From e0b3f4a6eb183bfbc6b740b4d0489150a4823870 Mon Sep 17 00:00:00 2001
From: Lewis <did:plc:3fwecdnvtcscjnrx2p4n7alz>
Date: Thu, 22 Jan 2026 09:22:10 +0000
Subject: [PATCH] oauth: add granular scope request for atproto records & everything tangled-related

---
 appview/oauth/oauth.go | 4 ++--
 appview/oauth/scopes.go | 41 +++++++++++++++++++++++++++++++++++++++++
 2 file(s) changed, 43 insertion(s)(+), 2 deletion(s)(-)

diff --git a/appview/oauth/oauth.go b/appview/oauth/oauth.go
--- a/appview/oauth/oauth.go
+++ b/appview/oauth/oauth.go
@@ -41,12 +41,12 @@
 	if config.Core.Dev {
 		clientUri = "http://127.0.0.1:3000"
 		callbackUri := clientUri + "/oauth/callback"
-		oauthConfig = oauth.NewLocalhostConfig(callbackUri, []string{"atproto", "transition:generic"})
+		oauthConfig = oauth.NewLocalhostConfig(callbackUri, TangledScopes)
 	} else {
 		clientUri = config.Core.AppviewHost
 		clientId := fmt.Sprintf("%s/oauth/client-metadata.json", clientUri)
 		callbackUri := clientUri + "/oauth/callback"
-		oauthConfig = oauth.NewPublicConfig(clientId, callbackUri, []string{"atproto", "transition:generic"})
+		oauthConfig = oauth.NewPublicConfig(clientId, callbackUri, TangledScopes)
 	}
 
 	// configure client secret
diff --git a/appview/oauth/scopes.go b/appview/oauth/scopes.go
new file mode 100644
--- /dev/null
+++ b/appview/oauth/scopes.go
@@ -0,0 +1,41 @@
+package oauth
+
+var TangledScopes = []string{
+	"atproto",
+
+	"repo:sh.tangled.publicKey",
+	"repo:sh.tangled.repo",
+	"repo:sh.tangled.repo.pull",
+	"repo:sh.tangled.repo.pull.comment",
+	"repo:sh.tangled.repo.artifact",
+	"repo:sh.tangled.repo.issue",
+	"repo:sh.tangled.repo.issue.comment",
+	"repo:sh.tangled.repo.collaborator",
+	"repo:sh.tangled.knot",
+	"repo:sh.tangled.knot.member",
+	"repo:sh.tangled.spindle",
+	"repo:sh.tangled.spindle.member",
+	"repo:sh.tangled.graph.follow",
+	"repo:sh.tangled.feed.star",
+	"repo:sh.tangled.feed.reaction",
+	"repo:sh.tangled.label.definition",
+	"repo:sh.tangled.label.op",
+	"repo:sh.tangled.string",
+	"repo:sh.tangled.actor.profile",
+
+	"blob:*/*",
+
+	"rpc:sh.tangled.repo.create?aud=*",
+	"rpc:sh.tangled.repo.delete?aud=*",
+	"rpc:sh.tangled.repo.merge?aud=*",
+	"rpc:sh.tangled.repo.hiddenRef?aud=*",
+	"rpc:sh.tangled.repo.deleteBranch?aud=*",
+	"rpc:sh.tangled.repo.setDefaultBranch?aud=*",
+	"rpc:sh.tangled.repo.forkSync?aud=*",
+	"rpc:sh.tangled.repo.forkStatus?aud=*",
+	"rpc:sh.tangled.repo.mergeCheck?aud=*",
+	"rpc:sh.tangled.pipeline.cancelPipeline?aud=*",
+	"rpc:sh.tangled.repo.addSecret?aud=*",
+	"rpc:sh.tangled.repo.removeSecret?aud=*",
+	"rpc:sh.tangled.repo.listSecrets?aud=*",
+}

--
tangled.sh