feat(desktop): re-land explicit OAuth scopes now ceilings are seeded - #76812
Merged
Conversation
|
😎 Merged successfully - details. |
2 tasks
Contributor
Prompt To Fix All With AI### Issue 1
products/desktop/packages/shared/src/oauth.ts:230
**Development OAuth rejects privileged scope**
When signing in against the documented local development OAuth application with an empty scope ceiling, the shared scope list requests privileged `llm_gateway:read`, causing `/oauth/authorize` to return `invalid_scope` and preventing developer sign-in. The development application's ceiling needs to be seeded for this scope as part of this change, or the development flow needs a compatible scope list.
---
For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.Reviews (1): Last reviewed commit: "feat(oauth): re-land explicit scopes now..." | Re-trigger Greptile |
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
dmarticus
approved these changes
Aug 3, 2026
dmarticus
left a comment
dmarticus
left a comment
Contributor
There was a problem hiding this comment.
greptile comment seems legit so just get that before you merge.
Request the live scopes_supported set plus llm_gateway:read instead of "*", and bump OAUTH_SCOPE_VERSION 5 → 6 so installs re-authorize. The Jul 22 revert (#3668) was required because #3411 shipped the explicit list before US/EU OAuth app ceilings were seeded. Both Code apps are now seeded to [@default, llm_gateway:read] and *→ceiling narrowing is live, so the client change is unblocked. Regenerated from us.posthog.com scopes_supported (203 scopes, includes loop:* and post-#3411 additions); drop agents:* which left the advertised set. Comment documents the seed-before-release guardrail so it doesn't get bundled again without the ceiling.
charlesvien
force-pushed
the
matt/oauth-reland-explicit-scopes
branch
from
August 4, 2026 03:13
5d9625e to
3e1ef67
Compare
batch_import_support, query_performance, and wizard_session are OAUTH_SCOPES_HIDDEN server-side: subtracted out of UNPRIVILEGED_SCOPES, so the app's "@default" ceiling can never cover them. /authorize treats an explicit scope list as all-or-nothing, so requesting them would fail every sign-in with invalid_scope. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01CAPcQaAZNzcWNhCh1nyBPi
Contributor
|
React Doctor found 50 issues in 13 files · 8 errors & 42 warnings. Errors
42 warnings
Reviewed by React Doctor for commit |
Contributor
|
/trunk merge |
Asheesh7298
pushed a commit
to Asheesh7298/posthog
that referenced
this pull request
Aug 5, 2026
…ostHog#76812) Co-authored-by: Matt Brooker <matt@posthog.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
Ports PostHog/code#3974. PostHog Code still requests
scope=*at sign-in, which blocks retiring the wildcard server-side and keeps the desktop token full-privilege.PostHog/code#3411 shipped an explicit scope list and bumped
OAUTH_SCOPE_VERSION, but the US/EU Code OAuth app ceilings were not seeded yet, so fresh sign-ins hitinvalid_scopeand PostHog/code#3668 reverted to*. Seeding and the*-to-ceiling narrowing (#70538) are now live in both regions, so the client change is unblocked.Changes
All under
products/desktop/packages/shared/:OAUTH_SCOPES: 206 scopes — the 205 advertised inscopes_supportedonus.posthog.comandeu.posthog.com(both regions publish identical sets), plus privilegedllm_gateway:readlast.OAUTH_SCOPE_VERSION6 to 7 so existing installs re-authorize onto the narrower set.*client, and never copyOAUTH_SCOPES_HIDDENout of the generated MCP scope file.llm_gateway:readlast, well-formed strings) plus a fingerprint guard.Why the hidden scopes are excluded
services/mcp/src/lib/oauth-scopes.generated.tsexports two lists:OAUTH_SCOPES_SUPPORTEDandOAUTH_SCOPES_HIDDEN(batch_import_support,query_performance,wizard_session). Only the first belongs here. The hidden ones are staff-only,is_staff-gated, and subtracted out ofUNPRIVILEGED_SCOPESinposthog/scopes.py, so a["@default", "llm_gateway:read"]ceiling can never cover them.OAuthValidator.validate_scopestreats an explicit scope list as all-or-nothing, so including even one would fail every sign-in withinvalid_scope.Verified by running the branch's scope list against
posthog/scopes.pyon master:["@default", "llm_gateway:read"]Preconditions (already done): #70538 deployed in US and EU, Code app ceilings seeded to
["@default", "llm_gateway:read"]in both regions, real*sign-in verified to narrow correctly in US.Follow-up worth tracking separately
Pinning an explicit list trades one failure mode for another. A
*request is rewritten to the app's ceiling byvalidate_scopes, so it can never go stale. An explicit list cannot: if a scope is ever renamed or retired server-side, every already-installed build that still pins it fails/authorizewithinvalid_scopeuntil users update. That is not a regression in this PR, but it does mean scope removals become a breaking change for shipped desktop builds, and there is currently no tolerance path at/authorize.How did you test this code?
pnpm --filter @posthog/shared testfromproducts/desktop/: 782 passed, including the oauth fingerprint and structural guards.pnpm --filter @posthog/shared typecheckclean.posthog/scopes.pyon master; itsget_oauth_scopes_supported()reproduces exactly the 205 scopes live on both regions.Automatic notifications
Docs update
N/A
🤖 Agent context
Autonomy: Human-driven (agent-assisted)
Claude ported this from PostHog/code#3974 at @charlesvien's direction using /porting-code-prs, applying the source patch with
git am --directory=products/desktop/so the commit keeps @MattBro's authorship. A follow-up commit removed the six hidden scopes after checking the list against the server's ceiling resolution.