If I'm an OAuth provider and I want to empower the user to restrict apps to only a subset of resources (for example, only resources in folder X), what is the right mechanism to do this? Scopes would seem to be it, but I find little to no precedent for this.
I often see scopes implemented as different permissions, e.g. "read-only", or "read-write". These are often very coarse categorizations, and require that if deep access is needed to any particular set of resources, it must be granted broadly as well so you end up getting read-write access to everything even if you only need to modify one thing.
Sometimes I see scopes implemented as categories of resource to access, e.g. "photos" or "email address". This only makes sense if you have a meaningful, predefined, finite set of categories of resource.
When I look at the Google Drive scopes for example, there appears to be no way to restrict an app's access to a collection of files. I apologize if I'm not looking hard enough, but this would seem to be very useful and it just doesn't exist. Drive has a "per-file" scope but that has very specific behavior that I am not interested in.
As an OAuth provider, what are the arguments for/against creating scopes for user-created resources? That is, why couldn't Google allow a scope for each of the user's folders? Presumably the app would need permission to first list the folders so that the user could select them, then the app could seek additional permissions to the folders. This would mean multiple OAuth dialogs, so I can imagine the answer is it's just hard to make a good experience. I've had a hard time finding discussion of these tradeoffs elsewhere.