Add OAuth2 API scope registration and enforcement

Register v1 API scopes in coredata, advertise them in OIDC discovery
and protected-resource metadata, show them on the consent screen, and
enforce scope-to-action mapping in the IAM Authorizer before policy
evaluation.

Signed-off-by: Ludovic Vielle <ludovic@probo.com>

e2e/console/oauth2_test.go

@@ -65,6 +65,7 @@ func TestOAuth2_Discovery(t *testing.T) {
 	assert.Contains(t, discovery.ScopesSupported, "profile")
 	assert.Contains(t, discovery.ScopesSupported, "email")
 	assert.Contains(t, discovery.ScopesSupported, "offline_access")
+	assert.Contains(t, discovery.ScopesSupported, "v1:document:read")
 
 	assert.Contains(t, discovery.ResponseTypesSupported, "code")
 	assert.Contains(t, discovery.CodeChallengeMethodsSupported, "S256")
@@ -97,6 +98,46 @@ func TestOAuth2_Discovery(t *testing.T) {
 	assert.Contains(t, discovery.ClaimsSupported, "name")
 }
 
+func TestOAuth2_ProtectedResourceMetadata(t *testing.T) {
+	t.Parallel()
+
+	owner := testutil.NewClient(t, testutil.RoleOwner)
+
+	metadata, raw, err := testutil.OAuth2ProtectedResourceMetadata(owner)
+	require.NoError(t, err)
+	require.Equal(t, http.StatusOK, raw.StatusCode)
+	require.NotNil(t, metadata)
+
+	expectedResource := owner.BaseURL()
+	assert.Equal(t, expectedResource, metadata.Resource)
+	assert.Contains(t, metadata.AuthorizationServers, expectedResource)
+	assert.Contains(t, metadata.BearerMethodsSupported, "header")
+	assert.Contains(t, metadata.ScopesSupported, "openid")
+	assert.Contains(t, metadata.ScopesSupported, "v1:document:read")
+	assert.NotContains(t, metadata.ScopesSupported, "profile")
+}
+
+func TestOAuth2_RegisterClientWithAPIScope(t *testing.T) {
+	t.Parallel()
+
+	owner := testutil.NewClient(t, testutil.RoleOwner)
+
+	resp, raw, err := testutil.OAuth2RegisterClient(owner, map[string]any{
+		"organization_id":            owner.GetOrganizationID().String(),
+		"client_name":                "API scope client",
+		"visibility":                 "private",
+		"redirect_uris":              []string{"http://localhost:9999/callback"},
+		"grant_types":                []string{"authorization_code"},
+		"response_types":             []string{"code"},
+		"token_endpoint_auth_method": "client_secret_basic",
+		"scopes":                     "openid v1:document:read",
+	})
+	require.NoError(t, err)
+	require.Equal(t, http.StatusCreated, raw.StatusCode)
+	require.NotNil(t, resp)
+	assert.Contains(t, resp.Scopes, "v1:document:read")
+}
+
 func TestOAuth2_JWKS(t *testing.T) {
 	t.Parallel()