From e5f7435d9f941822d7fbf6f050ab725237eb2632 Mon Sep 17 00:00:00 2001
From: Peter Steinberger <steipete@gmail.com>
Date: Tue, 20 Jan 2026 10:45:48 +0000
Subject: [PATCH] fix: sync device scopes on token rotation

---
 src/infra/device-pairing.test.ts | 1 +
 src/infra/device-pairing.ts      | 3 +++
 2 files changed, 4 insertions(+)

diff --git a/src/infra/device-pairing.test.ts b/src/infra/device-pairing.test.ts
index faa2a1a44..29ff507b7 100644
--- a/src/infra/device-pairing.test.ts
+++ b/src/infra/device-pairing.test.ts
@@ -31,6 +31,7 @@ describe("device pairing tokens", () => {
     });
     let paired = await getPairedDevice("device-1", baseDir);
     expect(paired?.tokens?.operator?.scopes).toEqual(["operator.read"]);
+    expect(paired?.scopes).toEqual(["operator.read"]);
 
     await rotateDeviceToken({
       deviceId: "device-1",
diff --git a/src/infra/device-pairing.ts b/src/infra/device-pairing.ts
index 9f161fea1..b190199eb 100644
--- a/src/infra/device-pairing.ts
+++ b/src/infra/device-pairing.ts
@@ -472,6 +472,9 @@ export async function rotateDeviceToken(params: {
     };
     tokens[role] = next;
     device.tokens = tokens;
+    if (params.scopes !== undefined) {
+      device.scopes = requestedScopes;
+    }
     state.pairedByDeviceId[device.deviceId] = device;
     await persistState(state, params.baseDir);
     return next;