fix(linkedin): drop deprecated r_basicprofile from default scopes

Make r_basicprofile opt-in via LINKEDIN_EXTRA_SCOPES so self-hosted users
unblock by default and ops with legacy/enterprise products keep working.

Why
---
LinkedIn rejects OAuth authorize requests with a generic "Bummer,
something went wrong" page when an app asks for a scope it can't grant.
`r_basicprofile` is a legacy scope deprecated in 2018; new LinkedIn dev
apps don't have it, so every self-hosted user hits the rejection
immediately on `/connect/linkedin`.

The two products LinkedIn actually grants to standard apps today are:

- Sign In with LinkedIn using OpenID Connect → `openid profile email`
- Share on LinkedIn                          → `w_member_social`

That set is enough for the connect flow. The only piece of data
`r_basicprofile` was buying us is `/v2/me`'s `vanityName` (pretty
`linkedin.com/in/<slug>`). `fetchVanityName()` already handles HTTP
failure gracefully (returns null), and the only downstream consumer —
`LinkedInPagePublisher`'s post-URL builder — already falls back to a
numeric `linkedin.com/feed/update/<id>` URL when `$account->username`
is null.

Backward compatibility
----------------------
Ops with legacy or enterprise LinkedIn products approved on their dev
app (so they DO have `r_basicprofile`) can opt back in via env:

    LINKEDIN_EXTRA_SCOPES=r_basicprofile

`LinkedInController::resolveScopes()` merges this comma-separated list
into the default scope array. The connect flow's `Socialite::scopes()`
call then includes the legacy scope, preserving the pre-PR behaviour
end-to-end (including `vanityName` lookup).

Net effect for users without `r_basicprofile`:
- Connect flow works (was previously rejected by LinkedIn).
- Posts publish exactly the same way.
- Generated post URLs use the numeric form instead of the vanity slug.

Tests
-----
- `linkedin connect requests the default scope set when LINKEDIN_EXTRA_SCOPES is unset`
- `linkedin connect appends LINKEDIN_EXTRA_SCOPES to the default scope set`
- Existing `splits comma-separated approvedScopes` fixture updated to
  match the new default set.

.env.example

@@ -103,6 +103,11 @@ LINKEDIN_CLIENT_ID=
 LINKEDIN_CLIENT_SECRET=
 LINKEDIN_CLIENT_REDIRECT="${APP_URL}/accounts/linkedin/callback"
 LINKEDIN_PAGE_CLIENT_REDIRECT="${APP_URL}/accounts/linkedin-page/callback"
+# Optional: comma-separated extra OAuth scopes appended to the personal
+# LinkedIn connect flow. Use this if your LinkedIn dev app has legacy or
+# enterprise products approved — e.g. `r_basicprofile` re-enables
+# vanityName lookup via /v2/me. Leave empty for the safe default set.
+# LINKEDIN_EXTRA_SCOPES=r_basicprofile
 
 # X / Twitter (https://developer.twitter.com)
 X_CLIENT_ID=

app/Http/Controllers/Auth/LinkedInController.php

@@ -26,7 +26,6 @@ class LinkedInController extends SocialController
         'openid',
         'profile',
         'email',
-        'r_basicprofile',
         'w_member_social',
     ];
 
@@ -42,7 +41,26 @@ public function connect(Request $request): Response|RedirectResponse
 
         $this->authorize('manageAccounts', $workspace);
 
-        return $this->redirectToProvider($request, $this->driver, $this->scopes);
+        return $this->redirectToProvider($request, $this->driver, $this->resolveScopes());
+    }
+
+    /**
+     * Merge $this->scopes with any extra scopes the operator configured via
+     * `LINKEDIN_EXTRA_SCOPES` — comma-separated, e.g. `r_basicprofile`. Useful
+     * when the connected LinkedIn dev app has legacy or enterprise products
+     * not covered by the default Sign-In + Share-on-LinkedIn pair.
+     */
+    protected function resolveScopes(): array
+    {
+        $extra = (string) config('services.linkedin.extra_scopes', '');
+
+        if ($extra === '') {
+            return $this->scopes;
+        }
+
+        $extraScopes = array_filter(array_map('trim', explode(',', $extra)));
+
+        return array_values(array_unique([...$this->scopes, ...$extraScopes]));
     }
 
     public function callback(Request $request): View

config/services.php

@@ -41,6 +41,12 @@
         'client_id' => env('LINKEDIN_CLIENT_ID'),
         'client_secret' => env('LINKEDIN_CLIENT_SECRET'),
         'redirect' => env('LINKEDIN_CLIENT_REDIRECT'),
+        // Comma-separated list of OAuth scopes to request beyond the defaults
+        // (openid, profile, email, w_member_social). Useful for apps with
+        // legacy or enterprise products approved — e.g. set
+        // `LINKEDIN_EXTRA_SCOPES=r_basicprofile` to re-enable vanityName
+        // lookup via /v2/me.
+        'extra_scopes' => env('LINKEDIN_EXTRA_SCOPES'),
     ],
 
     'linkedin-openid' => [

docker/.env.docker.example

@@ -90,6 +90,11 @@ LINKEDIN_CLIENT_ID=
 LINKEDIN_CLIENT_SECRET=
 LINKEDIN_CLIENT_REDIRECT="${APP_URL}/accounts/linkedin/callback"
 LINKEDIN_PAGE_CLIENT_REDIRECT="${APP_URL}/accounts/linkedin-page/callback"
+# Optional: comma-separated extra OAuth scopes appended to the personal
+# LinkedIn connect flow. Use this if your LinkedIn dev app has legacy or
+# enterprise products approved — e.g. `r_basicprofile` re-enables
+# vanityName lookup via /v2/me. Leave empty for the safe default set.
+# LINKEDIN_EXTRA_SCOPES=r_basicprofile
 
 X_CLIENT_ID=
 X_CLIENT_SECRET=

tests/Feature/Social/LinkedInControllerTest.php

@@ -39,6 +39,69 @@
     expect(session('social_connect_workspace'))->toBe($this->workspace->id);
 });
 
+test('linkedin connect requests the default scope set when LINKEDIN_EXTRA_SCOPES is unset', function () {
+    config(['services.linkedin.extra_scopes' => null]);
+
+    $captured = [];
+
+    $driverMock = Mockery::mock();
+    $driverMock->shouldReceive('scopes')
+        ->withArgs(function (array $scopes) use (&$captured) {
+            $captured = $scopes;
+
+            return true;
+        })
+        ->andReturnSelf();
+    $driverMock->shouldReceive('redirect')->andReturn(Mockery::mock([
+        'getTargetUrl' => 'https://www.linkedin.com/oauth/v2/authorization?test=1',
+    ]));
+
+    Socialite::shouldReceive('driver')
+        ->with('linkedin')
+        ->andReturn($driverMock);
+
+    $this->actingAs($this->user)
+        ->withHeader('X-Inertia', 'true')
+        ->get(route('app.social.linkedin.connect'));
+
+    expect($captured)->toEqualCanonicalizing([
+        'openid', 'profile', 'email', 'w_member_social',
+    ]);
+});
+
+test('linkedin connect appends LINKEDIN_EXTRA_SCOPES to the default scope set', function () {
+    // Backward-compatibility: ops who have legacy products approved on
+    // their LinkedIn app (e.g. r_basicprofile) opt back in via env.
+    config(['services.linkedin.extra_scopes' => 'r_basicprofile, r_emailaddress']);
+
+    $captured = [];
+
+    $driverMock = Mockery::mock();
+    $driverMock->shouldReceive('scopes')
+        ->withArgs(function (array $scopes) use (&$captured) {
+            $captured = $scopes;
+
+            return true;
+        })
+        ->andReturnSelf();
+    $driverMock->shouldReceive('redirect')->andReturn(Mockery::mock([
+        'getTargetUrl' => 'https://www.linkedin.com/oauth/v2/authorization?test=1',
+    ]));
+
+    Socialite::shouldReceive('driver')
+        ->with('linkedin')
+        ->andReturn($driverMock);
+
+    $this->actingAs($this->user)
+        ->withHeader('X-Inertia', 'true')
+        ->get(route('app.social.linkedin.connect'));
+
+    expect($captured)->toEqualCanonicalizing([
+        'openid', 'profile', 'email', 'w_member_social',
+        'r_basicprofile', 'r_emailaddress',
+    ]);
+});
+
 test('linkedin oauth callback creates account', function () {
     session([
         'social_connect_workspace' => $this->workspace->id,
@@ -99,7 +162,7 @@
     // splits on space (the OAuth 2.0 default), so approvedScopes lands as
     // a single-element array with the whole CSV inside. The save path
     // must normalize back to individual tokens.
-    $socialiteUser->approvedScopes = ['email,openid,profile,r_basicprofile,w_member_social'];
+    $socialiteUser->approvedScopes = ['email,openid,profile,w_member_social'];
 
     Socialite::shouldReceive('driver')
         ->with('linkedin')
@@ -116,7 +179,7 @@
 
     $account = SocialAccount::where('platform_user_id', 'abc123xyz')->first();
     expect($account->scopes)->toEqualCanonicalizing([
-        'email', 'openid', 'profile', 'r_basicprofile', 'w_member_social',
+        'email', 'openid', 'profile', 'w_member_social',
     ]);
 });