Overly broad Google Drive scope

[JakobKallin]

Google Drive integration was adapted from examples in Google's documentation that for some reason use the scope granting full access to the user's Drive. This is despite their documentation in other places pointing out that apps can only access files created or opened with the app itself.

The scope should be changed from https://www.googleapis.com/auth/drive to https://www.googleapis.com/auth/drive.file.

[JakobKallin]

It turns out that this issue is not trivial to fix. There are questions on Stack Overflow and Google Groups addressing it.

[JakobKallin]

As described in the Stack Overflow question, there is now a solution to this. I cannot see any other way to implement it, however, than requiring the user to manually recreate his adventures under the new scope (which makes sense, because the point of the drive.file scope is to only allow access to files explicitly authorized by the user via a Google interface).

At present, the simplest way I can think of is to maintain two different subdomains: one for the old scope and one for the new scope. Users would then either have to continue using the old scope, recreate their old adventures in the new scope, or use both versions until they no longer need adventures created under the old scope.