Prepare original Sheets add-on for OAuth verification - #19
Conversation
|
Warning Review limit reached
Next review available in: 56 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (3)
📝 WalkthroughWalkthroughThe add-on version is updated to 1.2.1. API-key deletion now also removes stored diagnostics, while the sidebar adds expanded data-use disclosures and privacy policy links with corresponding tests. ChangesAdd-on release updates
Estimated code review effort: 2 (Simple) | ~10 minutes 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (1)
test/runtime.test.js (1)
214-224: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick winCover user-property cleanup as well.
This regression test seeds only document properties, while
deleteApiKey()also removes the API key and diagnostic from user properties. Add a user-property fixture and assertions so the legacy fallback path is protected.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@test/runtime.test.js` around lines 214 - 224, Extend the deleteApiKey regression test around harness.context.deleteApiKey() by seeding OILPRICEAPI_KEY and OILPRICEAPI_LAST_DIAGNOSTIC in user properties, then assert both user-property entries are removed. Preserve the existing document-property fixtures and assertions to cover cleanup in both storage locations.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@Sidebar.html`:
- Around line 169-170: Update the disclosure text near the add-on privacy notice
and its regression test to accurately state that OILPRICE_GET() may send
user-supplied query parameter keys and values to OilPriceAPI, rather than
claiming only reviewed filters are transmitted. Keep the existing API key and
market identifier disclosure intact.
---
Nitpick comments:
In `@test/runtime.test.js`:
- Around line 214-224: Extend the deleteApiKey regression test around
harness.context.deleteApiKey() by seeding OILPRICEAPI_KEY and
OILPRICEAPI_LAST_DIAGNOSTIC in user properties, then assert both user-property
entries are removed. Preserve the existing document-property fixtures and
assertions to cover cleanup in both storage locations.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: 356d6d98-d70b-442a-917b-08f1e42c27f3
⛔ Files ignored due to path filters (1)
package-lock.jsonis excluded by!**/package-lock.json
📒 Files selected for processing (5)
Code.gsSidebar.htmlpackage.jsontest/public-claims.test.jstest/runtime.test.js
| This add-on works only in the spreadsheet where you open it. It sends only your API key and requested market identifiers to OilPriceAPI, plus reviewed filters needed for the selected endpoint. It does not request broad Google Drive access or use your Google email or profile. | ||
| Marketplace publication is pending. |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
Correct the data-sharing disclosure or restrict query parameters.
OILPRICE_GET() forwards arbitrary non-sensitive query keys and values; normalizeApiQuery_() does not allowlist endpoint-specific filters. Therefore users can send additional data beyond “reviewed filters,” contradicting this OAuth disclosure. Either enforce endpoint-specific query allowlists or update the notice and its regression test to describe user-supplied query parameters accurately.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@Sidebar.html` around lines 169 - 170, Update the disclosure text near the
add-on privacy notice and its regression test to accurately state that
OILPRICE_GET() may send user-supplied query parameter keys and values to
OilPriceAPI, rather than claiming only reviewed filters are transmitted. Keep
the existing API key and market identifier disclosure intact.
…ck claim (#26) * docs: record v11/1.2.2 as release candidate and correct the review-lock claim Two corrections, both verified against the live Google console and the Apps Script project on 2026-07-31. 1. Version 11 supersedes version 10. PR #22 (custom-function credential fix) merged 2026-07-29 22:01 UTC -- after version 10 was cut -- and changed Code.gs and Sidebar.html. Immutable version 11 was cut the same minute (18:01 EDT, the same instant in local time) and carries runtime 1.2.2; its Code.gs reads ADDON_VERSION = '1.2.2'. The Marketplace draft is still pinned to version 9, which was cut 2026-07-28 and predates BOTH #19 (OAuth verification prep) and #22. Version 11 is the release candidate and the docs now say so in every forward-looking place. 2. App Configuration is NOT locked during review. DEPLOYMENT_GUIDE.md and OAUTH_VERIFICATION.md both asserted the Marketplace App Configuration locks while Google reviews the draft. DOM inspection of the Cloud console disproves it: every input reports disabled:false, readOnly:false, no aria-disabled, and the Version field is a free-text input currently holding 9. Only the Store Listing tab locks ("The draft is in review and can't be edited"). That wrong assumption nearly drove an unnecessary cancel-and-recut of a submission that only ever needed a version repin. Nothing has been published; there is no live listing. test/public-claims.test.js is updated to pin 1.2.2/v11 and now also guards both corrections, so neither can silently regress. Verified: npm run validate passes -- 54 tests, deployment package, marketplace assets, portfolio, and secret scan all green. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * docs: date the packet July 31 and separate re-verified state from July 29 evidence Addresses CodeRabbit review on #26: the heading claimed 'Status as of July 29' while the Current Google state block recorded July 31 console verification. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
1 participant
Why
Google OAuth review requires accurate in-product disclosure, narrow scope justification, a matching public privacy policy, and a working deletion path before the original add-on can be approved.
What changed
Verification
Built 5 distinct Apps Script release packages.
Apps Script structure and bindings: valid
✔ all five builds compile and expose unique product identities (3.237125ms)
✔ crack-spread math covers 3-2-1 and 2-1-1 conventions (0.540667ms)
✔ bunker voyage model calculates tonnes, blend, and total cost (0.410292ms)
✔ fuel surcharge schedule never produces a negative surcharge (0.357125ms)
✔ curve parser rejects incomplete data and labels structure (0.780292ms)
✔ gas spread normalization makes currency and energy conversion explicit (0.34875ms)
✔ API requests carry measurable product identity without sheet contents (0.612667ms)
✔ reviewed market catalogs and first-party URL boundary are enforced (0.416917ms)
✔ public surfaces identify Marketplace status and canonical facts (1.285ms)
✔ Marketplace listing gives Google Sheets trademark attribution (0.150208ms)
✔ sidebar gives an in-product privacy notice and policy links (0.159667ms)
✔ public surfaces contain no unsupported mutable claims (0.713041ms)
✔ credential lifecycle never returns the stored key (1.730584ms)
✔ spreadsheet-scoped key survives the custom-function user identity boundary (1.409375ms)
✔ legacy user-property key remains readable until it is saved per spreadsheet (0.888417ms)
✔ OILPRICE rejects a missing key with a recovery action (0.507875ms)
✔ OILPRICE maps HTTP 401 to actionable recovery (0.399458ms)
✔ OILPRICE maps HTTP 403 to actionable recovery (0.32975ms)
✔ OILPRICE maps HTTP 429 to actionable recovery (0.302875ms)
✔ OILPRICE maps Apps Script fetch failures to timeout recovery (0.423666ms)
✔ OILPRICE rejects malformed JSON and an empty successful response (0.677917ms)
✔ OILPRICE rejects successful records with missing source fields (1.155875ms)
✔ OILPRICE supports the production flat record and caches its source data (0.325125ms)
✔ Excel-equivalent price, status, unit, and info formulas preserve source context (0.411584ms)
✔ OILPRICE_GET and OILPRICE_CODES match the Excel allowlisted table contract (0.885459ms)
✔ OILPRICE_GET rejects unsupported endpoints and credential-shaped query keys before fetch (0.417209ms)
✔ Excel-equivalent formulas return stable worksheet error codes (0.484208ms)
✔ OILPRICE_GET accepts the full reviewed Excel endpoint catalog (6.452917ms)
✔ OILPRICE_GET renders nested futures, diesel, and price-hash responses (0.933958ms)
✔ nested and encoded credential query keys are rejected (0.878708ms)
✔ a stale cache envelope is discarded before formula refresh (0.311459ms)
✔ historical formula retains API timestamps and rejects missing timestamps (1.191166ms)
✔ bunker records preserve the complete source contract (0.340667ms)
✔ bunker records reject empty, malformed, and incomplete successful responses (1.955625ms)
✔ BUNKER_PRICE maps HTTP 401 to actionable recovery (0.260708ms)
✔ BUNKER_PRICE maps HTTP 402 to actionable recovery (0.238667ms)
✔ BUNKER_PRICE maps HTTP 403 to actionable recovery (0.235166ms)
✔ BUNKER_PRICE maps HTTP 429 to actionable recovery (0.231834ms)
✔ BUNKER_PRICE maps Apps Script fetch failures to timeout recovery (0.2385ms)
✔ bunker formulas normalize and encode filters and return source-aware values (0.577959ms)
✔ bunker inputs reject unsupported filter characters before fetch (0.223917ms)
✔ Data Connector sheet writer creates the nine-column source-aware table (0.407583ms)
✔ Data Connector menu flow alerts on success and recovers from empty data (0.512042ms)
✔ batch refresh rejects the documented Apps Script request limit (0.274208ms)
✔ batch refresh writes only validated API metadata (0.286292ms)
✔ reference conversion uses the validated latest record (0.308834ms)
✔ exchange-rate conversion has no fabricated fallback (0.285417ms)
✔ testConnection validates source data instead of accepting any HTTP 200 (0.48425ms)
✔ user info does not invent a tier or request limit (0.263875ms)
ℹ tests 49
ℹ suites 0
ℹ pass 49
ℹ fail 0
ℹ cancelled 0
ℹ skipped 0
ℹ todo 0
ℹ duration_ms 69.828209
Deployment package verified: Code.gs, Sidebar.html, FetchDialog.html, appsscript.json
Marketplace assets and 1 screenshot(s) have the required formats and dimensions.
Portfolio verified: crack-spread-lab, bunker-voyage-planner, fuel-surcharge-studio, energy-curve-builder, gas-spread-monitor
Secret scan passed (filenames only).
Release plan
After merge, push this exact runtime to Apps Script, smoke it, create immutable version 10, then update the Marketplace SDK only after the public policy pages are deployed.
Summary by CodeRabbit
New Features
Bug Fixes
Chores