From 875835bb7c5b7e0860a502620366beade93c2ba3 Mon Sep 17 00:00:00 2001
From: jtricerolph <info@tricerolph.com>
Date: Thu, 2 Jul 2026 00:57:01 +0000
Subject: [PATCH] Use me+department scopes and improve OAuth error messages

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---
 src/workforce.js | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/src/workforce.js b/src/workforce.js
index 2640026..9fc9436 100644
--- a/src/workforce.js
+++ b/src/workforce.js
@@ -31,11 +31,14 @@ async function getWorkforceToken() {
       grant_type: 'password',
       username: creds.email,
       password: creds.password,
-      scope: 'me department staff',
+      scope: 'me department',
     }).toString(),
     signal: AbortSignal.timeout(10000),
   })
-  if (!res.ok) throw new Error(`Workforce OAuth failed: ${res.status}`)
+  if (!res.ok) {
+    const body = await res.text().catch(() => '')
+    throw new Error(`Workforce OAuth failed: ${res.status}${body ? ': ' + body.slice(0, 300) : ''}`)
+  }
   const data = await res.json()
   _tokenCache = { access_token: data.access_token, base_url: baseUrl, expires_at: Date.now() + 50 * 60_000 }
   return { token: data.access_token, baseUrl }