oh so queerious

[ImShyMike]

No description provided.

[greptile-apps]

Greptile Summary

The PR introduces endpoint-specific OAuth scopes, one-year access tokens with refresh-token support, and safer deterministic development seeding.

• Adds dedicated profile, read, heartbeats, and api_key authorization requirements.
• Updates OAuth documentation, generated API descriptions, and request coverage.
• Reworks the seeded OAuth application and development token to update stable identifiers instead of ambiguous attributes.

Confidence Score: 5/5

The PR appears safe to merge, with only a remaining non-blocking scope-test coverage gap.

No blocking failure remains; the previously reported seed defects are corrected, while the prior scope-rejection testing concern remains only for the API-key endpoint.

Important Files Changed

Filename	Overview
app/controllers/api/v1/authenticated/application_controller.rb	Centralizes endpoint-specific Doorkeeper scope authorization through an overridable scope list.
app/controllers/api/v1/authenticated/api_keys_controller.rb	Protects permanent API-key retrieval behind the dedicated api_key OAuth scope.
config/initializers/doorkeeper.rb	Registers the new scopes, reduces access-token lifetime to one year, and enables refresh tokens.
db/seeds.rb	Updates the fixed-UID desktop application and fixed development token deterministically, resolving the previously reported reseeding problems.
spec/requests/api/v1/authenticated_spec.rb	Adds missing-scope request coverage for the profile, stats, projects, streak, and heartbeat endpoints.
docs/oauth/oauth-apps.md	Documents the new scope split, shorter token lifetime, and rotating refresh-token flow.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart LR
  Client[OAuth client] --> Token[Bearer access token]
  Token --> Guard[Doorkeeper scope authorization]
  Guard -->|profile| Me[Profile endpoint]
  Guard -->|read| Stats[Hours, projects, and streak]
  Guard -->|heartbeats| Heartbeats[Latest heartbeat]
  Guard -->|api_key| ApiKey[Permanent API key]
  Refresh[Refresh token] --> Token

Loading

_{Reviews (7): Last reviewed commit: "Merge branch 'main' into fix-oauth" | Re-trigger Greptile}