From ab6eade6045eb30d3768167b069dc2d4892e6abf Mon Sep 17 00:00:00 2001
From: Trezy <tre@trezy.com>
Date: Mon, 06 Jul 2026 15:53:02 +0000
Subject: [PATCH] docs: reduce login scopes

Signed-off-by: Trezy <tre@trezy.com>
---
 packages/docs/src/app/oauth-client-metadata.json/route.ts | 15 ++++++++-------
 packages/docs/src/lib/atproto-oauth.ts | 12 +++++++-----
 2 file(s) changed, 15 insertion(s)(+), 12 deletion(s)(-)

diff --git a/packages/docs/src/app/oauth-client-metadata.json/route.ts b/packages/docs/src/app/oauth-client-metadata.json/route.ts
--- a/packages/docs/src/app/oauth-client-metadata.json/route.ts
+++ b/packages/docs/src/app/oauth-client-metadata.json/route.ts
@@ -1,18 +1,19 @@
-import { NextRequest } from 'next/server';
+import { NextRequest } from "next/server";
 
 export function GET(request: NextRequest) {
   const origin = new URL(request.url).origin;
 
   return Response.json({
     client_id: `${origin}/oauth-client-metadata.json`,
-    client_name: 'HappyView',
+    client_name: "HappyView",
     client_uri: origin,
     redirect_uris: [`${origin}/oauth/callback`],
-    grant_types: ['authorization_code'],
-    response_types: ['code'],
-    scope: 'atproto transition:generic',
-    token_endpoint_auth_method: 'none',
-    application_type: 'web',
+    grant_types: ["authorization_code"],
+    response_types: ["code"],
+    scope:
+      "atproto repo:site.standard.graph.recommend repo:site.standard.graph.subscription",
+    token_endpoint_auth_method: "none",
+    application_type: "web",
     dpop_bound_access_tokens: true,
   });
 }
diff --git a/packages/docs/src/lib/atproto-oauth.ts b/packages/docs/src/lib/atproto-oauth.ts
--- a/packages/docs/src/lib/atproto-oauth.ts
+++ b/packages/docs/src/lib/atproto-oauth.ts
@@ -1,25 +1,27 @@
-import { BrowserOAuthClient } from '@atproto/oauth-client-browser';
+import { BrowserOAuthClient } from "@atproto/oauth-client-browser";
 
 let clientPromise: Promise<BrowserOAuthClient> | null = null;
 
 export function getOAuthClient(): Promise<BrowserOAuthClient> {
   if (!clientPromise) {
     const origin = window.location.origin;
-    const isLoopback = origin.startsWith('http://localhost') || origin.startsWith('http://127.0.0.1');
+    const isLoopback =
+      origin.startsWith("http://localhost") ||
+      origin.startsWith("http://127.0.0.1");
 
     if (isLoopback) {
       const port = window.location.port;
       const redirectUri = `http://127.0.0.1:${port}/oauth/callback`;
-      const clientId = `http://localhost?redirect_uri=${encodeURIComponent(redirectUri)}&scope=${encodeURIComponent('atproto transition:generic')}`;
+      const clientId = `http://localhost?redirect_uri=${encodeURIComponent(redirectUri)}&scope=${encodeURIComponent("atproto repo:site.standard.graph.recommend repo:site.standard.graph.subscription")}`;
 
       clientPromise = BrowserOAuthClient.load({
         clientId,
-        handleResolver: 'https://bsky.social',
+        handleResolver: "https://bsky.social",
       });
     } else {
       clientPromise = BrowserOAuthClient.load({
         clientId: `${origin}/oauth-client-metadata.json`,
-        handleResolver: 'https://bsky.social',
+        handleResolver: "https://bsky.social",
       });
     }
   }

--
tangled.sh