Throw an exception if verified age scope is passed in sign-in request through the add scopes flow.

GoogleSignIn/Sources/GIDSignIn.m

@@ -20,6 +20,8 @@
 #import "GoogleSignIn/Sources/Public/GoogleSignIn/GIDGoogleUser.h"
 #import "GoogleSignIn/Sources/Public/GoogleSignIn/GIDProfileData.h"
 #import "GoogleSignIn/Sources/Public/GoogleSignIn/GIDSignInResult.h"
+#import "GoogleSignIn/Sources/Public/GoogleSignIn/GIDVerifiableAccountDetail.h"
+#import "GoogleSignIn/Sources/Public/GoogleSignIn/GIDVerifyAccountDetail.h"
 
 #import "GoogleSignIn/Sources/GIDAuthorizationResponse/GIDAuthorizationResponseHelper.h"
 #import "GoogleSignIn/Sources/GIDAuthorizationResponse/Implementations/GIDAuthorizationResponseHandler.h"
@@ -256,6 +258,10 @@ - (void)addScopes:(NSArray<NSString *> *)scopes
                                                       loginHint:self.currentUser.profile.email
                                                   addScopesFlow:YES
                                                      completion:completion];
+#if TARGET_OS_IOS && !TARGET_OS_MACCATALYST
+  // Explicitly throw an exception for invalid or restricted scopes in the request.
+  [self assertValidScopes:scopes];
+#endif // TARGET_OS_IOS && !TARGET_OS_MACCATALYST
 
   NSSet<NSString *> *requestedScopes = [NSSet setWithArray:scopes];
   NSMutableSet<NSString *> *grantedScopes =
@@ -989,6 +995,32 @@ - (void)assertValidPresentingViewController {
   }
 }
 
+#if TARGET_OS_IOS && !TARGET_OS_MACCATALYST
+// Asserts the requested scopes are valid.
+- (void)assertValidScopes:(NSArray<NSString *> *)scopes {
+  NSDictionary *scopeToClassMapping = @{
+    kAccountDetailTypeAgeOver18Scope : [GIDVerifyAccountDetail class],
+  };
+  NSMutableString *errorMessage =
+    [NSMutableString stringWithString:@"The following scopes are not supported in the 'addScopes' flow. "
+                                       "Please use the appropriate classes to handle these:\n"];
+  Boolean unsupportedScopeFound = NO;
+
+  for (NSString *scope in scopes) {
+    Class scopeClass = scopeToClassMapping[scope];
+    if (scopeClass) {
+      unsupportedScopeFound = YES;
+      [errorMessage appendFormat:@"%@ -> %@\n", scope, NSStringFromClass(scopeClass)];
+    }
+  }
+  if (unsupportedScopeFound) {
+    // NOLINTNEXTLINE(google-objc-avoid-throwing-exception)
+    [NSException raise:NSInvalidArgumentException
+                format:@"%@", errorMessage];
+  }
+}
+#endif // TARGET_OS_IOS && !TARGET_OS_MACCATALYST
+
 // Checks whether or not this is the first time the app runs.
 - (BOOL)isFreshInstall {
   NSUserDefaults* defaults = [NSUserDefaults standardUserDefaults];

GoogleSignIn/Tests/Unit/GIDSignInTest.m

@@ -1300,6 +1300,29 @@ - (void)testTokenEndpointEMMError {
   XCTAssertEqualObjects(_authError.domain, kGIDSignInErrorDomain);
   XCTAssertEqual(_authError.code, kGIDSignInErrorCodeEMM);
   XCTAssertNil(_signIn.currentUser, @"should not have current user");
+}
+
+- (void)testValidScopesException {
+  NSString *requestedScope = @"https://www.googleapis.com/auth/verified.age.over18.standard";
+  NSString *expectedException = 
+    [NSString stringWithFormat:@"The following scopes are not supported in the 'addScopes' flow. "
+                                "Please use the appropriate classes to handle these:\n%@ -> %@\n",
+                                requestedScope, NSStringFromClass([GIDVerifyAccountDetail class])];
+  BOOL threw = NO;
+  @try {
+    [_signIn addScopes:@[requestedScope]
+#if TARGET_OS_IOS || TARGET_OS_MACCATALYST
+      presentingViewController:_presentingViewController
+#elif TARGET_OS_OSX
+      presentingWindow:_presentingWindow
+#endif // TARGET_OS_IOS || TARGET_OS_MACCATALYST
+            completion:_completion];
+  } @catch (NSException *exception) {
+    threw = YES;
+    XCTAssertEqualObjects(exception.description, expectedException);
+  } @finally {
+  }
+  XCTAssert(threw);
 
   // TODO: Keep mocks from carrying forward to subsequent tests. (#410)
   [_authState stopMocking];