From 4f2c2ecef4f53777dafc94cbdf1aa07ef0a2b1c0 Mon Sep 17 00:00:00 2001
From: mbelinky <mbelinky@users.noreply.github.com>
Date: Fri, 20 Feb 2026 18:36:59 +0100
Subject: [PATCH] Gateway/Pairing: restore scope allow helper openclaw#20703
 thanks @coygeek

---
 src/infra/device-pairing.ts | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/src/infra/device-pairing.ts b/src/infra/device-pairing.ts
index 69cd4cfc461..5a2caab853d 100644
--- a/src/infra/device-pairing.ts
+++ b/src/infra/device-pairing.ts
@@ -177,6 +177,17 @@ function mergePendingDevicePairingRequest(
   };
 }
 
+function scopesAllow(requested: string[], allowed: string[]): boolean {
+  if (requested.length === 0) {
+    return true;
+  }
+  if (allowed.length === 0) {
+    return false;
+  }
+  const allowedSet = new Set(allowed);
+  return requested.every((scope) => allowedSet.has(scope));
+}
+
 const DEVICE_SCOPE_IMPLICATIONS: Readonly<Record<string, readonly string[]>> = {
   "operator.admin": ["operator.read", "operator.write", "operator.approvals", "operator.pairing"],
   "operator.write": ["operator.read"],