From 290145d332adf1fbe15a9990bbd6afa780ceb020 Mon Sep 17 00:00:00 2001
From: eti <eti@eti.tf>
Date: Wed, 23 Sep 2026 17:39:04 +0200
Subject: [PATCH] web/oauth: request explicit scopes instead of unpublished
 permission sets

Signed-off-by: eti <eti@eti.tf>
---
 web/src/lib/oauth-client-metadata.ts | 82 +++++++++++++++++++++++++++-
 1 file changed, 79 insertions(+), 3 deletions(-)

diff --git a/web/src/lib/oauth-client-metadata.ts b/web/src/lib/oauth-client-metadata.ts
index fd29b0494..badc3a034 100644
--- a/web/src/lib/oauth-client-metadata.ts
+++ b/web/src/lib/oauth-client-metadata.ts
@@ -1,19 +1,95 @@
 const scopes = [
 	"atproto",
 	"blob:*/*",
-	"include:org.tangled.authFull",
-	"include:sh.tangled.authFull",
+	"repo:org.tangled.feed.subscription",
+	"repo:sh.tangled.actor.profile",
+	"repo:sh.tangled.feed.comment",
+	"repo:sh.tangled.feed.reaction",
+	"repo:sh.tangled.feed.star",
+	"repo:sh.tangled.graph.follow",
+	"repo:sh.tangled.graph.vouch",
+	"repo:sh.tangled.knot",
+	"repo:sh.tangled.knot.member",
+	"repo:sh.tangled.label.definition",
+	"repo:sh.tangled.label.op",
+	"repo:sh.tangled.org.memberAcceptance",
+	"repo:sh.tangled.publicKey",
+	"repo:sh.tangled.repo",
+	"repo:sh.tangled.repo.artifact",
+	"repo:sh.tangled.repo.collaborator",
+	"repo:sh.tangled.repo.collaboratorAcceptance",
+	"repo:sh.tangled.repo.issue",
+	"repo:sh.tangled.repo.issue.comment",
+	"repo:sh.tangled.repo.issue.state",
+	"repo:sh.tangled.repo.pull",
+	"repo:sh.tangled.repo.pull.comment",
+	"repo:sh.tangled.repo.pull.status",
+	"repo:sh.tangled.spindle",
+	"repo:sh.tangled.spindle.member",
+	"repo:sh.tangled.string",
 	"rpc:com.atproto.moderation.createReport?aud=*",
 	"rpc:com.atproto.repo.createRecord?aud=*",
 	"rpc:com.atproto.repo.deleteRecord?aud=*",
 	"rpc:com.atproto.repo.putRecord?aud=*",
 	"rpc:com.atproto.repo.uploadBlob?aud=*",
 	"rpc:com.atproto.server.describeServer?aud=*",
+	"rpc:org.tangled.temp.account.addEmail?aud=*",
+	"rpc:org.tangled.temp.account.deleteEmail?aud=*",
+	"rpc:org.tangled.temp.account.listEmails?aud=*",
+	"rpc:org.tangled.temp.account.setPrimaryEmail?aud=*",
+	"rpc:org.tangled.temp.account.verifyEmail?aud=*",
+	"rpc:org.tangled.temp.server.redeemInviteCode?aud=*",
 	"rpc:com.bad-example.pocket.getPreferences?aud=*",
 	"rpc:com.bad-example.pocket.putPreferences?aud=*",
+	"rpc:org.tangled.temp.notification.getPreferences?aud=*",
+	"rpc:org.tangled.temp.notification.getUnreadCount?aud=*",
+	"rpc:org.tangled.temp.notification.listNotifications?aud=*",
+	"rpc:org.tangled.temp.notification.markAllRead?aud=*",
+	"rpc:org.tangled.temp.notification.markEntityRead?aud=*",
+	"rpc:org.tangled.temp.notification.updatePreferences?aud=*",
+	"rpc:org.tangled.temp.notification.updateSeen?aud=*",
+	"rpc:org.tangled.temp.search.searchCode?aud=*",
+	"rpc:org.tangled.temp.webhook.createWebhook?aud=*",
+	"rpc:org.tangled.temp.webhook.deleteWebhook?aud=*",
+	"rpc:org.tangled.temp.webhook.getDeliveriesForWebhooks?aud=*",
+	"rpc:org.tangled.temp.webhook.listWebhooks?aud=*",
+	"rpc:org.tangled.temp.webhook.retryDelivery?aud=*",
+	"rpc:org.tangled.temp.webhook.toggleWebhook?aud=*",
+	"rpc:org.tangled.temp.webhook.updateWebhook?aud=*",
+	"rpc:org.tangled.temp.site.claimDomain?aud=*",
+	"rpc:org.tangled.temp.site.getDomainClaim?aud=*",
+	"rpc:org.tangled.temp.site.releaseDomain?aud=*",
+	"rpc:sh.tangled.actor.getTrending?aud=*",
+	"rpc:sh.tangled.ci.cancelPipeline?aud=*",
+	"rpc:sh.tangled.ci.triggerPipeline?aud=*",
 	"rpc:farm.tranquil.delegation.authorize?aud=*",
 	"rpc:farm.tranquil.delegation.createAccount?aud=*",
-	"rpc:farm.tranquil.delegation.listControlledAccounts?aud=*"
+	"rpc:farm.tranquil.delegation.listControlledAccounts?aud=*",
+	"rpc:sh.tangled.feed.getTimeline?aud=*",
+	"rpc:sh.tangled.git.keepCommit?aud=*",
+	"rpc:sh.tangled.git.mergeCommit?aud=*",
+	"rpc:sh.tangled.graph.listNetworkVouches?aud=*",
+	"rpc:sh.tangled.knot.addMember?aud=*",
+	"rpc:sh.tangled.knot.removeMember?aud=*",
+	"rpc:sh.tangled.org.acceptMembership?aud=*",
+	"rpc:sh.tangled.repo.acceptCollaboration?aud=*",
+	"rpc:sh.tangled.repo.addCollaborator?aud=*",
+	"rpc:sh.tangled.repo.addSecret?aud=*",
+	"rpc:sh.tangled.repo.create?aud=*",
+	"rpc:sh.tangled.repo.delete?aud=*",
+	"rpc:sh.tangled.repo.deleteBranch?aud=*",
+	"rpc:sh.tangled.repo.forkStatus?aud=*",
+	"rpc:sh.tangled.repo.forkSync?aud=*",
+	"rpc:sh.tangled.repo.hiddenRef?aud=*",
+	"rpc:sh.tangled.repo.listSecrets?aud=*",
+	"rpc:sh.tangled.repo.listCobVersions?aud=*",
+	"rpc:sh.tangled.repo.merge?aud=*",
+	"rpc:sh.tangled.repo.mergeCheck?aud=*",
+	"rpc:sh.tangled.repo.push?aud=*",
+	"rpc:sh.tangled.repo.removeCollaborator?aud=*",
+	"rpc:sh.tangled.repo.removeSecret?aud=*",
+	"rpc:sh.tangled.repo.setContributionPolicy?aud=*",
+	"rpc:sh.tangled.repo.setDefaultBranch?aud=*"
 ];
 
 export default {
-- 
2.51.2