Add OAuth2 API scope registration and enforcement

Register v1 API scopes in coredata, advertise them in OIDC discovery
and protected-resource metadata, show them on the consent screen, and
enforce scope-to-action mapping in the IAM Authorizer before policy
evaluation.

Signed-off-by: Ludovic Vielle <ludovic@probo.com>

pkg/server/api/console/v1/dataloader/authorize.go

@@ -35,7 +35,7 @@ func NewAuthorizeFunc(logger *log.Logger) authz.AuthorizeFunc {
 	return func(
 		ctx context.Context,
 		objectID gid.GID,
-		action string,
+		action iam.Action,
 		options ...authz.AuthorizeFuncOption,
 	) (*coredata.Scope, error) {
 		loaders := FromContext(ctx)
@@ -66,6 +66,10 @@ func NewAuthorizeFunc(logger *log.Logger) authz.AuthorizeFunc {
 				return nil, gqlutils.Forbidden(ctx, err)
 			}
 
+			if _, ok := errors.AsType[*iam.ErrInsufficientOAuth2Scope](err); ok {
+				return nil, gqlutils.Forbidden(ctx, err)
+			}
+
 			if errors.Is(err, coredata.ErrResourceNotFound) {
 				return nil, gqlutils.NotFoundf(ctx, "resource not found")
 			}

pkg/server/api/console/v1/dataloader/dataloader.go

@@ -41,7 +41,7 @@ type (
 	// batch together.
 	AuthorizeKey struct {
 		ResourceID          gid.GID
-		Action              string
+		Action              iam.Action
 		ResourceAttributes  string
 		DryRun              bool
 		SkipAssumptionCheck bool