fix(auth): add missing profile scope for people/me verification (#120)

* fix(auth): add missing profile scope for people/me verification

gro init calls people/me with PersonFields("names,emailAddresses") to
verify the People API and power `gro me`. The contacts scope covers
the contacts list but not the authenticated user's own profile — Google
requires userinfo.profile for that endpoint.

Without this scope, gro init always fails with a 403 on the People API
verification step, making fresh credential setup impossible.

Closes #119

* test: update scope guardrails for userinfo.profile

Update the hardcoded count in TestAllScopes (6→7) and add the scope
assertion. Add userinfo.profile to the architecture test allowlist with
a note that it is read-only and scoped to the authenticated user's own
profile, not the contacts list.

Author: rianjs

internal/architecture/architecture_test.go

@@ -316,6 +316,7 @@ var allowedScopes = map[string]bool{
 	"https://www.googleapis.com/auth/calendar.events":   true, // RSVP, color (NOT calendar settings)
 	"https://www.googleapis.com/auth/contacts.readonly": true,
 	"https://www.googleapis.com/auth/contacts":          true, // group membership, starring (NOT create/delete contacts)
+	"https://www.googleapis.com/auth/userinfo.profile":  true, // read authenticated user's name/email for people/me (NOT contacts list)
 	"https://www.googleapis.com/auth/drive.readonly":    true,
 	"https://www.googleapis.com/auth/drive.metadata":    true, // star/unstar files (NOT file content write)
 }

internal/auth/auth.go

@@ -26,11 +26,13 @@ import (
 // The architecture test (TestNoDestructiveAPIMethodsInProductionCode) prevents accidental misuse.
 // Contacts uses the full contacts scope for group management and starring.
 // The contacts scope is a superset of contacts.readonly — it includes all read access.
+// Profile is required for people/me (names, emailAddresses fields) used by `gro me` and init verification.
 var AllScopes = []string{
 	gmail.GmailModifyScope,
 	calendar.CalendarReadonlyScope,
 	calendar.CalendarEventsScope,
 	people.ContactsScope,
+	people.UserinfoProfileScope,
 	drive.DriveReadonlyScope,
 	drive.DriveMetadataScope,
 }
@@ -43,6 +45,7 @@ var ScopeDescriptions = map[string]string{
 	calendar.CalendarEventsScope:   "Calendar Events — read and update events (RSVP, color). No calendar settings access.",
 	people.ContactsScope:           "Contacts — read contacts and groups, plus manage group membership and starring.",
 	people.ContactsReadonlyScope:   "Contacts Read-Only — read contacts and groups.",
+	people.UserinfoProfileScope:    "Profile — read the authenticated user's name and email address (required for 'gro me').",
 	drive.DriveReadonlyScope:       "Drive Read-Only — read files and metadata.",
 	drive.DriveMetadataScope:       "Drive Metadata — read and update file metadata (star/unstar). No file content write access.",
 }

internal/auth/auth_test.go

@@ -101,8 +101,8 @@ func TestDeprecatedWrappers(t *testing.T) {
 
 func TestAllScopes(t *testing.T) {
 	t.Parallel()
-	if len(AllScopes) != 6 {
-		t.Errorf("got length %d, want %d", len(AllScopes), 6)
+	if len(AllScopes) != 7 {
+		t.Errorf("got length %d, want %d", len(AllScopes), 7)
 	}
 	scopeSet := strings.Join(AllScopes, " ")
 	if !strings.Contains(scopeSet, "https://www.googleapis.com/auth/gmail.modify") {
@@ -123,6 +123,9 @@ func TestAllScopes(t *testing.T) {
 	if !strings.Contains(scopeSet, "https://www.googleapis.com/auth/drive.metadata") {
 		t.Errorf("expected AllScopes to contain %q", "https://www.googleapis.com/auth/drive.metadata")
 	}
+	if !strings.Contains(scopeSet, "https://www.googleapis.com/auth/userinfo.profile") {
+		t.Errorf("expected AllScopes to contain %q", "https://www.googleapis.com/auth/userinfo.profile")
+	}
 }
 
 func TestCheckScopesMigration_NoGrantedScopes(t *testing.T) {