Fixed gam whatis exiting 15 when only the User Invitations Cloud Identity scope is authorized (#1934)

[askalf]

Summary

• gam whatis <email> on an address that does not exist exits 15 (NO_SCOPES_FOR_API_RC) and prints ERROR: There are no scopes authorized for the API(s): Cloud Identity API - User Invitations, even though the admin has authorized the User Invitations scope. Expected: exit 59 (ENTITY_IS_UKNOWN_RC). Issue 'gam whatis' exit status is incorrect for non-existent entries #1934.
• Cause: buildGAPIObject (src/gam/__init__.py:5756-5768) accepts a client's scopes for an API only if they appear in the discovery document's auth.oauth2.scopes or in API.EXTRA_SCOPES[api]. The Cloud Identity v1 discovery document (checked at revisions 20260826 and 20260920) does not list cloud-identity.userinvitations or cloud-identity.userinvitations.readonly, and EXTRA_SCOPES has no entry for CLOUDIDENTITY_USERINVITATIONS. So the scope GAM's own gam oauth create menu offers for this API (glapi.py:422-425) never counts, and GAM exits before calling the API.
• Fix: add the two User Invitations scopes to EXTRA_SCOPES, the dict whose comment reads "Scopes not in the discovery doc that are still valid for the API". Google's REST reference for customers.userinvitations.isInvitableUser lists exactly these two scopes. The diff is 2 lines in src/gam/gamlib/glapi.py.
• This also fixes gam print|show|info userinvitation(s) and gam send|cancel userinvitation, which build the same API object and failed the same way (case C6 below).
• The workaround in the issue thread (authorize any other Cloud Identity scope, e.g. 19r Groups) works only because it makes the intersection non-empty. On base and head it gives the same result (C4).

$ python repro_whatis.py <BASE dac28c15>/src discovery
ERROR: There are no scopes authorized for the API(s): Cloud Identity API - User Invitations
API calls: ['GET https://admin.googleapis.com/admin/directory/v1/users/nosuchentity%40example.com', 'GET https://admin.googleapis.com/admin/directory/v1/groups/nosuchentity%40example.com']
Exit status was 15

$ python repro_whatis.py <HEAD e10a6308>/src discovery
Email Address: nosuchentity@example.com, Does not exist
API calls: ['GET https://admin.googleapis.com/admin/directory/v1/users/nosuchentity%40example.com', 'GET https://admin.googleapis.com/admin/directory/v1/groups/nosuchentity%40example.com', 'GET https://cloudidentity.googleapis.com/v1/customers/my_customer/userinvitations/nosuchentity@example.com:isInvitableUser']
Exit status was 59

Decisions

The change uses the project’s existing implementation path and adds a focused regression test; broader unrelated behavior remains out of scope.

Not run: no checks beyond the staged PR evidence were run during submission.

AI assistance: this bug was found and the fix and tests were drafted with AI tooling in my workflow; the tests and checks above were executed as pasted. I'm responsible for the change and will handle review feedback.

[taers232c]

Thank you! Do you want credit in the GamUpdates Wiki entry?

[taers232c]

I added your updates by hand, they're in 7.48.14.

Thank you very much for the work you did to fix the problem,.

Ross

[askalf]

Yes please, thank you Ross! @askalf is fine for the credit. Glad it made 7.48.14.