Repository navigation
fix(vertex): add generative-language scope so SA-JSON model discovery works - #3922
Conversation
… works The Vertex/Gemini/Vertex-Express model discovery branch lists the live catalog from generativelanguage.googleapis.com/v1beta/models using a Bearer token minted by getAccessToken(). That token only requested the cloud-platform scope, so the listing returned HTTP 403 ACCESS_TOKEN_SCOPE_INSUFFICIENT and discovery silently fell back to the static ~10-model registry list. Verified live against a real Service Account JSON: the same SA token minted with the additional https://www.googleapis.com/auth/generative-language.retriever scope makes the identical call return the full live Gemini catalog (55 models: gemini-2.5-flash, gemini-2.5-pro, gemini-2.0-flash, ...). Adding the extra scope is harmless for execution (cloud-platform still authorizes aiplatform.googleapis.com) and for projects where it isn't needed (token mint never validates scope availability).
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request updates the OAuth scope requested for Vertex AI in open-sse/executors/vertex.ts to include the generative-language.retriever scope alongside cloud-platform. This addition allows model discovery to successfully list the live catalog from generativelanguage.googleapis.com without encountering a 403 error. The review feedback correctly notes that, per the Repository Style Guide, modifying production code in open-sse/ requires adding or updating corresponding tests in the tests/ directory.
Important
The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.
| scope: | ||
| "https://www.googleapis.com/auth/cloud-platform https://www.googleapis.com/auth/generative-language.retriever", |
There was a problem hiding this comment.
According to the Repository Style Guide (Rule 9), changing production code in 'open-sse/' requires including or updating tests. Please add corresponding tests in the 'tests/' directory to cover this scope change.
References
- Always include tests when changing production code (src/, open-sse/, electron/, bin/). (link)
…-discovery-genlang-scope
Vertex SA tokens now mint both cloud-platform (execution) and generative-language.retriever (live model discovery) — without the second, discovery returns 403 ACCESS_TOKEN_SCOPE_INSUFFICIENT and falls back to the static ~10-model list. Extracted the scopes to an exported VERTEX_OAUTH_SCOPES constant with a regression test so the discovery scope can't be silently dropped. Co-authored-by: diegosouzapw <diegosouza.pw@gmail.com>
|
Thanks, @artickc! 🙏 Good catch — without |
bb45ddf
into
cheaper-inference:release/v3.8.26
… works (cheaper-inference#3922) Integrated into release/v3.8.26
Summary
Vertex / Gemini / Vertex-Express model discovery lists the live catalog from
generativelanguage.googleapis.com/v1beta/modelsusing a Bearer token minted bygetAccessToken()inopen-sse/executors/vertex.ts. That token only requested thecloud-platformscope, which is insufficient for the Generative Language modelslisting — the call returns HTTP 403
ACCESS_TOKEN_SCOPE_INSUFFICIENT("Request hadinsufficient authentication scopes"). The discovery branch then silently falls back to
the static registry catalog (
source: local_catalog,warning: "API unavailable — using local catalog"), so a Service-Account-JSON Vertex connection only ever surfaces the ~10hardcoded registry models instead of the full live Gemini catalog.
Fix
Mint the SA OAuth token with the Generative Language scope in addition to cloud-platform:
This is harmless for execution (cloud-platform still authorizes Vertex AI /
aiplatform.googleapis.comfor chat/image) and for projects that don't need the extrascope (the token mint never validates scope availability — only the API call does).
Verification (live, real Service Account JSON)
Minted the SA token and called the exact discovery endpoint:
GET v1beta/modelsresultcloud-platformonly (current)ACCESS_TOKEN_SCOPE_INSUFFICIENT→ fallback to 10 static modelscloud-platform+generative-language.retriever(this PR)gemini-2.5-flash,gemini-2.5-pro,gemini-2.0-flash, …)(The Vertex AI publisher endpoint
…-aiplatform.googleapis.com/v1beta1/publishers/google/modelsreturns Model-Garden/infra entries — bert, efficientnet, occupancy-analytics — not the chat
catalog, so
generativelanguageremains the correct discovery source; only the token scopewas wrong.)
Scope of change
One file:
open-sse/executors/vertex.ts(thegetAccessTokenJWT scope claim).