update

docs/deployment.md

@@ -53,7 +53,9 @@ Create these separately:
 
 The OAuth client secret authenticates the portal to Gitea. The package token
 is used only server-side while proxying an authorized file. Neither value is
-returned to a technician or Proxmox host.
+returned to a technician or Proxmox host. The broker requests only Gitea's
+`read:user` OAuth scope, which it uses to confirm the signed-in username
+against `TAPM_ALLOWED_GITEA_USERS`.
 
 ## 4. Broker configuration
 

internal/app/auth.go

@@ -48,6 +48,7 @@ func (s *Server) handleLogin(w http.ResponseWriter, r *http.Request) {
 		"client_id":     {s.cfg.GiteaClientID},
 		"redirect_uri":  {redirectURI},
 		"response_type": {"code"},
+		"scope":         {"read:user"},
 		"state":         {state},
 	}
 	http.Redirect(