How to update published add-on code when changing the scopes?

[Faustino Rodriguez]

The official documentation on how to update the add-on code version is on this page

https://developers.google.com/gsuite/add-ons/how-tos/update-editor-addons#update_published_add-on_code

And it works great when we are not changing the already verified scopes

- just by following the steps: 1-3-5-6bcd

However, that's not the case when changing the scopes if we go in the sequence from that page: 2-4-6a

- when changing the manifest or the SDK configuration, ahead of getting verified for the new scopes, (I did that first as suggested)

- the add-on goes into unverified status, with the users are getting this message:

"Sign in with Google temporarily disabled for this app This app has not been verified yet by Google in order to use Google Sign In."

- and showing the OAuth rate limits cap message (100 users / 100 user cap) in the GCP page

There are 3 places where to add/edit the scopes

1. The appsscript.json manifest in the add-on GAS project

2. The GCP GSM SDK Configuration page

3. The GCP APIs OAuth consent screen (Edit App) where you submit for verification

when asked Google through the oauth-feedback@ support email about the order on changing the scopes, the first answer was:

"you will need to wait for the scopes to be fully verified before adding them to the add-on production config. Otherwise, the app will show as unverified for new users."

when asking for clarification on the meaning of "add-on production config" in this context, the final reply was:

"The scopes should be added to the GCP APIs OAuth consent screen and verified first before added to the appsscript.json manifest or the GCP GSM SDK Configuration page and used in the application."

But as today, the documentation page is still showing the request for verification as the last step

Does anybody has experience changing the add-on scopes, after the recent migration to GSM?

Any Googler around to help on this process/workflow and to update the official documentation?

[Alex]

I am expecting the same problem.

I intend to declare the contest screen first. After that I'll publish the new version.

[Faustino Rodriguez]

I am not alone now

I did that already on Jan.08

- add the new scope (script.scriptapp) to the consent screen

- and submit for verification

Two days after, I got the kind of canned/automated reply 

- that doesn't apply to a Google Editor add-on project (see below) 

- and I am still stuck on that after responding to their message

- but I won't add the new scope to the GAS manifest neither the SDK config until getting the verified in the consent screen

- no idea what would happen when verified and still not added to the project

This was the content of the message coming from 

Thank you for submitting an OAuth App Verification request. In order to continue with the verification process, you’ll need to create and provide a link to a YouTube video that shows how you’ll use the data you access using OAuth scopes. Specifically, the demo video should detail, in English: How to log into your project (ensuring that the URL bar with the client ID is clearly visible) How to request an OAuth token (OAuth Consent Screen/Permissions Page) How your project's functionality utilizes the requested scopes: https://www.googleapis.com/auth/script.scriptapp Note: You don’t need to be personally visible in the  demo or narrate the video. Demonstrating the process from the keyboard/screen view is sufficient. You can send us the video by replying to this email with the link. ...

Let's hope for a prompt resolution to this problem and a better workflow in the near future

[Alex]

OK.

I had this with one of my add-on. The question for me was

How your project's functionality utilizes the requested scopes:

https://www.googleapis.com/auth/script.container.ui

Here is what I did:

1. I made a screencast (without sound) of how my application starts and how it uses the new scopes.
2. I sent an email confirmation (the response to the thread 'OAuth Verification Request') that my application is public and it doesnt require a domain or a special account.
3. I mentioned that Im not using a domain to store user identities.

My application has been blocked by the consent screen all this time. Only me can run the app.

This took 2-3 days.

Best, Alex.