storage: option.WithScopes has no effect unless it's ScopeFullControl

[eliben]

Client

storage

Environment

any

Code

e.g.

client, err := storage.NewClient(ctx, option.WithScopes(storage.ScopeReadOnly))

Expected behavior

I expect this to set a read-only scope on client operations. For example, listing a bucket will not return ACLs.

Actual behavior

ACLs are returned.

Additional context

This code appends ScopeFullControl unconditionally, which may override whatever the user provided.

[tritone]

Some additional context from research that I did:

Looking at the code here and here, it seems clear that 1. dial settings are applied in order left-to-right and 2. scopes that are applied later in the list will override those that came before. We think that users haven't noticed the issue because the default setting is FullControl which allows everything. Also, it's not clear whether this is a common override.