oidc: clarify a small point of quoting an envvar

[jordigh]

Ran into this problem by quoting in my .env file for Docker:

https://community.auth0.com/t/id-token-not-present-in-tokenset/63690/2

[netlify[bot]]

✅ Deploy Preview for grist-help-preview ready!

Name	Link
🔨 Latest commit	4ff92952df6574205a88a0629f582721bb6e0b21
🔍 Latest deploy log	https://app.netlify.com/sites/grist-help-preview/deploys/66c8b47586c5570008e40953
😎 Deploy Preview	https://deploy-preview-391--grist-help-preview.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

---

To edit notification comments on pull requests, go to your Netlify site configuration.

[jordigh]

@dsagal Well, now I wonder why is it a config option at all. Grist already knows the scopes it needs, so why even make it configurable?

[dsagal]

Good question, I don't know, only have a vague guess. @fflorent , do you know the answer to @jordigh's question?

[fflorent]

Indeed, good question @jordigh!

Here are some explanations I have in mind:

• The administrator may not want Grist to fetch some profile information (like the user's name), after all, Grist only needs the email address (so technically the only scopes required is openid email if I am right);
• There are some information that we may want to let the administrator retrieve in the future, I think of enhancement in the user table to store additional values;

These explanations may not be highly convincing (especially my second point). We may have introduced this env variable when needed or requested by the community.

[jordigh]

@fflorent Okay, I thought Grist just wouldn't work if it didn't have all of the scopes, but if degraded performance is possible with fewer scopes than the default, that's good to know.

@dsagal Even if it's the default value, I think it's helpful to highlight in the examples that this value exists.

Given that, I'm merging this in.