Add more granular OAuth scopes (#7929)

* Add more granular OAuth scopes

* Add human-readable descriptions of the new scopes

* Ensure new scopes look good on the app UI

* Add tests

* Group scopes in screen and color-code dangerous ones

* Fix wrong extra scope

1 files changed, 6 insertions, 1 deletions

diff --git a/spec/controllers/api/v1/statuses_controller_spec.rb b/spec/controllers/api/v1/statuses_controller_spec.rb
index 27e4f4eb2..8bc3b0c67 100644
--- a/spec/controllers/api/v1/statuses_controller_spec.rb
+++ b/spec/controllers/api/v1/statuses_controller_spec.rb
@@ -5,7 +5,7 @@ RSpec.describe Api::V1::StatusesController, type: :controller do
 
   let(:user)  { Fabricate(:user, account: Fabricate(:account, username: 'alice')) }
   let(:app)   { Fabricate(:application, name: 'Test app', website: 'http://testapp.com') }
-  let(:token) { Fabricate(:accessible_access_token, resource_owner_id: user.id, application: app, scopes: 'write') }
+  let(:token) { Fabricate(:accessible_access_token, resource_owner_id: user.id, application: app, scopes: scopes) }
 
   context 'with an oauth token' do
     before do
@@ -13,6 +13,7 @@ RSpec.describe Api::V1::StatusesController, type: :controller do
     end
 
     describe 'GET #show' do
+      let(:scopes) { 'read:statuses' }
       let(:status) { Fabricate(:status, account: user.account) }
 
       it 'returns http success' do
@@ -22,6 +23,7 @@ RSpec.describe Api::V1::StatusesController, type: :controller do
     end
 
     describe 'GET #context' do
+      let(:scopes) { 'read:statuses' }
       let(:status) { Fabricate(:status, account: user.account) }
 
       before do
@@ -35,6 +37,8 @@ RSpec.describe Api::V1::StatusesController, type: :controller do
     end
 
     describe 'POST #create' do
+      let(:scopes) { 'write:statuses' }
+
       before do
         post :create, params: { status: 'Hello world' }
       end
@@ -45,6 +49,7 @@ RSpec.describe Api::V1::StatusesController, type: :controller do
     end
 
     describe 'DELETE #destroy' do
+      let(:scopes) { 'write:statuses' }
       let(:status) { Fabricate(:status, account: user.account) }
 
       before do