From c1b1f25f102c2b188846bc4b7f2cf4c6fd504292 Mon Sep 17 00:00:00 2001
From: Thomas Rademaker <thomas@radmakr.com>
Date: Mon, 23 Mar 2026 12:10:40 -0400
Subject: [PATCH] fix login

---
 Sources/CoreATProtocol/OAuth/ATProtoOAuth.swift | 13 +++++++++----
 1 file changed, 9 insertions(+), 4 deletions(-)

diff --git a/Sources/CoreATProtocol/OAuth/ATProtoOAuth.swift b/Sources/CoreATProtocol/OAuth/ATProtoOAuth.swift
index 0215474..cecc86f 100644
--- a/Sources/CoreATProtocol/OAuth/ATProtoOAuth.swift
+++ b/Sources/CoreATProtocol/OAuth/ATProtoOAuth.swift
@@ -247,9 +247,12 @@ public final class ATProtoOAuth: Sendable {
             expectedAuthorizationServer: identity.authorizationServer
         )
 
+        var appCredentials = clientConfig.credentials
+        appCredentials.scopes = config.scopes
+
         let makeAuthenticatorConfiguration = {
             Authenticator.Configuration(
-                appCredentials: clientConfig.credentials,
+                appCredentials: appCredentials,
                 loginStorage: loginStorage,
                 tokenHandling: tokenHandling,
                 mode: .manualOnly,
@@ -364,6 +367,8 @@ public final class ATProtoOAuth: Sendable {
         let serverHost = stripScheme(from: issuer)
         let serverConfig = try await ServerMetadata.load(for: serverHost, provider: provider)
         let clientConfig = try await ClientMetadata.load(for: config.clientMetadataURL, provider: provider)
+        var appCredentials = clientConfig.credentials
+        appCredentials.scopes = config.scopes
         let jwtGenerator: DPoPSigner.JWTGenerator = { [self] params in
             try await self.generateJWT(params: params)
         }
@@ -434,18 +439,18 @@ public final class ATProtoOAuth: Sendable {
 
         if config.authProxyBaseURL != nil {
             do {
-                refreshedLogin = try await refreshProvider(login, clientConfig.credentials, proxyResponseProvider)
+                refreshedLogin = try await refreshProvider(login, appCredentials, proxyResponseProvider)
                 usedAuthProxy = true
             } catch {
                 guard shouldRetryWithoutAuthProxy(after: error) else {
                     throw error
                 }
 
-                refreshedLogin = try await refreshProvider(login, clientConfig.credentials, directResponseProvider)
+                refreshedLogin = try await refreshProvider(login, appCredentials, directResponseProvider)
                 usedAuthProxy = false
             }
         } else {
-            refreshedLogin = try await refreshProvider(login, clientConfig.credentials, directResponseProvider)
+            refreshedLogin = try await refreshProvider(login, appCredentials, directResponseProvider)
             usedAuthProxy = false
         }
 
-- 
2.51.2