From b91b1f95ce1698e45fe6336bd0fed8d7b9add6ea Mon Sep 17 00:00:00 2001
From: Warren Chen <warrenchen@WarrendeMacBook-Pro.local>
Date: Tue, 7 Jul 2026 13:51:30 +0900
Subject: [PATCH] Expand web login current-user profile scopes

---
 docs/DESIGN.md                                             | 2 +-
 docs/OPENAPI.md                                            | 2 +-
 docs/SCOPES.md                                             | 2 +-
 .../Services/AuthResourceRegistryService.cs                | 7 ++++++-
 4 files changed, 9 insertions(+), 4 deletions(-)

diff --git a/docs/DESIGN.md b/docs/DESIGN.md
index 96aa6e2..bdd54d3 100644
--- a/docs/DESIGN.md
+++ b/docs/DESIGN.md
@@ -111,7 +111,7 @@
 - Login / Logout return URL allowlist 分開驗證，採 URI origin 與 path segment prefix 比對，不使用原始字串 `StartsWith`。
 - API 可用 `Auth:WebLoginUrl` 指定登入頁位置；預設為 `/account/login`。
 - `web_login` 可使用 public client + PKCE，不要求 client secret。
-- `web_login` client 可使用 `openid email profile`，並預留 `profile:basic.read`。
+- `web_login` client 可使用 `openid email profile` 與 current-user `profile:*` scopes；這些 scopes 僅能操作 access token subject 自己的資料。
 
 ### 6.2 OAuth2 API 使用（站點自行 UI）
 1) 站點以 API 驗證使用者登入（會員中心提供 login API）
diff --git a/docs/OPENAPI.md b/docs/OPENAPI.md
index 57617a3..338b75c 100644
--- a/docs/OPENAPI.md
+++ b/docs/OPENAPI.md
@@ -90,7 +90,7 @@
   - 使用 Authorization Code + PKCE
   - 需設定 `redirect_uris`
   - 可使用 `client_type=public`
-  - 允許 scope：`openid`、`email`、`profile`、`profile:basic.read`
+  - 允許 scope：`openid`、`email`、`profile`、全部 current-user `profile:*`
 - `usage=webhook_outbound`：
   - 供 Member Center 內部標記「對外 webhook 用」的租戶憑證用途
   - 不可用於租戶 API 呼叫
diff --git a/docs/SCOPES.md b/docs/SCOPES.md
index 63a932a..f0cc404 100644
--- a/docs/SCOPES.md
+++ b/docs/SCOPES.md
@@ -78,7 +78,7 @@ Token audience 由 scope → resource registry 計算。
 
 | Usage | Client 型態 / Tenant | 預設 scopes |
 |---|---|---|
-| `web_login` | public 或 confidential；互動式登入 | `openid`、`email`、`profile`、`profile:basic.read` |
+| `web_login` | public 或 confidential；互動式登入 | `openid`、`email`、`profile`、全部 current-user `profile:*` |
 | `tenant_api` | confidential；必須綁 tenant | `newsletter:events.write`、`newsletter:list.read`、`newsletter:subscriptions.read/write`、全部 `profile:*` |
 | `platform_service` | confidential；可不綁 tenant | `newsletter:events.write.global`、`newsletter:list.read.global`、全部 `profile:*` |
 | `send_api` | confidential；必須綁 tenant | `newsletter:send.read/write` |
diff --git a/src/MemberCenter.Infrastructure/Services/AuthResourceRegistryService.cs b/src/MemberCenter.Infrastructure/Services/AuthResourceRegistryService.cs
index b3b39f7..b023777 100644
--- a/src/MemberCenter.Infrastructure/Services/AuthResourceRegistryService.cs
+++ b/src/MemberCenter.Infrastructure/Services/AuthResourceRegistryService.cs
@@ -82,7 +82,12 @@ public sealed class AuthResourceRegistryService : IAuthResourceRegistryService
             OpenIddictConstants.Scopes.OpenId,
             OpenIddictConstants.Scopes.Email,
             OpenIddictConstants.Scopes.Profile,
-            "profile:basic.read"
+            "profile:basic.read",
+            "profile:basic.write",
+            "profile:addresses.read",
+            "profile:addresses.write",
+            "profile:subscriptions.read",
+            "profile:subscriptions.write"
         ], cancellationToken);
 
         await EnsureUsagePermissionsAsync("webhook_outbound", [