Scopes
A scope is the vocabulary a club consents in. It is coarse on purpose: a club administrator has to be able to weigh it in one sentence, and a consent screen full of internal permission names is a consent screen nobody reads.
A scope resolves to permissions that already exist inside Lobo One, and it only ever narrows. Being granted a scope does not bypass anything: the club’s data isolation still applies, the module the scope belongs to still has to be switched on, and every request is still authorised on its own.
| Scope | What the club is agreeing to | Needs the module |
|---|---|---|
members.read | See the people who belong to your club, and their household relationships. | members |
members.write | Add and update the people who belong to your club. | members |
bookings.read | See what has been booked, and what is free. | bookings |
bookings.write | Make and cancel bookings on behalf of your members. | bookings |
catalog.read | See what your club offers and what it costs. | catalog |
billing.read | See what your members have been invoiced and what is outstanding. | billing |
events.read | Receive notifications about things that happen in your club. | — |
What each one reaches
members.read
- List and read the members of the club that granted you
- Read household relationships between them
members.write
- Everything members.read allows
- Create and update members
bookings.read
- Read bookings and what is free
- Read the resources a club has, and their types
bookings.write
- Everything bookings.read allows
- Make and cancel bookings for a member
catalog.read
- Read what the club offers and the price of each thing
billing.read
- Read invoices and outstanding balances
events.read
- Nothing on its own: it grants no endpoint
- Reserved for event delivery, which is not built yet
Asking for less
Ask for the narrowest set that works. A club weighing members.read agrees faster than one weighing members.write, and a component that only displays should hold a token that only reads — which you get by naming the scope on the token request.