From 9e9fb43e7288924cca052e5fdbb70d5365ef1ede Mon Sep 17 00:00:00 2001
From: Aaron Liu <abslant.liu@gmail.com>
Date: Sat, 13 Jun 2026 11:09:54 +0800
Subject: [PATCH] fix(router): AdminWrite scope should be required for OneDrive
 OAuth callback

---
 routers/router.go | 1 +
 1 file changed, 1 insertion(+)

diff --git a/routers/router.go b/routers/router.go
index 7c5a84cd..8c24708c 100644
--- a/routers/router.go
+++ b/routers/router.go
@@ -1007,6 +1007,7 @@ func initMasterRouter(dep dependency.Dep) *gin.Engine {
 					{
 						// 获取 OneDrive OAuth URL
 						oauth.POST("signin",
+							middleware.RequiredScopes(types.ScopeAdminWrite),
 							controllers.FromJSON[adminsvc.GetOauthRedirectService](adminsvc.GetOauthRedirectParamCtx{}),
 							controllers.AdminOdOAuthURL,
 						)