alf: the atproto Latency Fabric
alf.fly.dev/
Restrict demo sign-in OAuth scope to atproto only
The demo token is used solely to authenticate the user to ALF — ALF handles
PDS writes with its own OAuth session. No resource permissions needed in the
demo's sign-in token.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
+4
-4
+3
-3
demo/client/index.ts
+3
-3
demo/client/index.ts
···
667
667
if (isLocalhost) {
668
668
const port = window.location.port;
669
669
const redirectUri = `http://127.0.0.1${port ? `:${port}` : ''}/`;
670
-
const clientId = `http://localhost?scope=${encodeURIComponent('atproto repo:*?action=create blob:*/*')}&redirect_uri=${encodeURIComponent(redirectUri)}`;
670
+
const clientId = `http://localhost?scope=${encodeURIComponent('atproto')}&redirect_uri=${encodeURIComponent(redirectUri)}`;
671
671
oauthClientMetadata = {
672
672
client_id: clientId,
673
673
client_name: 'ALF Demo',
674
674
redirect_uris: [redirectUri],
675
-
scope: 'atproto repo:*?action=create blob:*/*',
675
+
scope: 'atproto',
676
676
grant_types: ['authorization_code', 'refresh_token'],
677
677
response_types: ['code'],
678
678
token_endpoint_auth_method: 'none',
···
686
686
client_id: metadataUrl,
687
687
client_name: 'ALF Demo',
688
688
redirect_uris: [`${window.location.origin}/`],
689
-
scope: 'atproto repo:*?action=create blob:*/*',
689
+
scope: 'atproto',
690
690
grant_types: ['authorization_code', 'refresh_token'],
691
691
response_types: ['code'],
692
692
token_endpoint_auth_method: 'none',
+1
-1
demo/server.ts
+1
-1
demo/server.ts
···
22
22
client_name: 'ALF Demo',
23
23
client_uri: SERVICE_URL,
24
24
redirect_uris: [`${SERVICE_URL}/`],
25
-
scope: 'atproto repo:*?action=create blob:*/*',
25
+
scope: 'atproto',
26
26
grant_types: ['authorization_code', 'refresh_token'],
27
27
response_types: ['code'],
28
28
token_endpoint_auth_method: 'none',