@surajmarkupchecks…fix/excel-scope-cnf-distribution → master23 files · +23 −132updated 1mo agoQA audit ([QA TESTING] Action To Scope Mapping — DONE Excel) flagged 23 Excel actions whose declared _scopes diverged from Microsoft Graph's documented required scopes. This tightens those to match the official docs — reducing unnecessary OAuth consent surface and avoiding misleading users about which scopes the endpoint actually checks.
Files.ReadWrite only — endpoints documented as requiring just Files.ReadWrite were declaring broader variants (Files.ReadWrite.All, Sites.ReadWrite.All, Files.Read, etc.) that the underlying Graph API does not require:
add_chart, add_sharepoint_worksheet, add_table_row, add_worksheet, apply_table_sort, clear_range, delete_table_column, delete_worksheet, get_range, get_sharepoint_range, get_sharepoint_worksheet, get_worksheet_used_range, list_chart_series, list_named_items, list_sharepoint_tables, list_sharepoint_worksheets, list_table_columns, merge_cells, update_chart, update_chart_legend, update_sharepoint_rangecreate_workbook: dropped Files.Read / Files.Read.All (write endpoint, read scopes were spurious) → kept Files.ReadWrite, Files.ReadWrite.All, Sites.ReadWrite.Alllist_files: added Sites.Read.All / Sites.ReadWrite.All to match the driveitem-list-children docSource of truth: per-row Doc remarks in the QA sheet, citing Microsoft Graph documentation for each endpoint.
nox -s fmt_app -- apps/excel — passesnox -s chk_app -- apps/excel — ruff + mypy clean_scopes (validator accepts)🤖 Generated with Claude Code