fix(auth): add cross-service Drive scopes for docs and sheets tools - #432
Conversation
Several docs tools (search_docs, get_doc_content, list_docs_in_folder, export_doc_to_pdf) and sheets tools (list_spreadsheets) internally use the Google Drive API but only receive docs/sheets-specific OAuth scopes when configured with `--tools docs sheets` (without `drive`). This adds the minimal required Drive scopes as cross-service dependencies: - docs: drive.readonly (metadata queries) + drive.file (PDF export) - sheets: drive.readonly (spreadsheet listing) This follows the existing pattern where appscript already includes DRIVE_FILE_SCOPE for its Drive API dependency. The alternative workaround of adding `--tools drive` exposes 14 full-access Drive tools which is undesirable from a security perspective. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
|
Hm, that's an interesting point. I think on one side, that may be concerning to users who think that they are only doing |
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
|
Thanks for the review! Pushed a ruff format fix (821804c) — the CI shows |
There was a problem hiding this comment.
Pull request overview
This PR fixes a runtime 403 error issue where docs and sheets tools fail when calling the Google Drive API because they lack the necessary Drive OAuth scopes. The fix adds minimal cross-service Drive scopes (drive.readonly and drive.file) to docs and sheets scope configurations, following the existing pattern used by the appscript tool.
Changes:
- Added
DRIVE_READONLY_SCOPEandDRIVE_FILE_SCOPEtoDOCS_SCOPESfor metadata queries and PDF export functionality - Added
DRIVE_READONLY_SCOPEtoSHEETS_SCOPESfor spreadsheet listing - Updated read-only mode scope mappings to include
DRIVE_READONLY_SCOPEfor both docs and sheets - Added comprehensive unit tests covering scope generation for docs, sheets, combined tools, and read-only modes
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.
| File | Description |
|---|---|
auth/scopes.py |
Modified scope definitions to include necessary Drive scopes for docs and sheets tools, enabling cross-service API calls without requiring explicit --tools drive flag |
tests/test_scopes.py |
Added 10 new unit tests to verify correct scope generation across different tool combinations and read-only mode configurations |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
|
Thanks! |
Summary
Several docs and sheets tools internally use the Google Drive API but don't receive the necessary Drive OAuth scopes when configured with
--tools docs sheets(without explicitly addingdrive):search_docs,get_doc_content,list_docs_in_folder,export_doc_to_pdflist_spreadsheetsThese tools use
@require_google_service("drive", ...)internally, which callsbuild("drive", "v3", credentials). The credentials work because the service builder doesn't gate on--tools, but the OAuth token lacks the required Drive scopes — causing API 403 errors at runtime.Fix
Add minimal cross-service Drive scopes to
DOCS_SCOPESandSHEETS_SCOPESinauth/scopes.py:drive.readonly(for metadata queries) +drive.file(for PDF export)drive.readonly(for spreadsheet listing)This follows the existing pattern where
SCRIPT_SCOPES(appscript) already includesDRIVE_FILE_SCOPEas a cross-service dependency (line 127).Importantly, this does not add
drive(full access) — only the minimal scopes needed. The alternative workaround of adding--tools driveexposes 14 full-access Drive tools, which is undesirable from a least-privilege perspective.Changes
auth/scopes.pyDRIVE_READONLY_SCOPE+DRIVE_FILE_SCOPEtoDOCS_SCOPES,DRIVE_READONLY_SCOPEtoSHEETS_SCOPES, and corresponding read-only variantstests/test_scopes.pyTest plan
manual_test.pyfixture)--tools docs sheets(withoutdrive) can successfully callsearch_docs,list_spreadsheets,export_doc_to_pdf🤖 Generated with Claude Code