feat(oauth): request explicit scopes instead of * on sign-in

[MattBro]

Problem

The desktop app requests the * wildcard scope at sign-in, so its OAuth token can do anything the user can. That's the single biggest source of *-scoped tokens in production, and it's what blocks retiring the * wildcard server-side — the app keeps minting wildcard tokens.

Changes

• OAUTH_SCOPES now mirrors the explicit set PostHog advertises as grantable — the API's OAUTH_SCOPES_SUPPORTED, served as scopes_supported at /.well-known/oauth-authorization-server — instead of ["*"]. The embedded agent reaches most of the product through the PostHog MCP exec tool, so it genuinely needs the broad unprivileged set; this drops only the privileged/internal scopes and the literal *, and stops newly-added scopes from being auto-granted.
• OAUTH_SCOPE_VERSION 5 → 6, which forces existing installs to re-authorize with the narrower set on next use.

Only touches the desktop/shared client (the one on *). The mobile app is a separate OAuth client and already requests a curated 8-scope list — left unchanged.

The list is kept in sync with the API's generated oauth-scopes.generated.ts (noted in a comment on oauth.ts). A natural follow-up is to fetch scopes_supported from the well-known endpoint at sign-in so it can't drift.

How did you test this?

• vitest run src/oauth.test.ts — the OAUTH_SCOPES guard snapshot passes with the new list + bumped version.
• biome check and tsc --noEmit clean on @posthog/shared; the full-repo typecheck also ran in the pre-commit hook.

Automatic notifications

• Publish to changelog?
• Alert Sales and Marketing teams?

[github-actions]

React Doctor found no issues in the changed files. 🎉

_{Reviewed by React Doctor for commit 26d086d.}

[greptile-apps]

Prompt To Fix All With AI

Fix the following 1 code review issue. Work through them one at a time, proposing concise fixes.

---

### Issue 1 of 1
packages/shared/src/oauth.test.ts:9-194
**Large inline snapshot should move to an external file**

The inline snapshot grew from 3 lines (just `"*"`) to 185 lines. Per the team's style rule, extensive snapshots belong in external `.snap` files — keeping them inline makes diffs noisy and the test file hard to navigate. Vitest supports `toMatchSnapshot()` with an auto-managed `__snapshots__/oauth.test.ts.snap` file that would serve the same guard purpose here.

_{Reviews (1): Last reviewed commit: "feat(oauth): request explicit scopes ins..." | Re-trigger Greptile}

[greptile-apps]

Large inline snapshot should move to an external file

The inline snapshot grew from 3 lines (just "*") to 185 lines. Per the team's style rule, extensive snapshots belong in external .snap files — keeping them inline makes diffs noisy and the test file hard to navigate. Vitest supports toMatchSnapshot() with an auto-managed __snapshots__/oauth.test.ts.snap file that would serve the same guard purpose here.

Rule Used: Avoid using inline snapshots for large test result... (source)

Learned From
PostHog/posthog#32651

Prompt To Fix With AI

This is a comment left during a code review.
Path: packages/shared/src/oauth.test.ts
Line: 9-194

Comment:
**Large inline snapshot should move to an external file**

The inline snapshot grew from 3 lines (just `"*"`) to 185 lines. Per the team's style rule, extensive snapshots belong in external `.snap` files — keeping them inline makes diffs noisy and the test file hard to navigate. Vitest supports `toMatchSnapshot()` with an auto-managed `__snapshots__/oauth.test.ts.snap` file that would serve the same guard purpose here.

**Rule Used:** Avoid using inline snapshots for large test result... ([source](https://app.greptile.com/posthog-org-19734/-/custom-context?memory=22c98109-c304-4258-9763-34ef5bd39e6d))

**Learned From**
[PostHog/posthog#32651](https://github.com/PostHog/posthog/pull/32651)

How can I resolve this? If you propose a fix, please make it concise.

Note: If this suggestion doesn't match your team's coding style, reply to this and let me know. I'll remember it for next time!