From 2fdd59ae5487edabb942c3fe1b1b9f68e3ec0bc1 Mon Sep 17 00:00:00 2001
From: Ginger <ginger@gingershaped.computer>
Date: Fri, 2 Oct 2026 11:05:19 -0400
Subject: [PATCH] fix: Use ApiFullAccess as required scope for NoAccessToken
 endpoints

---
 src/api/router/auth.rs | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/src/api/router/auth.rs b/src/api/router/auth.rs
index b4afef0d3..cac270ee0 100644
--- a/src/api/router/auth.rs
+++ b/src/api/router/auth.rs
@@ -261,9 +261,11 @@ async fn check<R: IncomingRequest<Authentication = Self> + Any>(
 			})?;
 
 		if let Some(authentication) = authentication {
-			check_access_token(services, &authentication, query, TypeId::of::<R>(), &[])
-				.await
-				.map(Some)
+			check_access_token(services, &authentication, query, TypeId::of::<R>(), &[
+				OAuthClientScope::ApiFullAccess,
+			])
+			.await
+			.map(Some)
 		} else {
 			Ok(None)
 		}