BYOK Personal Data Server (PDS) written in Go
ipfs
vow
atproto
pds
go
feat(oauth): support all ATProto dynamic scope prefixes
+27
-3
+27
-3
oauth/client/manager.go
+27
-3
oauth/client/manager.go
···
18
18
"pkg.rbrt.fr/vow/internal/helpers"
19
19
)
20
20
21
-
// supportedScopes lists accepted OAuth scopes.
22
-
var supportedScopes = []string{"atproto", "transition:generic", "transition:chat.bsky"}
21
+
// supportedScopes lists static OAuth scopes.
22
+
var supportedScopes = []string{"atproto"}
23
+
24
+
// supportedScopePrefixes lists prefixes for dynamic ATProto scopes.
25
+
var supportedScopePrefixes = []string{
26
+
"blob:", // Blob upload permissions (e.g., "blob:*/*", "blob:image/*")
27
+
"account:", // Account access (e.g., "account:email", "account:status")
28
+
"identity:", // Identity operations (e.g., "identity:*")
29
+
"repo:", // Repository operations (e.g., "repo:*")
30
+
"rpc:", // RPC calls (e.g., "rpc:*?aud=did:web:api.bsky.app#bsky_appview")
31
+
"include:", // Included permissions
32
+
"transition:", // Transitional scopes (e.g., "transition:generic", "transition:chat.bsky")
33
+
}
34
+
35
+
// isScopeSupported checks if a scope is in the supported list or matches a dynamic prefix.
36
+
func isScopeSupported(scope string) bool {
37
+
if slices.Contains(supportedScopes, scope) {
38
+
return true
39
+
}
40
+
for _, prefix := range supportedScopePrefixes {
41
+
if strings.HasPrefix(scope, prefix) {
42
+
return true
43
+
}
44
+
}
45
+
return false
46
+
}
23
47
24
48
type Manager struct {
25
49
cli *http.Client
···
284
308
return nil, fmt.Errorf("duplicate scope `%s`", scope)
285
309
}
286
310
287
-
if !slices.Contains(supportedScopes, scope) {
311
+
if !isScopeSupported(scope) {
288
312
return nil, fmt.Errorf("unsupported scope %q", scope)
289
313
}
290
314