From bac8edfb6c555fe857637e0b7b90ff2a3eda88db Mon Sep 17 00:00:00 2001
From: Nasyarobby Putra <nasyarobby@gmail.com>
Date: Tue, 22 Sep 2026 10:09:25 +0700
Subject: [PATCH] feat(api): switch OAuth scope to gmail.modify

Enable archive, label, and draft CLI operations after users re-consent; keep the web UI read-only.

Co-authored-by: Cursor <cursoragent@cursor.com>
---
 apps/api/src/config.js       | 2 +-
 apps/web/src/pages/Login.jsx | 5 +++--
 2 files changed, 4 insertions(+), 3 deletions(-)

diff --git a/apps/api/src/config.js b/apps/api/src/config.js
index b99cd01..0c7ddaf 100644
--- a/apps/api/src/config.js
+++ b/apps/api/src/config.js
@@ -17,7 +17,7 @@ export const GOOGLE_REDIRECT_URI =
   process.env.GOOGLE_REDIRECT_URI || "http://localhost:5173/callback";
 export const SESSION_SECRET = process.env.SESSION_SECRET || "";
 
-export const GMAIL_SCOPE = "https://www.googleapis.com/auth/gmail.readonly";
+export const GMAIL_SCOPE = "https://www.googleapis.com/auth/gmail.modify";
 export const OAUTH_SCOPES = [
   GMAIL_SCOPE,
   "openid",
diff --git a/apps/web/src/pages/Login.jsx b/apps/web/src/pages/Login.jsx
index 56c28fa..3237d22 100644
--- a/apps/web/src/pages/Login.jsx
+++ b/apps/web/src/pages/Login.jsx
@@ -17,8 +17,9 @@ export default function Login() {
         <div className="card-body gap-4">
           <h1 className="card-title text-2xl">Gmail Reader</h1>
           <p className="text-sm opacity-70">
-            Sign in with Google to list, search, and read mail. Access is
-            read-only.
+            Sign in with Google to list, search, and read mail in this UI. The
+            UI is read-only; the CLI can archive, label, and create drafts
+            after you grant <code>gmail.modify</code>.
           </p>
           {error ? (
             <div role="alert" className="alert alert-error text-sm">