tools.google_api_tool.google_api_toolset.OpenAPIToolset"
+  )
+  @mock.patch(
+      "google.adk.tools.google_api_tool.google_api_toolset.GoogleApiToOpenApiConverter"
+  )
+  def test_init_with_additional_scopes(
+      self,
+      mock_converter_class,
+      mock_openapi_toolset_class,
+      mock_converter_instance,
+      mock_openapi_toolset_instance,
+  ):
+    """Test GoogleApiToolset initialization with additional scopes."""
+    mock_converter_class.return_value = mock_converter_instance
+    mock_openapi_toolset_class.return_value = mock_openapi_toolset_instance
+
+    extra_scopes = ["https://www.googleapis.com/auth/calendar.readonly"]
+    tool_set = GoogleApiToolset(
+        api_name=TEST_API_NAME,
+        api_version=TEST_API_VERSION,
+        additional_scopes=extra_scopes,
+    )
+
+    mock_openapi_toolset_class.assert_called_once()
+    _, kwargs = mock_openapi_toolset_class.call_args
+    assert isinstance(kwargs["auth_scheme"], OpenIdConnectWithConfig)
+    assert kwargs["auth_scheme"].scopes == [DEFAULT_SCOPE] + extra_scopes
+
   @mock.patch(
       "google.adk.tools.google_api_tool.google_api_toolset.GoogleApiTool"
   )