# Scope Validation Comparison: pds.js vs atproto PDS

Comparison of OAuth scope validation between this implementation and the official AT Protocol PDS.

---

## Scope Types Supported

| Scope Type | Format | pds.js | atproto PDS |
|------------|--------|--------|-------------|
| `atproto` | Static | Full access | Required for all OAuth |
| `transition:generic` | Static | Full access | Full repo/blob bypass |
| `transition:email` | Static | N/A | Read account email |
| `transition:chat.bsky` | Static | N/A | Chat RPC access |
| `repo:<collection>?action=<action>` | Granular | Full parsing + enforcement | Full parsing + enforcement |
| `blob:<mime>` | Granular | Full parsing + enforcement | Full parsing + enforcement |
| `rpc:<aud>:<lxm>` | Granular | Not implemented | Full parsing + enforcement |

---

## Scope Enforcement by Endpoint

### com.atproto.repo.createRecord

| Aspect | pds.js | atproto PDS |
|--------|--------|-------------|
| Scope check | `ScopePermissions.allowsRepo(collection, 'create')` | `permissions.assertRepo({ action: 'create', collection })` |
| Required scope | `repo:<collection>?action=create` or `transition:generic` or `atproto` | `repo:<collection>?action=create` or `transition:generic` or `atproto` |
| OAuth-only check | Yes (legacy tokens without scope bypass) | Yes (legacy Bearer bypasses) |
| Error response | 403 "Missing required scope \"repo:...?action=...\"" | 403 "Missing required scope \"repo:...?action=...\"" |

### com.atproto.repo.putRecord

| Aspect | pds.js | atproto PDS |
|--------|--------|-------------|
| Scope check | `allowsRepo(collection, 'create')` AND `allowsRepo(collection, 'update')` | `assertRepo({ action: 'create' })` AND `assertRepo({ action: 'update' })` |
| Required scope | `repo:<collection>?action=create&action=update` | `repo:<collection>?action=create&action=update` |
| Notes | Requires both since putRecord can create or update | Requires both since putRecord can create or update |

### com.atproto.repo.deleteRecord

| Aspect | pds.js | atproto PDS |
|--------|--------|-------------|
| Scope check | `ScopePermissions.allowsRepo(collection, 'delete')` | `permissions.assertRepo({ action: 'delete', collection })` |
| Required scope | `repo:<collection>?action=delete` | `repo:<collection>?action=delete` |

### com.atproto.repo.applyWrites

| Aspect | pds.js | atproto PDS |
|--------|--------|-------------|
| Scope check | Iterates all writes, checks each unique action/collection pair | Iterates all writes, asserts each unique action/collection pair |
| Required scope | All `repo:<collection>?action=<action>` for each write | All `repo:<collection>?action=<action>` for each write |
| Per-write validation | Yes | Yes |

### com.atproto.repo.uploadBlob

| Aspect | pds.js | atproto PDS |
|--------|--------|-------------|
| Scope check | `ScopePermissions.allowsBlob(contentType)` | `permissions.assertBlob({ mime: encoding })` |
| Required scope | `blob:<mime-type>` (e.g., `blob:image/*`) | `blob:<mime-type>` (e.g., `blob:image/*`) |
| MIME type awareness | Yes (validates against Content-Type) | Yes (validates against Content-Type) |

### app.bsky.actor.getPreferences

| Aspect | pds.js | atproto PDS |
|--------|--------|-------------|
| Scope check | Requires auth only | `permissions.assertRpc({ aud, lxm })` |
| Required scope | Any valid auth | `rpc:app.bsky.actor.getPreferences` |

### app.bsky.actor.putPreferences

| Aspect | pds.js | atproto PDS |
|--------|--------|-------------|
| Scope check | Requires auth only | `permissions.assertRpc({ aud, lxm })` |
| Required scope | Any valid auth | `rpc:app.bsky.actor.putPreferences` |

---

## Scope Parsing

| Feature | pds.js | atproto PDS |
|---------|--------|-------------|
| Scope string splitting | `scope.split(' ')` | `ScopesSet` class |
| Repo scope parsing | `parseRepoScope()` | `RepoPermission.fromString()` |
| Repo scope format | `repo:collection?action=create&action=update` | `repo:collection?action=create&action=update` |
| Blob scope parsing | `parseBlobScope()` | `BlobPermission.fromString()` |
| RPC scope parsing | None | `RpcPermission.fromString()` |
| Scope validation | Returns null for invalid | Validates syntax, ignores invalid |
| Action deduplication | Yes (via Set) | Yes |
| Default actions | All (create, update, delete) when no `?action=` | All (create, update, delete) when no `?action=` |

---

## Permission Checking

| Feature | pds.js | atproto PDS |
|---------|--------|-------------|
| Permission class | `ScopePermissions` | `ScopePermissions` / `ScopePermissionsTransition` |
| `allowsRepo(collection, action)` | Yes | Yes |
| `allowsBlob(mime)` | Yes (with MIME wildcard matching) | Yes (with MIME wildcard matching) |
| `allowsRpc(aud, lxm)` | N/A | Yes |
| Transition scope handling | `transition:generic` bypasses repo/blob checks | `transition:generic` bypasses repo/blob checks |
| Error messages | Specific missing scope in error | Specific missing scope in error |

---

## OAuth Flow

| Feature | pds.js | atproto PDS |
|---------|--------|-------------|
| `scopes_supported` in metadata | `['atproto']` | `['atproto']` (but accepts granular) |
| Scope validation at PAR | None | Validates syntax |
| Scope stored in token | Yes | Yes |
| Scope returned in token response | Yes | Yes |
| `atproto` scope required | Checked at endpoints | Required at token verification |

---

## Transition Scope Behavior

| Scope | pds.js | atproto PDS |
|-------|--------|-------------|
| `transition:generic` | Bypasses all repo/blob permission checks | Bypasses ALL repo/blob permission checks |
| `transition:chat.bsky` | Not implemented | Allows `chat.bsky.*` RPC methods |
| `transition:email` | Not implemented | Allows `account:email:read` |

---

## Summary

| Category | pds.js | atproto PDS |
|----------|--------|-------------|
| Scope parsing | Full parser for repo/blob | Full parser per scope type |
| Enforcement granularity | Per-collection, per-action | Per-collection, per-action |
| Transition scope support | `transition:generic` only | Full |
| MIME-aware blob scopes | Yes | Yes |
| RPC scopes | No | Yes |
| Error specificity | Names missing scope | Names missing scope |

---

## Remaining Gaps

1. **RPC scopes** — `rpc:<aud>:<lxm>` parsing and enforcement not implemented
2. **Additional transition scopes** — `transition:chat.bsky` and `transition:email` not implemented
3. **Scope validation at PAR** — Could validate scope syntax during authorization request