meetbot requires full calendar permissions to schedule a meeting

[shoenseiwaso]

Typing !meet in a chat with meetbot initiates the following:

Clicking on that link opens up the following page:

It would be great if meetbot didn't require full GSuite calendar permissions to generate a new meeting link. For example, if I visit https://meet.google.com I can immediately generate a new Meet/Hangouts link without having to grant calendar permission.

[joshblum]

@shoenseiwaso thanks for reaching out and your concern. Unfortunately this is a private API and isn't exposed in the OAuth permissions we can request. The page you linked requires a logged in Google account, the bot would need to authenticate as a user to use the API (if we reversed it).

Calendar read/write is the most granular permission we can request at the moment since we have to create an event with a meeting to generate a link with the current setup. I will open a Google ticket now to request a more granular permission, but if you're concerned about privacy you can run your own instance of the bot. There are other video conferencing options within Keybase with different permission models: https://keybase.io/zoombot/chat (Zoom account required, managed by Keybase) https://keybase.io/jitsibot/chat (No account required, community contributed)

[joshblum]

https://issuetracker.google.com/issues/152375624

[shoenseiwaso]

Thanks Josh for the detailed explanation, and for filing the upstream issue! We’ll try some of your suggested alternatives, that’s helpful.

Not sure what Keybase’s standard is for issue handling, but would it make sense to keep this one open until the upstream issue is addressed by Google? We’ll obviously defer to you on this.

Also...is it just my memory or did meetbot only recently start needing these permissions? Was it generating the links another way before?

[joshblum]

@shoenseiwaso good point, I can leave this open in case other users come across it.

Meetbot has always had these permissions