Lexicon Garden

im.flushing.authApp

The permissions a Flushes session needs, as one named bundle an authorization server can resolve instead of the client spelling out four `repo:` grants. It holds the four collections everybody writes and deliberately not `im.flushing.fundraiser` or `im.flushing.donor`, both of which are written from /admin by the one account that runs the site: putting either here would list a collection on every user's consent screen that nobody but that account will ever write. Requesting this set and requesting the four grants individually authorize exactly the same writes; the set exists so the consent screen can name the app rather than enumerate its storage. Reads are absent on purpose, because every read path in Flushes goes out unauthenticated against world-readable repo records.

Repository @flushes.app did:plc:omyqslmybfah7a5shue7hnqz not from the namespace authority
Details · permission-set
Kindpermission-set
Authorityflushing.im
Indexed
Compare Edit in builder → Fork →

Permission set

permission-set

Shown at sign-in

title

string

Flushes

detail

string

Post, edit and delete your flushes; react and reply to other people's; and keep your settings so they follow you to your next device.

Permissions

repo

permission

Create, update and delete records in im.flushing.right.now, im.flushing.reaction, im.flushing.reply and im.flushing.preferences.

  • action: create, update, delete
Collections

Asking for it

OAuth scope

include:im.flushing.authApp

scope

A client asks for this permission set with this scope. The scope builder lists what the set grants.

Scope builder

Similar lexicons

semantic match

Lexicons whose schemas describe something close to this one. Check them before publishing a new one that overlaps.

  • app.standard-reader.authCollections

    permission-set

  • work.sequential.authReader

    permission-set

    Permissions for reader apps: the records readers write in their own repos.

  • community.gifthood.authApp

    permission-set

    The everyday Gifthood member bundle: every community.gifthood.* record type the app writes on a member's behalf. Deliberately excludes anything outside this namespace — blob upload, app.bsky.* grants, and the Ozone RPC grants are requested individually (spec: blob/account/identity can never live in a set; foreign namespaces can't either).

  • pub.oysters.authFullApp

    permission-set

    Everything the Oysters web app writes. Upvotes are community.lexicon.interaction.like records, which sit outside this set's namespace, so the app requests them as a separate repo scope.

  • app.bulleted.authFull

    permission-set