Introduce oauth2scope registry with freeze lifecycle

Replace pkg/iam/scopeset with pkg/iam/oauth2scope.Registry, a shared
OAuth2 scope→action registry used by the authorizer, OAuth2 service,
and Connect API. Registration stays open until probod calls Freeze();
read paths (RegisteredScopes, Allows, ValidateScopes) panic before
that.

Drop the leaky APIScopes surface and AllowedAPIScopes on manual
access-token creation in favor of registry.ValidateScopes. Metadata,
protected-resource metadata, and CIMD scope lists are built from
RegisteredScopes() via helpers in pkg/iam/oauth2/scopes.go. Expose
oauth2ScopesSupported as an OAuth2Scope GraphQL scalar.

Signed-off-by: Ludovic Vielle <ludovic@probo.com>

pkg/server/api/connect/v1/base_resolvers.go

@@ -267,15 +267,8 @@ func (r *queryResolver) SignUpEnabled(ctx context.Context) (bool, error) {
 }
 
 // Oauth2ScopesSupported is the resolver for the oauth2ScopesSupported field.
-func (r *queryResolver) Oauth2ScopesSupported(ctx context.Context) ([]string, error) {
-	apiScopes := r.iam.OAuth2ScopeSet.APIScopes()
-
-	scopes := make([]string, len(apiScopes))
-	for i, scope := range apiScopes {
-		scopes[i] = scope.String()
-	}
-
-	return scopes, nil
+func (r *queryResolver) Oauth2ScopesSupported(ctx context.Context) ([]coredata.OAuth2Scope, error) {
+	return r.scopeRegistry.RegisteredScopes(), nil
 }
 
 // Mutation returns schema.MutationResolver implementation.

pkg/server/api/connect/v1/gqlgen.yaml

@@ -43,4 +43,7 @@ models:
       - "go.probo.inc/probo/pkg/server/gqlutils/types/bigint.BigIntScalar"
   EmailAddr:
     model:
-      - "go.probo.inc/probo/pkg/server/gqlutils/types/mail.AddrScalar"
+      - "go.probo.inc/probo/pkg/server/gqlutils/types/mail.AddrScalar"
+  OAuth2Scope:
+    model:
+      - go.probo.inc/probo/pkg/server/gqlutils/types/oauth2scope.OAuth2ScopeScalar

pkg/server/api/connect/v1/graphql/base.graphql

@@ -16,6 +16,7 @@ scalar CursorKey
 scalar Datetime
 scalar Upload
 scalar EmailAddr
+scalar OAuth2Scope
 
 interface Node {
   id: ID!
@@ -33,7 +34,7 @@ type Query {
   signUpEnabled: Boolean!
     @goField(forceResolver: true)
     @authentication(required: OPTIONAL)
-  oauth2ScopesSupported: [String!]!
+  oauth2ScopesSupported: [OAuth2Scope!]!
     @goField(forceResolver: true)
     @authentication(required: OPTIONAL)
 }

pkg/server/api/connect/v1/graphql_handler.go

@@ -37,6 +37,7 @@ func NewGraphQLHandler(svc *iam.Service, logger *log.Logger, fileManagerSvc *fil
 			batchAuthorize: authz.NewBatchAuthorizeFunc(svc, logger),
 			logger:         logger,
 			iam:            svc,
+			scopeRegistry:  svc.OAuth2ScopeRegistry,
 			fileManager:    fileManagerSvc,
 			baseURL:        baseURL,
 			sessionCookie:  authn.NewCookie(&cookieConfig),

pkg/server/api/connect/v1/oauth2_access_token_resolvers.go

@@ -36,11 +36,10 @@ func (r *mutationResolver) CreateOAuth2AccessToken(ctx context.Context, input ty
 	tokenValue, accessToken, err := r.iam.OAuth2ServerService.CreateManualAccessToken(
 		ctx,
 		&oauth2.CreateManualAccessTokenRequest{
-			IdentityID:       identity.ID,
-			Name:             strings.TrimSpace(input.Name),
-			ExpiresAt:        input.ExpiresAt,
-			Scopes:           scopes,
-			AllowedAPIScopes: r.iam.OAuth2ScopeSet.APIScopes(),
+			IdentityID: identity.ID,
+			Name:       strings.TrimSpace(input.Name),
+			ExpiresAt:  input.ExpiresAt,
+			Scopes:     scopes,
 		},
 	)
 	if err != nil {

pkg/server/api/connect/v1/resolver.go

@@ -40,6 +40,7 @@ import (
 	"go.probo.inc/probo/pkg/filemanager"
 	"go.probo.inc/probo/pkg/gid"
 	"go.probo.inc/probo/pkg/iam"
+	"go.probo.inc/probo/pkg/iam/oauth2scope"
 	"go.probo.inc/probo/pkg/saferedirect"
 	"go.probo.inc/probo/pkg/securecookie"
 	"go.probo.inc/probo/pkg/server/api/authn"
@@ -53,6 +54,7 @@ type (
 		batchAuthorize authz.BatchAuthorizeFunc
 		logger         *log.Logger
 		iam            *iam.Service
+		scopeRegistry  *oauth2scope.Registry
 		fileManager    *filemanager.Service
 		baseURL        *baseurl.BaseURL
 		sessionCookie  *authn.Cookie

pkg/server/gqlutils/types/oauth2scope/scope.go

@@ -0,0 +1,43 @@
+// Copyright (c) 2026 Probo Inc <hello@probo.com>.
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+// PERFORMANCE OF THIS SOFTWARE.
+
+package oauth2scope
+
+import (
+	"fmt"
+	"io"
+	"strconv"
+
+	"github.com/99designs/gqlgen/graphql"
+	"go.probo.inc/probo/pkg/coredata"
+)
+
+type OAuth2ScopeScalar = coredata.OAuth2Scope
+
+func MarshalOAuth2ScopeScalar(s OAuth2ScopeScalar) graphql.Marshaler {
+	return graphql.WriterFunc(
+		func(w io.Writer) {
+			_, _ = w.Write([]byte(strconv.Quote(s.String())))
+		},
+	)
+}
+
+func UnmarshalOAuth2ScopeScalar(v any) (OAuth2ScopeScalar, error) {
+	s, ok := v.(string)
+	if !ok {
+		return "", fmt.Errorf("oauth2 scope must be a string")
+	}
+
+	return OAuth2ScopeScalar(s), nil
+}