arirubinstein

Update: download the new Pokemon Go app - it fixes all of this. Download it, and reauth, and you should be set. The grant scopes and prompt are correct and visible now too! Now if only I could actually find a pikachu...

Pokemon tokens are requested with these understandable scopes:

• openid
• email
• https://www.googleapis.com/auth/userinfo.email
• https://www.google.com/accounts/OAuthLogin (this scope does much more than it appears. see update on the bottom for more info)

untrusted-lvl3-solution.js

/************************
 * validationEngaged.js *
 ************************
 *
 * They're really on to us now! The validateLevel function
 * has been activated to enforce constraints on what you can
 * do. In this case, you're not allowed to remove any blocks.
 *
 * They're doing all they can to keep you here. But you
 * can still outsmart them.