fix: filter alertcenter scopes from user OAuth login flow (#108)

* fix: filter alertcenter scopes from user OAuth login flow

The `apps.alerts` scope is restricted to service accounts with
domain-wide delegation and fails with `400 invalid_scope` when
used in the standard 3-legged OAuth consent flow. Filter it out
alongside the existing chat.app/chat.bot/keep exclusions.

Fixes #73

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* fix: also filter apps.alerts in is_app_only_scope()

The scope filter exists in two locations: setup.rs (fetch_scopes_for_apis)
and auth_commands.rs (is_app_only_scope). Both need the apps.alerts
exclusion to prevent it from appearing in the interactive scope picker.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* chore: retrigger CLA check

* chore: retrigger CI after CLA signing

---------

Co-authored-by: Andrew Barnes <andrew.jaguars@gmail.com>
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>

.changeset/fix-alertcenter-scope-filter.md

@@ -0,0 +1,5 @@
+---
+"@googleworkspace/cli": patch
+---
+
+Filter out `apps.alerts` scopes from user OAuth login flow since they require service account with domain-wide delegation

src/auth_commands.rs

@@ -1322,12 +1322,14 @@ const SCOPE_ENTRIES: &[ScopeEntry] = &[
 
 // (parse_scopes removed — replaced by resolve_scopes above)
 
-/// Helper: check if a scope is an app-only scope that can't be used with user OAuth
+/// Helper: check if a scope can't be used with user OAuth consent flow
+/// (requires a Chat app, service account, or domain-wide delegation).
 fn is_app_only_scope(url: &str) -> bool {
     url.contains("/auth/chat.app.")
         || url.contains("/auth/chat.bot")
         || url.contains("/auth/chat.import")
         || url.contains("/auth/keep")
+        || url.contains("/auth/apps.alerts")
 }
 
 #[cfg(test)]

src/setup.rs

@@ -285,12 +285,13 @@ pub async fn fetch_scopes_for_apis(enabled_api_ids: &[String]) -> Vec<Discovered
                         if !url.starts_with("https://www.googleapis.com/auth/") {
                             continue;
                         }
-                        // Filter out app-only scopes that can't be used with user OAuth consent
-                        // (they require a Chat app / service account)
+                        // Filter out scopes that can't be used with user OAuth consent
+                        // (they require a Chat app, service account, or domain-wide delegation)
                         if url.contains("/auth/chat.app.")
                             || url.contains("/auth/chat.bot")
                             || url.contains("/auth/chat.import")
                             || url.contains("/auth/keep")
+                            || url.contains("/auth/apps.alerts")
                         {
                             continue;
                         }