fix(chat): disallow users without "ai" scope to use AI

[pan93412]

Before (always allowed):

After (only authorized allowed):

[linear]

DBP-88 任意使用者都能使用 AI

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Preview	Comments	Updated (UTC)
dbplay-app	Ready	Preview	Comment	Oct 4, 2025 7:23pm

[Copilot]

Pull Request Overview

This PR implements scope-based authorization for AI chat functionality by enhancing the authentication system to check for specific user permissions. Users must now have either "*" or "ai" scope to access AI chat features.

• Enhanced checkAuthorizedStatus function to accept and validate required scopes
• Added scope checking logic that validates user permissions against token introspection results
• Applied AI-specific authorization to the chat API endpoint

Reviewed Changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

File	Description
lib/auth.rsc.ts	Enhanced authorization function to support scope-based permissions checking
app/api/chat/route.ts	Applied AI scope requirement to chat endpoint authorization

---

_{Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.}