Fix Google Photos Picker discovery

Author: zrm625

packages/plugins/google/src/sdk/discovery.test.ts

@@ -53,6 +53,9 @@ it("accepts only supported HTTPS Google Discovery endpoints", () => {
   expect(
     normalizeGoogleDiscoveryUrl("https://chat.googleapis.com/$discovery/rest?version=v1"),
   ).toBe("https://www.googleapis.com/discovery/v1/apis/chat/v1/rest");
+  expect(
+    normalizeGoogleDiscoveryUrl("https://photospicker.googleapis.com/$discovery/rest?version=v1"),
+  ).toBe("https://photospicker.googleapis.com/$discovery/rest?version=v1");
 
   expect(isGoogleDiscoveryUrl("https://www.googleapis.com/discovery/v1/apis/gmail/v1/rest")).toBe(
     true,

packages/plugins/google/src/sdk/discovery.ts

@@ -283,7 +283,9 @@ export const normalizeGoogleDiscoveryUrl = (discoveryUrl: string): string | null
   ) {
     return null;
   }
-  return `${DISCOVERY_SERVICE_HOST}/${service}/${version}/rest`;
+  return service === "photospicker"
+    ? `https://${host}/$discovery/rest?version=${version}`
+    : `${DISCOVERY_SERVICE_HOST}/${service}/${version}/rest`;
 };
 
 const normalizeDiscoveryUrl = (discoveryUrl: string): string => {
@@ -679,12 +681,39 @@ const GOOGLE_OAUTH_SECURITY_SCHEME = "googleOAuth2";
 const GOOGLE_PHOTOS_LIBRARY_SERVICE = "photoslibrary";
 const GOOGLE_PHOTOS_PICKER_SERVICE = "photospicker";
 const GOOGLE_PHOTOS_APPENDONLY_SCOPE = "https://www.googleapis.com/auth/photoslibrary.appendonly";
+const GOOGLE_PHOTOS_PICKER_SCOPE =
+  "https://www.googleapis.com/auth/photospicker.mediaitems.readonly";
+const GOOGLE_PHOTOS_PICKER_SCOPE_DESCRIPTION = "Read selected Google Photos media";
 const GOOGLE_PHOTOS_UPLOAD_TOOL_PATH = "photoslibrary.mediaItems.upload";
 const GOOGLE_PHOTOS_UPLOAD_PATH = "/uploads";
 
 const isGooglePhotosService = (service: string): boolean =>
   service === GOOGLE_PHOTOS_LIBRARY_SERVICE || service === GOOGLE_PHOTOS_PICKER_SERVICE;
 
+const discoveryScopesForService = (
+  service: string,
+  document: DiscoveryDocument,
+): Record<string, string> => {
+  const scopes = discoveryScopes(document);
+  if (service !== GOOGLE_PHOTOS_PICKER_SERVICE || scopes[GOOGLE_PHOTOS_PICKER_SCOPE] !== undefined) {
+    return scopes;
+  }
+  return {
+    ...scopes,
+    [GOOGLE_PHOTOS_PICKER_SCOPE]: GOOGLE_PHOTOS_PICKER_SCOPE_DESCRIPTION,
+  };
+};
+
+const discoveryMethodScopesForService = (
+  service: string,
+  method: DiscoveryMethod,
+): readonly string[] => {
+  const scopes = method.scopes ?? [];
+  return service === GOOGLE_PHOTOS_PICKER_SERVICE && scopes.length === 0
+    ? [GOOGLE_PHOTOS_PICKER_SCOPE]
+    : scopes;
+};
+
 /** The v2 oauth auth template for a Google-discovery integration. The spec
  *  itself carries the matching `securitySchemes.googleOAuth2` entry; this is the
  *  catalog-level template a connection's access token renders through. */
@@ -811,6 +840,7 @@ export const convertGoogleDiscoveryToOpenApi = Effect.fn("OpenApi.convertGoogleD
         method,
         toolPath,
         pathTemplate: pathTemplate.startsWith("/") ? pathTemplate : `/${pathTemplate}`,
+        oauthScopes: discoveryMethodScopesForService(service, method),
       });
     }
 
@@ -826,7 +856,7 @@ export const convertGoogleDiscoveryToOpenApi = Effect.fn("OpenApi.convertGoogleD
       });
     }
 
-    const scopes = compactDiscoveryScopeMap(discoveryScopes(document));
+    const scopes = compactDiscoveryScopeMap(discoveryScopesForService(service, document));
     const authenticationTemplate = googleOauthTemplate(scopes);
 
     const spec: OpenApiDocument = {
@@ -923,7 +953,7 @@ export const convertGoogleDiscoveryBundleToOpenApi = Effect.fn(
   for (const info of infos) {
     const schemaPrefix = schemaComponentPart(`${info.service}_${info.version}`);
     const schemaNameForRef = (name: string) => `${schemaPrefix}_${schemaComponentPart(name)}`;
-    const scopeDescriptions = discoveryScopes(info.document);
+    const scopeDescriptions = discoveryScopesForService(info.service, info.document);
     const filterPhotosScopes = consentScopeSet !== null && isGooglePhotosService(info.service);
 
     for (const [scope, description] of Object.entries(scopeDescriptions)) {
@@ -939,7 +969,7 @@ export const convertGoogleDiscoveryBundleToOpenApi = Effect.fn(
       const methodId = Option.getOrUndefined(method.id);
       const rawPathTemplate = Option.getOrUndefined(method.path);
       if (!methodId || !rawPathTemplate || !method.httpMethod) continue;
-      const methodScopes = method.scopes ?? [];
+      const methodScopes = discoveryMethodScopesForService(info.service, method);
       const oauthScopes = filterPhotosScopes
         ? methodScopes.filter((scope) => consentScopeSet.has(scope))
         : methodScopes;

packages/plugins/google/src/sdk/plugin.test.ts

@@ -35,7 +35,7 @@ const CALENDAR_URL = "https://www.googleapis.com/discovery/v1/apis/calendar/v3/r
 const GMAIL_URL = "https://www.googleapis.com/discovery/v1/apis/gmail/v1/rest";
 const DRIVE_URL = "https://www.googleapis.com/discovery/v1/apis/drive/v3/rest";
 const PHOTOS_LIBRARY_URL = "https://www.googleapis.com/discovery/v1/apis/photoslibrary/v1/rest";
-const PHOTOS_PICKER_URL = "https://www.googleapis.com/discovery/v1/apis/photospicker/v1/rest";
+const PHOTOS_PICKER_URL = "https://photospicker.googleapis.com/$discovery/rest?version=v1";
 
 const calendarDoc = {
   name: "calendar",
@@ -197,23 +197,13 @@ const photosPickerDoc = {
   title: "Google Photos Picker API",
   rootUrl: "https://photospicker.googleapis.com/",
   servicePath: "v1/",
-  auth: {
-    oauth2: {
-      scopes: {
-        "https://www.googleapis.com/auth/photospicker.mediaitems.readonly": {
-          description: "Read selected Google Photos media",
-        },
-      },
-    },
-  },
   resources: {
     mediaItems: {
       methods: {
         list: {
           id: "photospicker.mediaItems.list",
           httpMethod: "GET",
           path: "mediaItems",
-          scopes: ["https://www.googleapis.com/auth/photospicker.mediaitems.readonly"],
           parameters: {},
         },
       },
@@ -233,12 +223,14 @@ const DISCOVERY_BODIES: Readonly<Record<string, string>> = {
 };
 
 // A stub HTTP client that serves the canned Discovery document for whichever
-// URL the bundle converter fetches (query params are ignored when matching).
+// URL the bundle converter fetches. Service-hosted Discovery URLs carry their
+// version in the query string, so match the full URL before falling back to the
+// path-only key used by central Discovery URLs.
 const discoveryHttpClientLayer = Layer.succeed(HttpClient.HttpClient)(
   HttpClient.make((request: HttpClientRequest.HttpClientRequest) => {
     const url = new URL(request.url);
     const key = `${url.origin}${url.pathname}`;
-    const body = DISCOVERY_BODIES[key];
+    const body = DISCOVERY_BODIES[url.toString()] ?? DISCOVERY_BODIES[key];
     return Effect.succeed(
       HttpClientResponse.fromWeb(
         request,