Skip to content

Commit 990ef2b

Browse files
AshexAshex
committed
Drop hyperboards permission set from demo
1 parent c7b7771 commit 990ef2b

6 files changed

Lines changed: 21 additions & 16 deletions

File tree

‎.agents/skills/epds-login/SKILL.md‎

Lines changed: 6 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -62,7 +62,7 @@ are mutually exclusive:
6262
"client_id": "https://yourapp.example.com/client-metadata.json",
6363
"client_name": "Your App",
6464
"redirect_uris": ["https://yourapp.example.com/api/oauth/callback"],
65-
"scope": "atproto include:org.hypercerts.authWrite include:org.hyperboards.authWrite include:app.certified.authWrite",
65+
"scope": "atproto include:org.hypercerts.authWrite include:app.certified.authWrite",
6666
"grant_types": ["authorization_code", "refresh_token"],
6767
"response_types": ["code"],
6868
"token_endpoint_auth_method": "private_key_jwt",
@@ -74,9 +74,9 @@ are mutually exclusive:
7474

7575
> **On the `scope` value:** `atproto` is mandatory and must be listed first; the
7676
> remaining entries request only the permissions your app needs. The examples here
77-
> reference three hypercerts specific permission sets via the `include:` prefix —
78-
> `include:org.hypercerts.authWrite`, `include:org.hyperboards.authWrite`, and
79-
> `include:app.certified.authWrite`; substitute the permission sets your own app defines. A
77+
> reference two hypercerts specific permission sets via the `include:` prefix —
78+
> `include:org.hypercerts.authWrite` and `include:app.certified.authWrite`;
79+
> substitute the permission sets your own app defines. A
8080
> permission set that bundles `rpc:` service calls also needs an
8181
> `?aud=<service-did>` parameter (with `#` percent-encoded as `%23`); these are
8282
> write-only sets, so no `aud` is required. Avoid the legacy `transition:generic`
@@ -101,7 +101,8 @@ const client = new NodeOAuthClient({
101101
client_id: 'https://yourapp.example.com/client-metadata.json',
102102
client_name: 'Your App',
103103
redirect_uris: ['https://yourapp.example.com/api/oauth/callback'],
104-
scope: 'atproto include:org.hypercerts.authWrite include:org.hyperboards.authWrite include:app.certified.authWrite',
104+
scope:
105+
'atproto include:org.hypercerts.authWrite include:app.certified.authWrite',
105106
grant_types: ['authorization_code', 'refresh_token'],
106107
response_types: ['code'],
107108
token_endpoint_auth_method: 'private_key_jwt',

‎.agents/skills/epds-login/references/client-metadata.md‎

Lines changed: 4 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -53,7 +53,7 @@ mutually exclusive — the PDS rejects metadata that has both.
5353
"client_id": "https://yourapp.example.com/client-metadata.json",
5454
"client_name": "Your App Name",
5555
"redirect_uris": ["https://yourapp.example.com/api/oauth/callback"],
56-
"scope": "atproto include:org.hypercerts.authWrite include:org.hyperboards.authWrite include:app.certified.authWrite",
56+
"scope": "atproto include:org.hypercerts.authWrite include:app.certified.authWrite",
5757
"grant_types": ["authorization_code", "refresh_token"],
5858
"response_types": ["code"],
5959
"token_endpoint_auth_method": "private_key_jwt",
@@ -70,7 +70,7 @@ mutually exclusive — the PDS rejects metadata that has both.
7070
"client_id": "https://yourapp.example.com/client-metadata.json",
7171
"client_name": "Your App Name",
7272
"redirect_uris": ["https://yourapp.example.com/api/oauth/callback"],
73-
"scope": "atproto include:org.hypercerts.authWrite include:org.hyperboards.authWrite include:app.certified.authWrite",
73+
"scope": "atproto include:org.hypercerts.authWrite include:app.certified.authWrite",
7474
"grant_types": ["authorization_code", "refresh_token"],
7575
"response_types": ["code"],
7676
"token_endpoint_auth_method": "private_key_jwt",
@@ -96,15 +96,14 @@ host — useful for simpler setups. See
9696
[Publishing the JWKS document](#publishing-the-jwks-document) below for
9797
key generation and serving details.
9898

99-
10099
## All supported fields
101100

102101
| Field | Required | Description |
103102
| --------------------------------- | ----------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
104103
| `client_id` | Yes | Must match the URL where this file is hosted |
105104
| `client_name` | Yes | Shown on the login page and in OTP emails |
106105
| `redirect_uris` | Yes | Array of allowed callback URLs after login |
107-
| `scope` | Yes | Space-separated list. `atproto` is required and must come first; add the scopes/permission sets your app needs (the examples use `include:org.hypercerts.authWrite include:org.hyperboards.authWrite include:app.certified.authWrite`). Avoid the legacy `transition:generic` catch-all — see the `atproto-oauth` skill. |
106+
| `scope` | Yes | Space-separated list. `atproto` is required and must come first; add the scopes/permission sets your app needs (the examples use `include:org.hypercerts.authWrite include:app.certified.authWrite`). Avoid the legacy `transition:generic` catch-all — see the `atproto-oauth` skill. |
108107
| `grant_types` | Yes | Always `["authorization_code", "refresh_token"]` |
109108
| `response_types` | Yes | Always `["code"]` |
110109
| `token_endpoint_auth_method` | Yes | `"private_key_jwt"` (recommended) or `"none"` — see above |
@@ -267,7 +266,7 @@ above for the trade-offs.
267266
"client_id": "https://yourapp.example.com/client-metadata.json",
268267
"client_name": "Your App Name",
269268
"redirect_uris": ["https://yourapp.example.com/api/oauth/callback"],
270-
"scope": "atproto include:org.hypercerts.authWrite include:org.hyperboards.authWrite include:app.certified.authWrite",
269+
"scope": "atproto include:org.hypercerts.authWrite include:app.certified.authWrite",
271270
"grant_types": ["authorization_code", "refresh_token"],
272271
"response_types": ["code"],
273272
"token_endpoint_auth_method": "none",

‎.agents/skills/epds-login/references/flows.md‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -156,7 +156,8 @@ export async function handleLogin(email: string) {
156156
client_id: CLIENT_ID,
157157
redirect_uri: REDIRECT_URI,
158158
response_type: 'code',
159-
scope: 'atproto include:org.hypercerts.authWrite include:org.hyperboards.authWrite include:app.certified.authWrite',
159+
scope:
160+
'atproto include:org.hypercerts.authWrite include:app.certified.authWrite',
160161
state,
161162
code_challenge: codeChallenge,
162163
code_challenge_method: 'S256',

‎docs/tutorial.md‎

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -190,7 +190,7 @@ The file must be served with `Content-Type: application/json`:
190190
"client_uri": "https://yourapp.example.com",
191191
"logo_uri": "https://yourapp.example.com/logo.png",
192192
"redirect_uris": ["https://yourapp.example.com/api/oauth/callback"],
193-
"scope": "atproto transition:generic",
193+
"scope": "atproto include:org.hypercerts.authWrite include:app.certified.authWrite",
194194
"grant_types": ["authorization_code", "refresh_token"],
195195
"response_types": ["code"],
196196
"token_endpoint_auth_method": "private_key_jwt",
@@ -674,7 +674,8 @@ const client = new NodeOAuthClient({
674674
client_id: 'https://yourapp.example.com/client-metadata.json',
675675
client_name: 'Your App',
676676
redirect_uris: ['https://yourapp.example.com/api/oauth/callback'],
677-
scope: 'atproto transition:generic',
677+
scope:
678+
'atproto include:org.hypercerts.authWrite include:app.certified.authWrite',
678679
grant_types: ['authorization_code', 'refresh_token'],
679680
response_types: ['code'],
680681
token_endpoint_auth_method: 'private_key_jwt',
@@ -772,7 +773,8 @@ const parBody = new URLSearchParams({
772773
client_id: clientId,
773774
redirect_uri: redirectUri,
774775
response_type: 'code',
775-
scope: 'atproto transition:generic',
776+
scope:
777+
'atproto include:org.hypercerts.authWrite include:app.certified.authWrite',
776778
state,
777779
code_challenge: codeChallenge,
778780
code_challenge_method: 'S256',

‎packages/demo/src/app/api/oauth/login/route.ts‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -150,7 +150,8 @@ export async function GET(request: Request) {
150150
client_id: clientId,
151151
redirect_uri: redirectUri,
152152
response_type: 'code',
153-
scope: 'atproto include:org.hypercerts.authWrite include:org.hyperboards.authWrite include:app.certified.authWrite',
153+
scope:
154+
'atproto include:org.hypercerts.authWrite include:app.certified.authWrite',
154155
state,
155156
code_challenge: codeChallenge,
156157
code_challenge_method: 'S256',

‎packages/demo/src/app/client-metadata.json/route.ts‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -50,7 +50,8 @@ export async function GET() {
5050
client_uri: baseUrl,
5151
logo_uri: `${baseUrl}/certified-logo.png`,
5252
redirect_uris: [`${baseUrl}/api/oauth/callback`],
53-
scope: 'atproto include:org.hypercerts.authWrite include:org.hyperboards.authWrite include:app.certified.authWrite',
53+
scope:
54+
'atproto include:org.hypercerts.authWrite include:app.certified.authWrite',
5455
grant_types: ['authorization_code', 'refresh_token'],
5556
response_types: ['code'],
5657
...(isConfidential

0 commit comments

Comments
 (0)