more oauth fixes for hold service

cmd/hold/main.go

@@ -1072,15 +1072,11 @@ func (s *HoldService) registerWithOAuth(publicURL, handle, did, pdsEndpoint stri
 	// Run interactive OAuth flow with persistent server
 	ctx := context.Background()
 
-	// Note: holdScopes are ignored for now as indigo uses default scopes
-	// TODO: Enhance indigo App to support custom scopes if needed
-	_ = holdScopes
-
 	result, err := oauth.InteractiveFlowWithCallback(
 		ctx,
 		baseURL,
 		handle,
-		nil, // scopes (not used - indigo uses defaults)
+		holdScopes, // Pass hold-specific scopes
 		func(handler http.HandlerFunc) error {
 			// Register callback on existing server (persistent server pattern)
 			http.HandleFunc("/auth/oauth/callback", handler)

pkg/auth/oauth/client.go

@@ -19,9 +19,14 @@ type App struct {
 	directory identity.Directory
 }
 
-// NewApp creates a new OAuth app for ATCR
+// NewApp creates a new OAuth app for ATCR with default scopes
 func NewApp(baseURL string, store oauth.ClientAuthStore) (*App, error) {
-	config := NewClientConfig(baseURL)
+	return NewAppWithScopes(baseURL, store, GetDefaultScopes())
+}
+
+// NewAppWithScopes creates a new OAuth app for ATCR with custom scopes
+func NewAppWithScopes(baseURL string, store oauth.ClientAuthStore, scopes []string) (*App, error) {
+	config := NewClientConfigWithScopes(baseURL, scopes)
 	clientApp := oauth.NewClientApp(&config, store)
 
 	return &App{
@@ -33,9 +38,13 @@ func NewApp(baseURL string, store oauth.ClientAuthStore) (*App, error) {
 
 // NewClientConfig creates an OAuth client configuration for ATCR
 func NewClientConfig(baseURL string) oauth.ClientConfig {
-	clientID := ClientID(baseURL)
+	return NewClientConfigWithScopes(baseURL, GetDefaultScopes())
+}
+
+// NewClientConfigWithScopes creates an OAuth client configuration with custom scopes
+func NewClientConfigWithScopes(baseURL string, scopes []string) oauth.ClientConfig {
+	clientID := ClientIDWithScopes(baseURL, scopes)
 	redirectURI := RedirectURI(baseURL)
-	scopes := GetDefaultScopes()
 
 	// Check if this is localhost (public client) or production (confidential client)
 	if strings.Contains(baseURL, "127.0.0.1") || strings.Contains(baseURL, "localhost") {

pkg/auth/oauth/interactive.go

@@ -32,8 +32,13 @@ func InteractiveFlowWithCallback(
 		return nil, fmt.Errorf("failed to create OAuth store: %w", err)
 	}
 
-	// Create OAuth app
-	app, err := NewApp(baseURL, store)
+	// Create OAuth app with custom scopes (or defaults if nil)
+	var app *App
+	if scopes != nil {
+		app, err = NewAppWithScopes(baseURL, store, scopes)
+	} else {
+		app, err = NewApp(baseURL, store)
+	}
 	if err != nil {
 		return nil, fmt.Errorf("failed to create OAuth app: %w", err)
 	}