ADR: a Money Forward Cloud 経費 connector, and a scope question - #261
Open
wooheum-xin wants to merge 1 commit into
Open
ADR: a Money Forward Cloud 経費 connector, and a scope question#261wooheum-xin wants to merge 1 commit into
wooheum-xin wants to merge 1 commit into
Conversation
Money Forward is the dominant back-office suite in Japan and its expense product is what people most want to ask an agent about. The connector fits the existing declarative shape, but the vendor documents no read-only scope for transactions or reports, so reading them appears to require a scope that also permits writing. Asking what qm's convention should be before inventing one. Claude-Session: https://claude.ai/code/session_01AnKuftwBchrSLpfQkzBHUE
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
We run qm at a Japanese company, and expense claims are the thing people most often want to ask an agent about that it currently cannot see. Money Forward Cloud is the dominant back-office suite here.
The connector itself fits the existing shape —
expense.moneyforward.comspeaks plain OAuth 2.0 authorization code with a standard token response, somakeTokenAdapters({})handles exchange and refresh with no custom code. Static authorize/token URLs, one host, REST under/api/external/v1/. Same shape as Linear or Dropbox.The part we would like your view on is scopes. Money Forward documents no read-only scope for the resources people actually want to read: we could not find
transaction:readorreport:readanywhere, only the:writeforms. So reading someone's expense transactions appears to require a scope that also lets an agent create and update them — an uncomfortable default for a money system.We defaulted to
public_resource:read+user_setting:readand left widening to an administrator through the per-org scope override, with the reason inscopesRationale. We are not confident that is the right convention, and the same question will come up for any vendor that bundles read into write — so we would rather follow yours than invent one.Happy to test against a live Japanese tenant either way; that is the part that is hard to come by outside Japan.
https://claude.ai/code/session_01AnKuftwBchrSLpfQkzBHUE
Need help on this PR? Tag
@codesmith-botwith what you need. Autofix is disabled.