PR Custody

PRPR Custody

fix: align apaleo inventory action scopes with swagger

@surajmarkupchecks n/achecks…fix/apaleo-scope-qa-mismatches → master25 files · +304 −227updated 1mo ago

GitHub

▸Description

Summary

Audited only the VERIFIED Apaleo sheet in [QA TESTING] Action To Scope Mapping.xlsx.
This workbook revision does not contain literal need review rows; it has manual status values plus an auto-computed Mercury vs official status column. I treated the 25 failed rows as changes to audit and re-verified the 4 success rows.
Ground truth for every scope decision: Inventory V1 swagger JSON (per-endpoint security) plus apaleo scopes guide for scope names/meanings.

Per-action changes

Action	Old	New	Reason	Source
`archive_a_property`	`missing`	`{"all_of":[{"any_of":["properties.manage","setup.manage","admin"]}]}`	Action had no `_scopes`; added the documented `properties.manage, setup.manage, admin` alternatives for `PUT /inventory/v1/property-actions/{id}/archive`.	Inventory V1 swagger JSON (`PUT /inventory/v1/property-actions/{id}/archive`)
`check_if_a_unit_attribute_exists`	`missing`	`{"all_of":[{"any_of":["unitattributes.read","setup.read","setup.manage","admin"]}]}`	Action had no `_scopes`; added the documented `unitattributes.read, setup.read, setup.manage, admin` alternatives for `HEAD /inventory/v1/unit-attributes/{id}`.	Inventory V1 swagger JSON (`HEAD /inventory/v1/unit-attributes/{id}`)
`check_if_a_unit_exists`	`["units.read","setup.read","setup.manage"]`	`{"all_of":[{"any_of":["units.read","setup.read","setup.manage","admin"]}]}`	Existing list matched the resource/setup scopes but omitted the documented `admin` alternative; converted to CNF and added `admin`.	Inventory V1 swagger JSON (`HEAD /inventory/v1/units/{id}`)
`check_if_a_unit_group_exists`	`["unitgroups.read","setup.read","setup.manage"]`	`{"all_of":[{"any_of":["unitgroups.read","setup.read","setup.manage","admin"]}]}`	Existing list matched the resource/setup scopes but omitted the documented `admin` alternative; converted to CNF and added `admin`.	Inventory V1 swagger JSON (`HEAD /inventory/v1/unit-groups/{id}`)
`clones_a_property`	`missing`	`{"all_of":[{"any_of":["properties.create","setup.manage","admin"]}]}`	Action had no `_scopes`; added the documented `properties.create, setup.manage, admin` alternatives for `POST /inventory/v1/property-actions/{id}/clone`.	Inventory V1 swagger JSON (`POST /inventory/v1/property-actions/{id}/clone`)
`create_a_unit`	`["units.create","setup.manage"]`	`{"all_of":[{"any_of":["units.create","setup.manage","admin"]}]}`	Existing list matched the resource/setup scopes but omitted the documented `admin` alternative; converted to CNF and added `admin`.	Inventory V1 swagger JSON (`POST /inventory/v1/units`)
`create_a_unit_attribute`	`missing`	`{"all_of":[{"any_of":["unitattributes.create","setup.manage","admin"]}]}`	Action had no `_scopes`; added the documented `unitattributes.create, setup.manage, admin` alternatives for `POST /inventory/v1/unit-attributes`.	Inventory V1 swagger JSON (`POST /inventory/v1/unit-attributes`)
`create_a_unit_group`	`["setup.manage"]`	`{"all_of":[{"any_of":["unitgroups.create","setup.manage","admin"]}]}`	Existing gate only allowed `setup.manage`; restored the endpoint-specific unit-group scope(s) plus the documented `admin` alternative.	Inventory V1 swagger JSON (`POST /inventory/v1/unit-groups`)
`create_multiple_units`	`["units.create","setup.manage"]`	`{"all_of":[{"any_of":["units.create","setup.manage","admin"]}]}`	Existing list matched the resource/setup scopes but omitted the documented `admin` alternative; converted to CNF and added `admin`.	Inventory V1 swagger JSON (`POST /inventory/v1/units/bulk`)
`creates_a_property`	`["setup.read","setup.manage"]`	`{"all_of":[{"any_of":["properties.create","setup.manage","admin"]}]}`	Old gate incorrectly allowed `setup.read`; replaced it with the endpoint's documented `properties.create` alternative and added `admin`.	Inventory V1 swagger JSON (`POST /inventory/v1/properties`)
`delete_a_unit`	`missing`	`{"all_of":[{"any_of":["units.delete","setup.manage","admin"]}]}`	Action had no `_scopes`; added the documented `units.delete, setup.manage, admin` alternatives for `DELETE /inventory/v1/units/{id}`.	Inventory V1 swagger JSON (`DELETE /inventory/v1/units/{id}`)
`delete_a_unit_group`	`["setup.manage"]`	`{"all_of":[{"any_of":["unitgroups.delete","setup.manage","admin"]}]}`	Existing gate only allowed `setup.manage`; restored the endpoint-specific unit-group scope(s) plus the documented `admin` alternative.	Inventory V1 swagger JSON (`DELETE /inventory/v1/unit-groups/{id}`)
`deletes_unit_attribute`	`missing`	`{"all_of":[{"any_of":["unitattributes.delete","setup.manage","admin"]}]}`	Action had no `_scopes`; added the documented `unitattributes.delete, setup.manage, admin` alternatives for `DELETE /inventory/v1/unit-attributes/{id}`.	Inventory V1 swagger JSON (`DELETE /inventory/v1/unit-attributes/{id}`)
`get_a_properties_list`	`["setup.read"]`	`{"all_of":[]}`	Swagger marks this endpoint as auth-only with no OAuth scope list; removed the stray scope gate.	Inventory V1 swagger JSON (`GET /inventory/v1/properties`)
`get_a_unit`	`["setup.read","setup.manage"]`	`{"all_of":[{"any_of":["units.read","setup.read","setup.manage","admin"]}]}`	Existing read gate was missing either the resource-specific read scope, `setup.manage`, or `admin`; aligned it to the swagger security list.	Inventory V1 swagger JSON (`GET /inventory/v1/units/{id}`)
`get_a_unit_group`	`["setup.read"]`	`{"all_of":[{"any_of":["unitgroups.read","setup.read","setup.manage","admin"]}]}`	Existing read gate was missing either the resource-specific read scope, `setup.manage`, or `admin`; aligned it to the swagger security list.	Inventory V1 swagger JSON (`GET /inventory/v1/unit-groups/{id}`)
`get_a_units_list`	`["units.read"]`	`{"all_of":[{"any_of":["units.read","setup.read","setup.manage","admin"]}]}`	Existing read gate was missing either the resource-specific read scope, `setup.manage`, or `admin`; aligned it to the swagger security list.	Inventory V1 swagger JSON (`GET /inventory/v1/units`)
`list_unit_groups`	`["setup.read","setup.manage"]`	`{"all_of":[{"any_of":["unitgroups.read","setup.read","setup.manage","admin"]}]}`	Existing read gate was missing either the resource-specific read scope, `setup.manage`, or `admin`; aligned it to the swagger security list.	Inventory V1 swagger JSON (`GET /inventory/v1/unit-groups`)
`get_unit_attribute_by_id`	`missing`	`{"all_of":[{"any_of":["unitattributes.read","setup.read","setup.manage","admin"]}]}`	Action had no `_scopes`; added the documented `unitattributes.read, setup.read, setup.manage, admin` alternatives for `GET /inventory/v1/unit-attributes/{id}`.	Inventory V1 swagger JSON (`GET /inventory/v1/unit-attributes/{id}`)
`get_unit_attribute_list`	`missing`	`{"all_of":[{"any_of":["unitattributes.read","setup.read","setup.manage","admin"]}]}`	Action had no `_scopes`; added the documented `unitattributes.read, setup.read, setup.manage, admin` alternatives for `GET /inventory/v1/unit-attributes`.	Inventory V1 swagger JSON (`GET /inventory/v1/unit-attributes`)
`move_property_to_live`	`missing`	`{"all_of":[{"any_of":["properties.manage","setup.manage","admin"]}]}`	Action had no `_scopes`; added the documented `properties.manage, setup.manage, admin` alternatives for `PUT /inventory/v1/property-actions/{id}/set-live`.	Inventory V1 swagger JSON (`PUT /inventory/v1/property-actions/{id}/set-live`)
`replace_a_unit_group`	`["setup.manage"]`	`{"all_of":[{"any_of":["unitgroups.manage","setup.manage","admin"]}]}`	Existing gate only allowed `setup.manage`; restored the endpoint-specific unit-group scope(s) plus the documented `admin` alternative.	Inventory V1 swagger JSON (`PUT /inventory/v1/unit-groups/{id}`)
`reset_property_data`	`missing`	`{"all_of":[{"any_of":["properties.manage","setup.manage","admin"]}]}`	Action had no `_scopes`; added the documented `properties.manage, setup.manage, admin` alternatives for `PUT /inventory/v1/property-actions/{id}/reset`.	Inventory V1 swagger JSON (`PUT /inventory/v1/property-actions/{id}/reset`)
`returns_number_of_unit_groups`	`["setup.read"]`	`{"all_of":[{"any_of":["unitgroups.read","setup.read","setup.manage","admin"]}]}`	Existing read gate was missing either the resource-specific read scope, `setup.manage`, or `admin`; aligned it to the swagger security list.	Inventory V1 swagger JSON (`GET /inventory/v1/unit-groups/$count`)
`returns_number_of_units`	`["setup.read"]`	`{"all_of":[{"any_of":["units.read","setup.read","setup.manage","admin"]}]}`	Existing read gate was missing either the resource-specific read scope, `setup.manage`, or `admin`; aligned it to the swagger security list.	Inventory V1 swagger JSON (`GET /inventory/v1/units/$count`)

Coverage matrix

Action	HTTP call(s) verified in action code	Doc scopes on every verified endpoint	CNF shipped
`archive_a_property`	`PUT /inventory/v1/property-actions/{id}/archive`	`properties.manage`, `setup.manage`, `admin`	`{"all_of":[{"any_of":["properties.manage","setup.manage","admin"]}]}`
`check_if_a_unit_attribute_exists`	`HEAD /inventory/v1/unit-attributes/{id}`	`unitattributes.read`, `setup.read`, `setup.manage`, `admin`	`{"all_of":[{"any_of":["unitattributes.read","setup.read","setup.manage","admin"]}]}`
`check_if_a_unit_exists`	`HEAD /inventory/v1/units/{id}`	`units.read`, `setup.read`, `setup.manage`, `admin`	`{"all_of":[{"any_of":["units.read","setup.read","setup.manage","admin"]}]}`
`check_if_a_unit_group_exists`	`HEAD /inventory/v1/unit-groups/{id}`	`unitgroups.read`, `setup.read`, `setup.manage`, `admin`	`{"all_of":[{"any_of":["unitgroups.read","setup.read","setup.manage","admin"]}]}`
`clones_a_property`	`POST /inventory/v1/property-actions/{id}/clone`	`properties.create`, `setup.manage`, `admin`	`{"all_of":[{"any_of":["properties.create","setup.manage","admin"]}]}`
`create_a_unit`	`POST /inventory/v1/units`	`units.create`, `setup.manage`, `admin`	`{"all_of":[{"any_of":["units.create","setup.manage","admin"]}]}`
`create_a_unit_attribute`	`POST /inventory/v1/unit-attributes`	`unitattributes.create`, `setup.manage`, `admin`	`{"all_of":[{"any_of":["unitattributes.create","setup.manage","admin"]}]}`
`create_a_unit_group`

Reviewed but not changed

Action	Sheet status	Why no change	Source
`check_if_a_property_exists`	`✓ MATCH (no scope required)`	Action code only calls `HEAD /inventory/v1/properties/{id}`, and the Inventory V1 swagger lists no scopes for that endpoint, so master already matched the real docs.	Inventory V1 swagger JSON (`HEAD /inventory/v1/properties/{id}`)
`get_a_property`	`✓ MATCH (no scope required)`	Action code only calls `GET /inventory/v1/properties/{id}`, and the Inventory V1 swagger lists no scopes for that endpoint, so master already matched the real docs.	Inventory V1 swagger JSON (`GET /inventory/v1/properties/{id}`)
`return_total_count_of_properties`	`✓ MATCH (no scope required)`	Action code only calls `GET /inventory/v1/properties/$count`, and the Inventory V1 swagger lists no scopes for that endpoint, so master already matched the real docs.	Inventory V1 swagger JSON (`GET /inventory/v1/properties/$count`)
`returns_a_list_of_supported_countries`	`✓ MATCH (no scope required)`	Action code only calls `GET /inventory/v1/types/countries`, and the Inventory V1 swagger lists no scopes for that endpoint, so master already matched the real docs.	Inventory V1 swagger JSON (`GET /inventory/v1/types/countries`)

Validation

/.nox/fmt_app/bin/ruff format <edited apaleo files>
/.nox/chk_app/bin/ruff check <edited apaleo files>
python3 AST check with ast.literal_eval confirmed every edited _scopes block is valid CNF: {"all_of": [...]} with only string clauses or {"any_of": [...]} clauses.

Bugbot pass

Fetched gh api repos/ComposioHQ/mercury/pulls/23391/comments on 2026-05-11; response was [] (no review comments / no bugbot flags at fetch time).
No follow-up commit or retrospective section was needed.

loading diff…