PipedreamHQ / PipedreamHQ/pipedream
[FEATURE] Add ZohoCRM.files.CREATE and ZohoCRM.files.READ to the managed Zoho CRM OAuth client scopes
- Dominant language
- JavaScript
- Stars
- 11.7k
- Forks
- 5.8k
- Avg merge
- 3d 10h
- Merged PRs (30d)
- 102
Description
**Is your feature request related to a problem? Please describe.**
Pipedream's managed Zoho CRM OAuth client requests scopes for modules, records and settings, but it does not include the `ZohoCRM.files.*` scopes. Any account connected with the managed client therefore cannot call the Zoho File System (ZFS) endpoints:
- `POST https://www.zohoapis.com/crm/v8/files` requires `ZohoCRM.files.CREATE`
- `GET https://www.zohoapis.com/crm/v8/files?id=...` requires `ZohoCRM.files.READ`
Those calls fail with `OAUTH_SCOPE_MISMATCH`.
Concretely: we attach documents (PO/quote PDFs and similar) to file-upload fields on a Sales Order. Zoho requires uploading to ZFS first to obtain a file ID, then referencing that ID on the record. Without `ZohoCRM.files.CREATE` the ZFS step is impossible, and the fallback is a generic record attachment, which lands the file in the Attachments section rather than the intended field.
Docs:
- Upload Files: https://www.zoho.com/crm/developer/docs/api/v8/upload-files.html
- Get File: https://www.zoho.com/crm/developer/docs/api/v8/get-file.html
- Scopes reference: https://www.zoho.com/crm/developer/docs/api/v8/scopes.html
**Describe the solution you'd like**
Add `ZohoCRM.files.CREATE` and `ZohoCRM.files.READ` to the default scope set on Pipedream's managed Zoho CRM OAuth client.
Both are narrow, file-specific scopes and neither grants access to record or setting data beyond what the current set already covers, so the consent screen impact is small relative to the capability unlocked.
**Do you have a workaround?**
Only unattractive ones.
Registering a custom OAuth client for Zoho CRM (https://pipedream.com/docs/apps/oauth-clients) would let us set the scopes ourselves, but that means owning a Zoho client registration per data center and the credential rotation that comes with it, purely to add two file scopes. We would much rather stay on the managed client.
The other fallback, generic record attachments instead of file-upload fields, works but loses the field-level association users expect.
**Comparable features in other tools?**
n/a. Pipedream's custom OAuth client support already covers the general case well. This request is specifically about the default scope set on the managed client.
**Additional context**
Prior art in this repo: #1517 added `ZohoCRM.templates.email.READ` and `ZohoCRM.templates.inventory.READ` to this same app.
`ZohoCRM.files.READ` is requested alongside `CREATE` because reading an uploaded file back, to verify it or re-attach it, hits the same scope family.
Contributor guide
Research direction
Search the Zoho CRM app configuration for the managed OAuth client's default scope set, then compare its structure with the change described in issue #1517. Add the two file scopes and verify that the resulting authorization includes them for the documented ZFS upload and get-file requests.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- javascript
- Domain
- api, authentication
- Issue type
- Feature
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Active
- Clarity
- Clearly specified
- Newbie friendliness
- 72/100