No way to remove name scope when using Sign in with Apple

[MrFunctor]

Operating System

Not relevant

Environment (if applicable)

Not relevant

Firebase SDK Version

11.2.0

Firebase SDK Product(s)

Auth

Project Tooling

React app, though this is not really relevant.

Detailed Problem Description

When doing Sign in with Apple, I just need to ask for the user's email. So, I create the OAuth provider, add the email scope, and do a signInWithPopup (or linkWithPopup).

The problem is that when the pop-up shows up, the user is asked to share both their email and their name, despite the fact that I only added the email scope. The shared name is then saved as the user's displayName.

This default behavior is mentioned in the docs:

By default, when One account per email address is enabled, Firebase requests email and name scopes. If you change this setting to Multiple accounts per email address, Firebase doesn't request any scopes from Apple unless you specify them.

Since I have the Link accounts that use the same email setting enabled, I guess that Firebase requests both email and name by default. However, there is no way to change this default behavior as there is no way to remove scopes.

If an app does not need to know the user's name, I don't see why there is no way to remove the name scope from the Sign in with Apple request.

So, in summary, either the default should be changed to not include any scope so that all required scopes need to be explicitly specified, or if the default is left as-is with the email and name scopes, there should be a way to remove them to not ask the user for more information than is actually needed.

Steps and code to reproduce issue

import { getAuth, signInWithPopup, OAuthProvider } from 'firebase/auth'

const auth = getAuth()
const provider = new OAuthProvider('apple.com')

// Only email scope is explicitly added
provider.addScope('email')

// The pop-up asks the user both the email and the name
const result = await signInWithPopup(auth, provider)

[google-oss-bot]

I couldn't figure out how to label this issue, so I've labeled it for a human to triage. Hang tight.