| 1 | // Cross-target: a scope-insufficient upstream 403 is a distinct, actionable |
| 2 | // failure — not a re-authenticate loop. When a connection's OAuth grant does |
| 3 | // not cover the scope an operation requires, the upstream rejects the call |
| 4 | // with a scope signal (Google's ACCESS_TOKEN_SCOPE_INSUFFICIENT, RFC 6750's |
nothing calls this directly
no test coverage detected