feat: handle oauth scope verification and errors

app/controllers/concerns/google_concern.rb

@@ -15,6 +15,6 @@ module GoogleConcern
   private
 
   def scope
-    'email profile https://mail.google.com/'
+    'https://www.googleapis.com/auth/userinfo.profile https://www.googleapis.com/auth/userinfo.email https://mail.google.com/'
   end
 end

app/controllers/google/callbacks_controller.rb

@@ -12,6 +12,16 @@ class Google::CallbacksController < OauthCallbackController
 
   private
 
+  def verify_scopes
+    granted_scopes = parsed_body['scope']&.split || []
+    required_scopes = scope.split
+
+    missing_scopes = required_scopes - granted_scopes
+    return if missing_scopes.empty?
+
+    raise CustomExceptions::OAuth::InsufficientScopes.new({ missing_scopes: missing_scopes })
+  end
+
   def provider_name
     'google'
   end
@@ -24,4 +34,14 @@ class Google::CallbacksController < OauthCallbackController
     # from GoogleConcern
     google_client
   end
+
+  def handle_error(exception)
+    ChatwootExceptionTracker.new(exception).capture_exception
+
+    error_code = exception.respond_to?(:code) ? exception.code : 'OAUTH_ERR'
+    error_message = exception.message || 'OAuth authorization failed'
+
+    redirect_url = "#{ENV.fetch('FRONTEND_URL', 'http://localhost:3000')}/app/accounts/#{account.id}/settings/inboxes/new/email"
+    redirect_to "#{redirect_url}?error=#{CGI.escape(error_message)}&code=#{error_code}"
+  end
 end

app/controllers/oauth_callback_controller.rb

@@ -5,10 +5,10 @@ class OauthCallbackController < ApplicationController
       redirect_uri: "#{base_url}/#{provider_name}/callback"
     )
 
+    verify_scopes
     handle_response
   rescue StandardError => e
-    ChatwootExceptionTracker.new(e).capture_exception
-    redirect_to '/'
+    handle_error(e)
   end
 
   private
@@ -63,6 +63,19 @@ class OauthCallbackController < ApplicationController
     raise NotImplementedError
   end
 
+  def verify_scopes
+    true
+  end
+
+  def failure_redirect_url
+    '/'
+  end
+
+  def handle_error(exception)
+    ChatwootExceptionTracker.new(exception).capture_exception
+    redirect_to failure_redirect_url
+  end
+
   def create_channel_with_inbox
     ActiveRecord::Base.transaction do
       channel_email = Channel::Email.create!(email: users_data['email'], account: account)