IssueTracker

A short description of the issue:

If we have a credential that has authorized both the `gmail.readonly` and `gmail.metadata` scopes, we theoretically have access to that credential's full email message. However, when requesting a specific email message with `format=full`, we get an error that we are unable to do so because we have the `gmail.metadata` scope.

The desired behavior should be that obtaining the `gmail.readonly` scope supersedes the `gmail.metadata` scope, so we should be able to obtain the entire email message using `format=full`.

Note that the `mail.google.com` scope can be substituted for the `gmail.readonly` scope with the same behavior. The fix should address the following two scenarios:
1. Requesting `format=full` with both `gmail.metadata` and `gmail.readonly` scopes.
2. Requesting `format=full` with both `gmail.metadata` and `mail.google.com`.

-----------------------------------------------------------------------------------------------------------------------------

A small code sample that reliably reproduces the issue. The sample should run as-is or with minimal setup, without external dependencies.

Unable to provide a code sample, as it would be too complex. Instead, please check out the steps to reproduce the problem below using Google's own API Explorer. If there are questions that are unresolved, happy to clarify in a followup.


-----------------------------------------------------------------------------------------------------------------------------

What steps will reproduce the problem?

1. Navigate to the API Explorer Here: https://developers.google.com/gmail/api/v1/reference/users/messages/list

2. In the right "try it" sidebar, type "me" under userId and fetch a list of emails in your inbox. Copy an arbitrary email ID from the response to the clipboard. We will need the ID in the next step.

3. Navigate to the API Explorer Here: https://developers.google.com/gmail/api/v1/reference/users/messages/get

4. In the right "try it" sidebar, type "me" under `userId` and paste the email ID from above under `id`.

5. Optionally, select "full" under `format`.

6. Under the "Authentication" section, click "Show Scopes". Uncheck all scopes EXCEPT the following two:
  https://www.googleapis.com/auth/gmail.metadata
  https://www.googleapis.com/auth/gmail.readonly

7. Click Execute. The API Explorer will try to fetch the entire email message (which we should be allowed to do because we have the `gmail.readonly` scope).

-----------------------------------------------------------------------------------------------------------------------------

What is the expected output? What do you see instead?  If you see error messages, please provide them.

We expect to see the entire contents of the email message, because we have the `gmail.readonly` scope (which gives us permission to fetch the full email message. It is also a superset of the `gmail.metadata` scope):

```
{
 "id": "ID",
 "threadId": "THREAD_ID",
 "labelIds": [
  "UNREAD",
  "IMPORTANT",
  "CATEGORY_UPDATES",
  "INBOX"
 ],

 ...
}

```


Instead, we get the following:
```
{
 "error": {
  "errors": [
   {
    "domain": "global",
    "reason": "forbidden",
    "message": "Metadata scope doesn't allow format FULL"
   }
  ],
  "code": 403,
  "message": "Metadata scope doesn't allow format FULL"
 }
}
```

-----------------------------------------------------------------------------------------------------------------------------

Please provide any additional information below.

We currently run an app used by clients all around the world where we request an increasing set of email permissions from `gmail.metadata` to `gmail.readonly` to eventually `gmail.send` (following best practices--we only request them when necessary). However, we are unable to access our users' email bodies after they authorize us to use the `gmail.readonly` scope (since they previously authorized us with the `gmail.metadata` scope).

We have found two solutions around this limitation so far:
1. Ask Google to revoke the user's access token and refresh token (and all scopes attached to that token), before asking the user to login again through another flow that _only_ authorizes the `gmail.readonly` scope. This is cumbersome for both the user and us, and we would appreciate if this behavior is fixed!
2. Never ask the user for the `gmail.metadata` scope--only ask for the `gmail.readonly` scope even if we don't need the full email. This is bad because it gives us unnecessary data, makes the user wary as to why they're providing readonly access when the metadata scope exists, and leads to a worse-off user experience.

Thank you!