fix oauth scope mismatch

pkg/auth/oauth/client.go

@@ -17,6 +17,38 @@ import (
 	"github.com/bluesky-social/indigo/atproto/syntax"
 )
 
+// permissionSetExpansions maps lexicon IDs to their expanded scope format.
+// These must match the collections defined in lexicons/io/atcr/authFullApp.json
+// Collections are sorted alphabetically for consistent comparison with PDS-expanded scopes.
+var permissionSetExpansions = map[string]string{
+	"io.atcr.authFullApp": "repo?" +
+		"collection=io.atcr.manifest&" +
+		"collection=io.atcr.repo.page&" +
+		"collection=io.atcr.sailor.profile&" +
+		"collection=io.atcr.sailor.star&" +
+		"collection=io.atcr.tag",
+}
+
+// ExpandIncludeScopes expands any "include:" prefixed scopes to their full form
+// by looking up the corresponding permission-set in the embedded lexicon files.
+// For example, "include:io.atcr.authFullApp" expands to "repo?collection=io.atcr.manifest&..."
+func ExpandIncludeScopes(scopes []string) []string {
+	var expanded []string
+	for _, scope := range scopes {
+		if strings.HasPrefix(scope, "include:") {
+			lexiconID := strings.TrimPrefix(scope, "include:")
+			if exp, ok := permissionSetExpansions[lexiconID]; ok {
+				expanded = append(expanded, exp)
+			} else {
+				expanded = append(expanded, scope) // Keep original if unknown
+			}
+		} else {
+			expanded = append(expanded, scope)
+		}
+	}
+	return expanded
+}
+
 // NewClientApp creates an indigo OAuth ClientApp with ATCR-specific configuration
 // Automatically configures confidential client for production deployments
 // keyPath specifies where to store/load the OAuth client P-256 key (ignored for localhost)
@@ -97,19 +129,24 @@ func GetDefaultScopes(did string) []string {
 }
 
 // ScopesMatch checks if two scope lists are equivalent (order-independent)
-// Returns true if both lists contain the same scopes, regardless of order
+// Returns true if both lists contain the same scopes, regardless of order.
+// Expands any "include:" prefixed scopes in the desired list before comparing,
+// since the PDS returns expanded scopes in the stored session.
 func ScopesMatch(stored, desired []string) bool {
+	// Expand any include: scopes in desired before comparing
+	expandedDesired := ExpandIncludeScopes(desired)
+
 	// Handle nil/empty cases
-	if len(stored) == 0 && len(desired) == 0 {
+	if len(stored) == 0 && len(expandedDesired) == 0 {
 		return true
 	}
-	if len(stored) != len(desired) {
+	if len(stored) != len(expandedDesired) {
 		return false
 	}
 
 	// Build map of desired scopes for O(1) lookup
-	desiredMap := make(map[string]bool, len(desired))
-	for _, scope := range desired {
+	desiredMap := make(map[string]bool, len(expandedDesired))
+	for _, scope := range expandedDesired {
 		desiredMap[scope] = true
 	}