PR Custody

fix: correct Airtable scope mismatches from QA audit

@surajmarkupchecks n/achecks…fix/airtable-scope-qa-mismatches → master5 files · +10 −35updated 4w ago

▸Description

Summary

fix 5 real Airtable _scopes mismatches from the Desktop QA workbook audit
keep AIRTABLE_CREATE_RECORD_FROM_NL unchanged after verifying it genuinely needs a two-clause CNF intersection
document per-action coverage, reviewed-but-not-changed results, and local validation

No existing GitHub issue matched this Airtable scope-audit task, so this PR is tied directly to the QA workbook request.

Scope audit coverage matrix

Action	File	Observed HTTP calls in code	Old `_scopes`	Final `_scopes`	Decision
`AIRTABLE_CREATE_A_RECORD`	`apps/airtable/actions/create_a_record.py`	`POST /v0/{baseId}/{tableIdOrName}`	`all_of(data.records:write AND schema.bases:read)`	`any_of(data.records:write)`	changed
`AIRTABLE_CREATE_MULTIPLE_RECORDS`	`apps/airtable/actions/create_multiple_records.py`	batched `POST /v0/{baseId}/{tableIdOrName}`	`all_of(data.records:write AND schema.bases:write)`	`any_of(data.records:write)`	changed
`AIRTABLE_CREATE_RECORD_FROM_NL`	`apps/airtable/actions/create_record_from_nl.py`	`GET /meta/bases/{baseId}/tables` + `POST /{baseId}/{table_id}`	`all_of(data.records:write AND schema.bases:read)`	unchanged	reviewed, not changed
`AIRTABLE_GET_RECORD`	`apps/airtable/actions/get_record.py`	`GET /{baseId}/{tableIdOrName}/{recordId}`	`all_of(data.records:read AND schema.bases:read)`	`any_of(data.records:read)`	changed
`AIRTABLE_UPDATE_RECORD`	`apps/airtable/actions/update_record.py`	`PATCH /v0/{baseId}/{tableIdOrName}/{recordId}`	`all_of(data.records:read AND data.records:write AND schema.bases:read)`	`any_of(data.records:write)`	changed
`AIRTABLE_UPLOAD_ATTACHMENT`	`apps/airtable/actions/upload_attachment.py`	`POST /v0/{baseId}/{recordId}/{attachmentFieldIdOrName}/uploadAttachment` via `content.airtable.com`	`all_of(data.records:write AND data.records:read AND schema.bases:read)`	`any_of(data.records:write)`	changed

Why each change is correct

AIRTABLE_CREATE_A_RECORD / AIRTABLE_CREATE_MULTIPLE_RECORDS
- Code makes only the create-records POST.
- Airtable's create-records endpoint documents data.records:write: https://airtable.com/developers/web/api/create-records
- So the extra schema clauses were false blockers.
AIRTABLE_GET_RECORD
- Code makes only the get-record GET.
- Airtable's get-record endpoint documents data.records:read: https://airtable.com/developers/web/api/get-record
- So schema.bases:read was unnecessary.
AIRTABLE_UPDATE_RECORD
- Code makes only the update-record PATCH and handles failures directly from that response.
- Airtable's update-record endpoint documents data.records:write: https://airtable.com/developers/web/api/update-record
- So Mercury should not require an added read or schema clause.
AIRTABLE_UPLOAD_ATTACHMENT
- Code makes only the upload-attachment POST.
- Airtable's upload-attachment endpoint documents data.records:write: https://airtable.com/developers/web/api/upload-attachment
- So Mercury should not require record-read or schema-read.

Reviewed but not changed

Action Why unchanged

AIRTABLE_CREATE_RECORD_FROM_NL This action has two mandatory primary calls: GET /meta/bases/{baseId}/tables to fetch schema and POST /{baseId}/{table_id} to create the record. There is no graceful degradation path. Under the scope-audit rules, the CNF must intersect both endpoints, so keeping data.records:write and schema.bases:read is correct. Docs: get-base-schema https://airtable.com/developers/web/api/get-base-schema ; create-records https://airtable.com/developers/web/api/create-records

Action	Why unchanged
`AIRTABLE_CREATE_RECORD_FROM_NL`	This action has two mandatory primary calls: `GET /meta/bases/{baseId}/tables` to fetch schema and `POST /{baseId}/{table_id}` to create the record. There is no graceful degradation path. Under the scope-audit rules, the CNF must intersect both endpoints, so keeping `data.records:write` and `schema.bases:read` is correct. Docs: get-base-schema https://airtable.com/developers/web/api/get-base-schema ; create-records https://airtable.com/developers/web/api/create-records

Validation

black --check on changed Airtable action files
isort --check-only on changed Airtable action files
python -m py_compile on changed Airtable action files
ActionBuilder.validate_scopes(...) on the five changed actions plus CreateRecordFromNaturalLanguage

Bugbot pass

This PR changes only _scopes declarations plus formatter-only line wrapping.
Every changed action was traced back to its real HTTP calls before updating scopes.
Multi-endpoint CNF collapse was explicitly rejected for AIRTABLE_CREATE_RECORD_FROM_NL.
Local validation passed before opening the PR.

loading diff…