fix(auth): Revert OAuth scopes to wildcard to fix prod login

[charlesvien]

Problem

Login against US prod is broken: /oauth/authorize redirects back with error=invalid_scope. #3411 switched the OAuth request from "" to an explicit scope list including the privileged llm_gateway:read, but the prod OAuth app rows have no seeded scope ceiling. The server only grandfathers "" under an empty ceiling and rejects any privileged scope, so every login fails. The same PR bumped OAUTH_SCOPE_VERSION, which force-logs-out existing sessions into that broken flow, so any build with #3411 locks users out entirely. v0.57.262 is tagged with this and must not ship until this lands.

Changes

Revert OAUTH_SCOPES to [""] and OAUTH_SCOPE_VERSION to 5, restoring the exact behavior of v0.57.257. Existing "" tokens keep working with no forced re-auth. The explicit list can re-land once the US and EU OAuthApplication ceilings are seeded with ["@default", "llm_gateway:read"].

How did you test this?

• pnpm --filter @posthog/shared test (642 passed) and typecheck
• pnpm --filter @posthog/core test src/auth src/oauth (2481 passed)
• pnpm --filter @posthog/harness test src/extensions/posthog-provider (661 passed)

Automatic notifications

• Publish to changelog?
• Alert Sales and Marketing teams?

[trunk-io]

😎 This pull request was merged.

[github-actions]

React Doctor found no issues in the changed files. 🎉

_{Reviewed by React Doctor for commit eb6c4dc.}

[greptile-apps]

Security Review

New desktop, web, and harness authorizations request a wildcard grant. Without a compulsory server-side scope restriction, issued tokens may receive permissions beyond the previous explicit list.

Prompt To Fix All With AI

Fix the following 1 code review issue. Work through them one at a time, proposing concise fixes.

---

### Issue 1 of 1
packages/shared/src/oauth.ts:11
**Wildcard Can Broaden Token Access**

New desktop, web, and harness logins now request `*` while the production OAuth applications lack the intended scope restriction. If the grandfathered wildcard expands beyond the previous explicit list, issued tokens gain unadvertised or future permissions, increasing the access available through a leaked or misused token. Apply a compulsory server-side restriction before requesting the wildcard, or ensure its expansion is limited to the previous scope set.

_{Reviews (1): Last reviewed commit: "revert oauth scopes to wildcard" | Re-trigger Greptile}

[veria-ai]

PR overview

All previously flagged issues have been addressed. No open security concerns remain on this pull request.

Security review

No open security issues remain on this pull request.

Fixed/addressed: 1 · PR risk: 0/10