fix issue with mismatched scopes locally

pkg/appview/readme/fetcher.go

@@ -29,7 +29,7 @@ func NewFetcher() *Fetcher {
 	// Configure markdown renderer with GitHub-flavored markdown
 	md := goldmark.New(
 		goldmark.WithExtensions(
-			extension.GFM,        // GitHub Flavored Markdown
+			extension.GFM,         // GitHub Flavored Markdown
 			extension.Typographer, // Smart quotes, dashes, etc.
 		),
 		goldmark.WithParserOptions(

pkg/auth/oauth/client.go

@@ -20,8 +20,8 @@ type App struct {
 }
 
 // NewApp creates a new OAuth app for ATCR with default scopes
-func NewApp(baseURL string, store oauth.ClientAuthStore, holdDid string) (*App, error) {
-	return NewAppWithScopes(baseURL, store, GetDefaultScopes(holdDid))
+func NewApp(baseURL string, store oauth.ClientAuthStore, holdDid string, testMode bool) (*App, error) {
+	return NewAppWithScopes(baseURL, store, GetDefaultScopes(holdDid, testMode))
 }
 
 // NewAppWithScopes creates a new OAuth app for ATCR with custom scopes
@@ -120,10 +120,10 @@ func RedirectURI(baseURL string) string {
 }
 
 // GetDefaultScopes returns the default OAuth scopes for ATCR registry operations
-func GetDefaultScopes(did string) []string {
-	return []string{
+// testMode determines whether to use transition:generic (test) or rpc scopes (production)
+func GetDefaultScopes(did string, testMode bool) []string {
+	scopes := []string{
 		"atproto",
-		"transition:generic",
 		// Image manifest types (single-arch)
 		"blob:application/vnd.oci.image.manifest.v1+json",
 		"blob:application/vnd.docker.distribution.manifest.v2+json",
@@ -132,12 +132,25 @@ func GetDefaultScopes(did string) []string {
 		"blob:application/vnd.docker.distribution.manifest.list.v2+json",
 		// OCI artifact manifests (for cosign signatures, SBOMs, attestations)
 		"blob:application/vnd.cncf.oras.artifact.manifest.v1+json",
-		fmt.Sprintf("rpc:com.atproto.repo.getRecord?aud=%s#atcr_hold", did),
+	}
+
+	// In test mode: use transition:generic (local dev with test PDS)
+	// In production: use rpc scope for service auth
+	if testMode {
+		scopes = append(scopes, "transition:generic")
+	} else {
+		scopes = append(scopes, fmt.Sprintf("rpc:com.atproto.repo.getRecord?aud=%s#atcr_hold", did))
+	}
+
+	// Add repo scopes
+	scopes = append(scopes,
 		fmt.Sprintf("repo:%s", atproto.ManifestCollection),
 		fmt.Sprintf("repo:%s", atproto.TagCollection),
 		fmt.Sprintf("repo:%s", atproto.StarCollection),
 		fmt.Sprintf("repo:%s", atproto.SailorProfileCollection),
-	}
+	)
+
+	return scopes
 }
 
 // ScopesMatch checks if two scope lists are equivalent (order-independent)

pkg/auth/oauth/interactive.go

@@ -33,11 +33,13 @@ func InteractiveFlowWithCallback(
 	}
 
 	// Create OAuth app with custom scopes (or defaults if nil)
+	// Interactive flows are typically for production use (credential helper, etc.)
+	// so we default to testMode=false
 	var app *App
 	if scopes != nil {
 		app, err = NewAppWithScopes(baseURL, store, scopes)
 	} else {
-		app, err = NewApp(baseURL, store, "*")
+		app, err = NewApp(baseURL, store, "*", false)
 	}
 	if err != nil {
 		return nil, fmt.Errorf("failed to create OAuth app: %w", err)