Allow Space OAuth collection writes

Co-authored-by: OpenAI Codex <codex@openai.com>

README.md

@@ -12,6 +12,7 @@ hf_oauth_scopes:
   - write-repos
   - contribute-repos
   - manage-repos
+  - write-collections
   - inference-api
   - jobs
   - write-discussions

backend/routes/auth.py

@@ -20,6 +20,18 @@ router = APIRouter(prefix="/auth", tags=["auth"])
 OAUTH_CLIENT_ID = os.environ.get("OAUTH_CLIENT_ID", "")
 OAUTH_CLIENT_SECRET = os.environ.get("OAUTH_CLIENT_SECRET", "")
 OPENID_PROVIDER_URL = os.environ.get("OPENID_PROVIDER_URL", "https://huggingface.co")
+OAUTH_SCOPES = (
+    "openid",
+    "profile",
+    "read-repos",
+    "write-repos",
+    "contribute-repos",
+    "manage-repos",
+    "write-collections",
+    "inference-api",
+    "jobs",
+    "write-discussions",
+)
 
 # In-memory OAuth state store with expiry (5 min TTL)
 _OAUTH_STATE_TTL = 300
@@ -69,7 +81,7 @@ async def oauth_login(request: Request) -> RedirectResponse:
     params = {
         "client_id": OAUTH_CLIENT_ID,
         "redirect_uri": get_redirect_uri(request),
-        "scope": "openid profile read-repos write-repos contribute-repos manage-repos inference-api jobs write-discussions",
+        "scope": " ".join(OAUTH_SCOPES),
         "response_type": "code",
         "state": state,
     }

tests/unit/test_auth_token_propagation.py

@@ -3,6 +3,7 @@
 import sys
 from pathlib import Path
 from types import SimpleNamespace
+from urllib.parse import parse_qs, urlparse
 
 import pytest
 
@@ -59,3 +60,16 @@ async def test_auth_me_does_not_expose_internal_hf_token():
         "username": "alice",
         "authenticated": True,
     }
+
+
+@pytest.mark.asyncio
+async def test_oauth_login_requests_collection_write_scope(monkeypatch):
+    monkeypatch.setattr(auth, "OAUTH_CLIENT_ID", "oauth-client")
+    monkeypatch.setenv("SPACE_HOST", "example.hf.space")
+    auth.oauth_states.clear()
+
+    response = await auth.oauth_login(SimpleNamespace())
+    params = parse_qs(urlparse(response.headers["location"]).query)
+    scopes = set(params["scope"][0].split())
+
+    assert "write-collections" in scopes