[Tonours]

Aligns action approval request handling with agent-nodejs and agent-python: an action run with an approval request uses the signed payload, scoped to the collection it was issued for.

fixes PRD-1764

What

File	Change
routes/action/actions.rb	The decoded approval request's data is used as the action request data. Approval requests issued for another collection, without explicit record ids, with an unexpected shape, or that cannot be decoded return a ForbiddenError (403) before permission checks.
spec/.../routes/resources/action/actions_spec.rb	Approval request specs with server-shaped payloads: signed ids and values, collection scoping, explicit record ids, 403 cases, field-aware value parsing, outer query filters.
spec/.../routes/action/actions_spec.rb	Two existing specs use server-shaped payloads (PRD-1704 behaviour kept).
spec/.../services/smart_action_checker_spec.rb	Checker spec on the new payload shape.

Why

• Using the signed payload as the request data matches agent-nodejs and agent-python.
• The decoded payload uses indifferent access so signed values keep field-aware parsing (collection and file fields). The copy passed to SmartActionChecker is a deep_dup, so the checker contract is unchanged.
• Decoding errors now map to 403 instead of 500.
• Outer query filters (filters, search, segment) still apply on top of the signed selection, as in Node and Python.

Parity: consistency follow-ups for the other agents are tracked internally.

How to test

• cd packages/forest_admin_agent && BUNDLE_GEMFILE=Gemfile-test bundle exec rspec spec/lib/forest_admin_agent/routes/action spec/lib/forest_admin_agent/routes/resources/action spec/lib/forest_admin_agent/services/smart_action_checker_spec.rb spec/lib/forest_admin_agent/services/permissions_spec.rb: 133 examples, 0 failures.
• Rubocop on the touched files: no offenses.

Definition of Done

General

• Write an explicit title for the Pull Request, following Conventional Commits specification
• Test manually the implemented changes
• Validate the code quality (indentation, syntax, style, simplicity, readability)

Security

• Consider the security impact of the changes made

https://claude.ai/code/session_01TVjvko66LLq8rEjEqNokRA

[linear-code]

PRD-1764

[qltysh]

Coverage Impact

This PR will not change total coverage.

Modified Files with Diff Coverage (1)

Rating	File	% Diff	Uncovered Line #s
	...st_admin_agent/lib/forest_admin_agent/routes/action/actions.rb	100.0%
	Total	100.0%

🚦 See full report on Qlty Cloud »

🛟 Help

• Diff Coverage: Coverage for added or modified lines of code (excludes deleted files). Learn more.

• Total Coverage: Coverage for the whole repository, calculated as the sum of all File Coverage. Learn more.

• File Coverage: Covered Lines divided by Covered Lines plus Missed Lines. (Excludes non-executable lines including blank lines and comments.)

  • Indirect Changes: Changes to File Coverage for files that were not modified in this PR. Learn more.