fix(oauth-provider): accept query-only granular scopes (#175)

`parseScope` only looked for `:` to find the resource prefix, so valid
canonical scopes using the `prefix?query` form (e.g. a multi-collection
`repo?collection=a&collection=b` produced by expanding a permission set)
were rejected as `Unknown scope resource`. Use the earlier of `:` and
`?` as the delimiter, matching `@atproto/oauth-scopes` syntax.

Author: ascorbic

.changeset/oauth-scope-query-form.md

@@ -0,0 +1,5 @@
+---
+"@getcirrus/oauth-provider": patch
+---
+
+Fix `parseScope` rejecting valid granular scopes that use the query-only form (e.g. `repo?collection=a&collection=b`) with `Unknown scope resource`. The parser previously only looked for `:` as the prefix delimiter, but per `@atproto/oauth-scopes` syntax a scope can use `prefix:positional`, `prefix?query`, or both. This affected permission sets whose `repo` permission listed multiple collections, since those expand to a single query-form token.

packages/oauth-provider/src/scopes.ts

@@ -124,7 +124,10 @@ export function parseScope(
 		}
 
 		const colon = scope.indexOf(":");
-		const resource = colon === -1 ? scope : scope.slice(0, colon);
+		const question = scope.indexOf("?");
+		const end =
+			colon === -1 ? question : question === -1 ? colon : Math.min(colon, question);
+		const resource = end === -1 ? scope : scope.slice(0, end);
 		const parser =
 			STRUCTURAL_PARSERS[
 				resource as (typeof GRANULAR_RESOURCES)[number]

packages/oauth-provider/test/scopes.test.ts

@@ -60,6 +60,21 @@ describe("parseScope", () => {
 		expect(() => parseScope("atproto madeup:thing")).toThrow(ScopeParseError);
 	});
 
+	it("accepts repo scopes in query-only form (no positional)", () => {
+		const set = parseScope("atproto repo?collection=app.bsky.feed.post");
+		expect(set.has("repo?collection=app.bsky.feed.post")).toBe(true);
+	});
+
+	it("accepts repo scopes with multiple collections", () => {
+		const scope =
+			"repo?collection=site.standard.document" +
+			"&collection=site.standard.graph.recommend" +
+			"&collection=site.standard.graph.subscription" +
+			"&collection=site.standard.publication";
+		const set = parseScope(`atproto ${scope}`);
+		expect(set.has(scope)).toBe(true);
+	});
+
 	it("rejects include: scopes by default (strict mode)", () => {
 		expect(() =>
 			parseScope("atproto include:com.example.basic?aud=did:web:foo%23svc"),