Issue with Google Integration verification process

[emillod]

Hello Guys,
we received an email from a client which already purchased Google Integration extension and he tried to use it in his company.
Unfortunately, don't know why, but instead of using Google Workspace, he is using private google accounts and he fail on verification stage.

Of course if he is using private google accounts, he have to turn public app as external to give access private accounts. He only want to use google contacts sync, but google verification see that EspoCRM extension trying to connect also to the https://mail.google.com/ endpoint. And because of that they want to do a security analysis. Here you have a quote: Assessments will be conducted by a Google-empanelled third-party assessor. The cost of the assessment typically varies between $10,000 -$75,000 (or more).

And i wonder is it normal? Is there a way to walk around this and for example disable request in extension to that specific endpoint.

They've also had issue with text on button on connecting stage, when user connect his account to google. There is a red button with text "Connect" and they want "Sign in with Google". Here you have a screenshot with their comment: https://i.imgur.com/YzH59MX.png

This is a message mostly to EspoCRM devs, to make sure that there will be no issues in the future for other users. i decided to post this here, because maybe someone have some experience with adjusting scopes, to not use gmail endpoint. I can of course adjust extension to don't use that endpoint, but maybe someone already have such issue and have better idea.

Oooor maybe i'm doing something wrong

Have a wonderful day!

[emillod]

yuri
any information?

[emillod]

For offspring: you just have to adjust scopes in Custom directory.
Params which you should adjust:
application/Espo/Modules/Google/Resources/metadata/integrations/Google.json
scopeGmail and scope.

I found in scope param, in original file from official package scope called email. I'm not sure is it right..

[yuri]

"email" scope is needed I think. It just exposes own email address I believe.

Did you try to remove "https://mail.google.com/" scope ?

[emillod]

Like i mentioned above, i removed scopes and it's working. we'll see how verification process will be handled by google.

[yuri]

Did you remove both scopes or only "https://mail.google.com"? The "email" scope is needed for Calendar sync I believe. "https://mail.google.com" was used in older versions of the extension and was left for backward compatibility reasons. I will consider to remove it.

[emillod]

I added file Google.json in custom directory: /custom/Espo/Custom/Resources/metadata/integrations/
with this content:

{
"params": {
"scopeGmail": "https://www.googleapis.com/auth/userinfo.profile",
"scope": "https://www.googleapis.com/auth/userinfo.profile https://www.googleapis.com/auth/user.emails.read https://www.googleapis.com/auth/calendar https://www.googleapis.com/auth/contacts https://www.google.com/m8/feeds"
},
"products":{
"googleCalendar": true,
"googleContacts": true,
"gmail": false
}
}