fix(sheets): replace unreal :read scope with :readonly in shortcuts

[EthanGuo-coder]

Summary

All lark-cli sheets shortcuts declared sheets:spreadsheet:read as a required scope, but that scope name does not exist on the Feishu Open Platform — the real name is sheets:spreadsheet:readonly. Because the framework's preflight (internal/auth/scope.go MissingScopes) does exact-string scope matching, tokens that carried the correct :readonly / :write_only / :create scopes were rejected with a misleading missing required scope(s): sheets:spreadsheet:read hint, and the entire sheets shortcut layer was unusable.

Changes

• Replace sheets:spreadsheet:read with sheets:spreadsheet:readonly in every sheets shortcut declaration (35 occurrences across 9 files under shortcuts/sheets/).
• Update the two affected scope strings in internal/registry/registry_test.go so the auto-approve-set test reflects the real scope name.
• Add two regression tests in shortcuts/sheets/shortcuts_test.go:
  • TestShortcuts_NoUnrealReadScope — walks every registered sheets shortcut and fails if any re-declares the unreal :read form.
  • TestShortcuts_PrecheckAcceptsFeishuSheetsScopes — feeds a token granted the documented Feishu sheets scopes (:create / :readonly / :write_only) through auth.MissingScopes against every sheets-only shortcut's Scopes, and fails if any shortcut is rejected. This pins the precheck behaviour the issue reported.

Test Plan

• go test ./shortcuts/sheets/... passes (both new tests included).
• go test ./internal/registry/... passes.
• TestShortcuts_PrecheckAcceptsFeishuSheetsScopes hermetically verifies that lark-cli sheets +read / +write / +append / +find (and every other sheets-only shortcut) no longer reject tokens holding sheets:spreadsheet:readonly / :write_only / :create.

Related Issues

• Fixes [bug] sheets shortcut precheck rejects valid token — hardcoded "sheets:spreadsheet:read" instead of "sheets:spreadsheet:readonly" #838

Summary by CodeRabbit

• Chores
  • Updated OAuth permission scopes for Sheets operations to use the sheets:spreadsheet:readonly variant instead of the deprecated sheets:spreadsheet:read scope across read, write, styling, filtering, and management shortcuts.
  • Added validation tests to ensure all Sheets shortcuts declare correct permission scopes.

[CLAassistant]

All committers have signed the CLA.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 9aba7f75-fa1a-4b88-9665-277834ad0907

📥 Commits

Reviewing files that changed from the base of the PR and between 4a45e00 and 4322fdf.

📒 Files selected for processing (11)

• internal/registry/registry_test.go
• shortcuts/sheets/lark_sheets_cell_data.go
• shortcuts/sheets/lark_sheets_cell_images.go
• shortcuts/sheets/lark_sheets_cell_style_and_merge.go
• shortcuts/sheets/lark_sheets_dropdown.go
• shortcuts/sheets/lark_sheets_filter_views.go
• shortcuts/sheets/lark_sheets_float_images.go
• shortcuts/sheets/lark_sheets_row_column_management.go
• shortcuts/sheets/lark_sheets_sheet_management.go
• shortcuts/sheets/lark_sheets_spreadsheet_management.go
• shortcuts/sheets/shortcuts_test.go

---

📝 Walkthrough

Walkthrough

This PR corrects OAuth scope names across all 38 Sheets shortcuts by replacing the non-existent sheets:spreadsheet:read with the correct Feishu scope sheets:spreadsheet:readonly, and adds validation tests to prevent regression. Registry and shortcut tests are updated to reflect the corrected scope expectations.

Changes

Sheets OAuth Scope Alignment

Layer / File(s)	Summary
Scope validation tests shortcuts/sheets/shortcuts_test.go	Two new test functions validate that no shortcut uses the invalid sheets:spreadsheet:read scope and that shortcuts declaring only sheets:* scopes are compatible with required real Feishu sheets scopes via auth.MissingScopes.
Cell data operation shortcuts shortcuts/sheets/lark_sheets_cell_data.go	SheetRead, SheetWrite, SheetAppend, SheetFind, and SheetReplace replace sheets:spreadsheet:read with sheets:spreadsheet:readonly while preserving write-only scopes where applicable.
Cell formatting and image shortcuts shortcuts/sheets/lark_sheets_cell_style_and_merge.go, shortcuts/sheets/lark_sheets_cell_images.go, shortcuts/sheets/lark_sheets_float_images.go	Seven shortcuts (SheetSetStyle, SheetBatchSetStyle, SheetMergeCells, SheetUnmergeCells, SheetWriteImage, SheetGetFloatImage, SheetListFloatImages) update their read scope to sheets:spreadsheet:readonly.
Sheet structure operation shortcuts shortcuts/sheets/lark_sheets_dropdown.go, shortcuts/sheets/lark_sheets_filter_views.go, shortcuts/sheets/lark_sheets_row_column_management.go, shortcuts/sheets/lark_sheets_sheet_management.go	Twenty-three shortcuts spanning dropdown management, filter views, row/column operations, and sheet creation/copying/deletion replace sheets:spreadsheet:read with sheets:spreadsheet:readonly.
Spreadsheet metadata and registry alignment shortcuts/sheets/lark_sheets_spreadsheet_management.go, internal/registry/registry_test.go	SheetInfo metadata scope is updated, and registry auto-approve test expectations are aligned to verify the correct scope in allow-list and filtering scenarios.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~12 minutes

Possibly related PRs

• larksuite/cli#413: Introduces dimension shortcuts (SheetAddDimension, SheetInsertDimension, etc.) whose scopes are corrected in this PR.

Suggested labels

size/L

Suggested reviewers

• fangshuyu-768
• liangshuo-1

Poem

🐰 A scope renamed from false to true,
Thirty-eight shortcuts, all made new.
Tests now stand guard, so none shall slip—
From read to readonly, steady grip. ✨

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 25.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly and concisely summarizes the main change: replacing the incorrect sheets:spreadsheet:read scope with the correct sheets:spreadsheet:readonly scope across shortcuts.
Description check	✅ Passed	The PR description comprehensively covers all required template sections: Summary explains the problem, Changes lists all modifications with scope replacements and test additions, Test Plan details testing done, and Related Issues references #838.
Linked Issues check	✅ Passed	All PR changes directly address issue #838 requirements: 35 scope replacements across 9 shortcuts files, registry test updates, and two new regression tests that verify the fix prevents re-introduction of the unreal scope.
Out of Scope Changes check	✅ Passed	All changes are directly scoped to fixing issue #838: scope string replacements, test updates, and regression test additions. No unrelated modifications detected.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

Tip

💬 Introducing Slack Agent: The best way for teams to turn conversations into code.

Slack Agent is built on CodeRabbit's deep understanding of your code, so your team can collaborate across the entire SDLC without losing context.

• Generate code and open pull requests
• Plan features and break down work
• Investigate incidents and troubleshoot customer tickets together
• Automate recurring tasks and respond to alerts with triggers
• Summarize progress and report instantly

Built for teams:

• Shared memory across your entire org—no repeating context
• Per-thread sandboxes to safely plan and execute work
• Governance built-in—scoped access, auditability, and budget controls

One agent for your entire SDLC. Right inside Slack.

👉 Get started

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}