Add RFC 6750 WWW-Authenticate on OAuth bearer APIs

Introduce BearerChallengeMiddleware on MCP, Console and Connect GraphQL, Files, and OAuth2 userinfo. Call sites record challenge intent in context via NoteUnauthenticated, NoteInvalidToken, and NoteInsufficientScope; the middleware applies resource_metadata, invalid_token, and insufficient_scope on WriteHeader.

OAuth2 access token middleware flags rejected Bearer tokens for invalid_token challenges. Add Authorizer.ScopesForAction for the scope auth-param.

Signed-off-by: Ludovic Vielle <ludovic@probo.com>

pkg/iam/oauth2scope/registry.go

@@ -72,6 +72,13 @@ func (r *Registry) Allows(tokenScopes coredata.OAuth2Scopes, action string) bool
 	return slices.ContainsFunc(grantingScopes, tokenScopes.Contains)
 }
 
+func (r *Registry) ScopesForAction(action string) []coredata.OAuth2Scope {
+	r.mu.RLock()
+	defer r.mu.RUnlock()
+
+	return sortedScopes(r.invertedIndex[action])
+}
+
 func (r *Registry) ValidateScopes(scopes coredata.OAuth2Scopes) error {
 	r.mu.RLock()
 	defer r.mu.RUnlock()

pkg/iam/oauth2scope/registry_test.go

@@ -81,6 +81,30 @@ func TestRegistry_ValidateScopes(t *testing.T) {
 	assert.EqualError(t, err, "invalid scope: v1:unknown:read")
 }
 
+func TestRegistry_ScopesForAction(t *testing.T) {
+	t.Parallel()
+
+	const (
+		scopeV1OrgRead  = coredata.OAuth2Scope("v1:org:read")
+		scopeV1OrgWrite = coredata.OAuth2Scope("v1:org")
+	)
+
+	reg := oauth2scope.NewRegistry().Register(
+		map[coredata.OAuth2Scope][]string{
+			scopeV1OrgRead:  {"core:organization:get"},
+			scopeV1OrgWrite: {"core:organization:get", "core:organization:update"},
+		},
+	)
+
+	assert.Equal(
+		t,
+		[]coredata.OAuth2Scope{scopeV1OrgWrite, scopeV1OrgRead},
+		reg.ScopesForAction("core:organization:get"),
+	)
+	assert.Equal(t, []coredata.OAuth2Scope{scopeV1OrgWrite}, reg.ScopesForAction("core:organization:update"))
+	assert.Nil(t, reg.ScopesForAction("core:organization:delete"))
+}
+
 func TestRegistry_RegisteredScopes(t *testing.T) {
 	t.Parallel()