From 4cda163099f3951125ba4902490e01561bf0c232 Mon Sep 17 00:00:00 2001 From: Evan Jarrett Date: Fri, 26 Dec 2025 17:05:51 -0600 Subject: [PATCH] add back individual scopes --- pkg/auth/oauth/client.go | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) diff --git a/pkg/auth/oauth/client.go b/pkg/auth/oauth/client.go index 17e3b92..4a36932 100644 --- a/pkg/auth/oauth/client.go +++ b/pkg/auth/oauth/client.go @@ -73,14 +73,21 @@ func RedirectURI(baseURL string) string { } // GetDefaultScopes returns the default OAuth scopes for ATCR registry operations. -// Uses io.atcr.permissions#registry permission-set to bundle repo and rpc scopes. +// Includes io.atcr.authFullApp permission-set plus individual scopes for PDS compatibility. // Blob scopes are listed explicitly (not supported in Lexicon permission-sets). func GetDefaultScopes(did string) []string { return []string{ "atproto", - // Permission-set bundles repo and rpc scopes + // Permission-set (for future PDS support) // See lexicons/io/atcr/authFullApp.json for definition "io.atcr.authFullApp", + // Individual repo/rpc scopes (for current PDS compatibility) + fmt.Sprintf("repo:%s", atproto.ManifestCollection), + fmt.Sprintf("repo:%s", atproto.TagCollection), + fmt.Sprintf("repo:%s", atproto.StarCollection), + fmt.Sprintf("repo:%s", atproto.SailorProfileCollection), + fmt.Sprintf("repo:%s", atproto.RepoPageCollection), + "rpc:com.atproto.repo.getRecord?aud=*", // Blob scopes (not supported in Lexicon permission-sets) // Image manifest types (single-arch) "blob:application/vnd.oci.image.manifest.v1+json",