// What this app asks a PDS for.
//
// Its own module because two things read it: the page, which requests one of
// the two at sign-in, and the deploy, which lists both in the client metadata
// the authorization server fetches.

/** Read a space's records, at any authority, without being able to change one. */
export const READ_SCOPE = 'space:*?authority=*&skey=*&action=read';

/**
 * Everything the read scope covers, plus writing records and managing spaces.
 *
 * `collection=*` is required for the write actions. A space scope naming no
 * collection grants writes only in the collections the space type declares, and
 * a browser that works against any space type knows no such declaration.
 */
export const WRITE_SCOPE =
  'space:*?authority=*&skey=*&collection=*&action=read&action=create&action=update&action=delete&manage=create&manage=update&manage=delete';

/** `atproto` names the account; every authorization request carries it. */
export const SCOPES = {
  read: `atproto ${READ_SCOPE}`,
  write: `atproto ${WRITE_SCOPE}`,
};