From 4b370a0bb89df3862c6f806c538ce38d632f586e Mon Sep 17 00:00:00 2001
From: scanash00 <scan@scanash.com>
Date: Sun, 25 Jan 2026 02:39:45 +0000
Subject: [PATCH] granular oauth scopes

---
 backend/internal/oauth/handler.go | 54 ++++++++++++++++++++++++++++++++++++++++++------------
 1 file(s) changed, 42 insertion(s)(+), 12 deletion(s)(-)

diff --git a/backend/internal/oauth/handler.go b/backend/internal/oauth/handler.go
--- a/backend/internal/oauth/handler.go
+++ b/backend/internal/oauth/handler.go
@@ -140,7 +140,17 @@
 
 	pkceVerifier, pkceChallenge := client.GeneratePKCE()
 
-	scope := "atproto transition:generic"
+	scope := "atproto " +
+		"at.margin.annotation " +
+		"at.margin.highlight " +
+		"at.margin.bookmark " +
+		"at.margin.reply " +
+		"at.margin.like " +
+		"at.margin.collection " +
+		"at.margin.collectionItem " +
+		"rpc:app.bsky.actor.searchActorsTypeahead?aud=* " +
+		"rpc:app.bsky.actor.getProfiles?aud=* " +
+		"rpc:com.atproto.identity.resolveHandle?aud=*"
 
 	parResp, state, dpopNonce, err := client.SendPAR(meta, handle, scope, dpopKey, pkceChallenge)
 	if err != nil {
@@ -240,7 +250,17 @@
 	}
 
 	pkceVerifier, pkceChallenge := client.GeneratePKCE()
-	scope := "atproto transition:generic"
+	scope := "atproto " +
+		"at.margin.annotation " +
+		"at.margin.highlight " +
+		"at.margin.bookmark " +
+		"at.margin.reply " +
+		"at.margin.like " +
+		"at.margin.collection " +
+		"at.margin.collectionItem " +
+		"rpc:app.bsky.actor.searchActorsTypeahead?aud=* " +
+		"rpc:app.bsky.actor.getProfiles?aud=* " +
+		"rpc:com.atproto.identity.resolveHandle?aud=*"
 
 	parResp, state, dpopNonce, err := client.SendPAR(meta, req.Handle, scope, dpopKey, pkceChallenge)
 	if err != nil {
@@ -481,16 +501,26 @@
 
 	w.Header().Set("Content-Type", "application/json")
 	json.NewEncoder(w).Encode(map[string]interface{}{
-		"client_id":                       client.ClientID,
-		"client_name":                     "Margin",
-		"client_uri":                      baseURL,
-		"logo_uri":                        baseURL + "/logo.svg",
-		"tos_uri":                         baseURL + "/terms",
-		"policy_uri":                      baseURL + "/privacy",
-		"redirect_uris":                   []string{client.RedirectURI},
-		"grant_types":                     []string{"authorization_code", "refresh_token"},
-		"response_types":                  []string{"code"},
-		"scope":                           "atproto transition:generic",
+		"client_id":      client.ClientID,
+		"client_name":    "Margin",
+		"client_uri":     baseURL,
+		"logo_uri":       baseURL + "/logo.svg",
+		"tos_uri":        baseURL + "/terms",
+		"policy_uri":     baseURL + "/privacy",
+		"redirect_uris":  []string{client.RedirectURI},
+		"grant_types":    []string{"authorization_code", "refresh_token"},
+		"response_types": []string{"code"},
+		"scope": "atproto " +
+			"at.margin.annotation " +
+			"at.margin.highlight " +
+			"at.margin.bookmark " +
+			"at.margin.reply " +
+			"at.margin.like " +
+			"at.margin.collection " +
+			"at.margin.collectionItem " +
+			"rpc:app.bsky.actor.searchActorsTypeahead?aud=* " +
+			"rpc:app.bsky.actor.getProfiles?aud=* " +
+			"rpc:com.atproto.identity.resolveHandle?aud=*",
 		"token_endpoint_auth_method":      "private_key_jwt",
 		"token_endpoint_auth_signing_alg": "ES256",
 		"dpop_bound_access_tokens":        true,

--
tangled.sh