Add OAuth2 API scope registration and enforcement

Register v1 API scopes in coredata, advertise them in OIDC discovery
and protected-resource metadata, show them on the consent screen, and
enforce scope-to-action mapping in the IAM Authorizer before policy
evaluation.

Signed-off-by: Ludovic Vielle <ludovic@probo.com>

pkg/accessreview/actions.go

@@ -42,4 +42,7 @@ const (
 	ActionSourceUpdate = "access-review:source:update"
 	ActionSourceDelete = "access-review:source:delete"
 	ActionSourceSync   = "access-review:source:sync"
+
+	// Driver catalog actions (global deployment-scoped catalog).
+	ActionDriverCatalogList = "access-review:driver-catalog:list"
 )

pkg/accessreview/oauth2_scopes.go

@@ -0,0 +1,58 @@
+// Copyright (c) 2026 Probo Inc <hello@probo.com>.
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+// PERFORMANCE OF THIS SOFTWARE.
+
+package accessreview
+
+import (
+	"go.probo.inc/probo/pkg/coredata"
+	"go.probo.inc/probo/pkg/iam"
+)
+
+const (
+	ScopeV1AccessReviewRead coredata.OAuth2Scope = "v1:access-review:read"
+	ScopeV1AccessReview     coredata.OAuth2Scope = "v1:access-review"
+)
+
+// OAuth2ScopeSet returns OAuth2 scope mappings for access-review actions.
+func OAuth2ScopeSet() *iam.ScopeSet {
+	return iam.CreateScopeSet(
+		map[coredata.OAuth2Scope][]iam.Action{
+			ScopeV1AccessReviewRead: {
+				ActionCampaignGet,
+				ActionCampaignList,
+				ActionEntryGet,
+				ActionEntryList,
+				ActionSourceGet,
+				ActionSourceList,
+				ActionDriverCatalogList,
+			},
+			ScopeV1AccessReview: {
+				ActionCampaignCreate,
+				ActionCampaignUpdate,
+				ActionCampaignDelete,
+				ActionCampaignStart,
+				ActionCampaignClose,
+				ActionCampaignCancel,
+				ActionCampaignAddSource,
+				ActionCampaignRemoveSource,
+				ActionEntryDecide,
+				ActionEntryFlag,
+				ActionSourceCreate,
+				ActionSourceUpdate,
+				ActionSourceDelete,
+				ActionSourceSync,
+			},
+		},
+	)
+}

pkg/accessreview/policies.go

@@ -48,6 +48,17 @@ var ReadAccessPolicy = policy.NewPolicy(
 	).WithSID("access-review-read-access").When(organizationCondition),
 ).WithDescription("Read-only access-review access")
 
+// DriverCatalogPolicy grants every authenticated identity read access to the
+// global access-review driver catalog. The catalog is deployment-scoped and has
+// no organization scoping, so the allow has no condition.
+var DriverCatalogPolicy = policy.NewPolicy(
+	"access-review:driver-catalog",
+	"Access Review Driver Catalog",
+	policy.Allow(
+		ActionDriverCatalogList,
+	).WithSID("read-access-review-driver-catalog"),
+).WithDescription("Allows every authenticated user to read the global access-review driver catalog")
+
 // PolicySet returns the PolicySet for the access-review service. It is owned by
 // this package and registered into the authorizer at composition time so the
 // access-review authorization rules live alongside the access-review domain
@@ -56,5 +67,6 @@ func PolicySet() *iam.PolicySet {
 	return iam.NewPolicySet().
 		AddRolePolicy("OWNER", FullAccessPolicy).
 		AddRolePolicy("ADMIN", FullAccessPolicy).
-		AddRolePolicy("VIEWER", ReadAccessPolicy)
+		AddRolePolicy("VIEWER", ReadAccessPolicy).
+		AddIdentityScopedPolicy(DriverCatalogPolicy)
 }