From 89fc92c3ca5ea5489706b95399f44c149231c467 Mon Sep 17 00:00:00 2001
From: rick <rick@debian-BULLSEYE-live-builder-AMD64>
Date: Tue, 3 Mar 2026 20:39:01 -0600
Subject: [PATCH] fix(ui): request full operator scopes for gateway client

---
 ui/src/ui/gateway.ts | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/ui/src/ui/gateway.ts b/ui/src/ui/gateway.ts
index 5d0c4e73f2f..e12db30bd78 100644
--- a/ui/src/ui/gateway.ts
+++ b/ui/src/ui/gateway.ts
@@ -173,7 +173,13 @@ export class GatewayBrowserClient {
     // Gateways may reject this unless gateway.controlUi.allowInsecureAuth is enabled.
     const isSecureContext = typeof crypto !== "undefined" && !!crypto.subtle;
 
-    const scopes = ["operator.admin", "operator.approvals", "operator.pairing"];
+    const scopes = [
+      "operator.admin",
+      "operator.read",
+      "operator.write",
+      "operator.approvals",
+      "operator.pairing",
+    ];
     const role = "operator";
     let deviceIdentity: Awaited<ReturnType<typeof loadOrCreateDeviceIdentity>> | null = null;
     let canFallbackToShared = false;