Show missing OAuth scopes after connector reconnect

Partial grants completed without feedback, leaving Reconnect
required unexplained. Keep the token and toast the backend
missing-scopes error after the OAuth callback redirect.

Signed-off-by: Sacha Al Himdani <sacha@probo.com>

pkg/accessreview/errors.go

@@ -23,6 +23,7 @@ package accessreview
 import (
 	"errors"
 	"fmt"
+	"strings"
 
 	"go.probo.inc/probo/pkg/gid"
 )
@@ -34,6 +35,7 @@ var (
 	ErrCampaignNotPendingActions = errors.New("access review campaign not pending actions")
 	ErrCampaignCompleted         = errors.New("access review campaign completed")
 	ErrCampaignCancelled         = errors.New("access review campaign cancelled")
+	ErrMissingOAuthScopes        = errors.New("missing required OAuth scopes")
 )
 
 type (
@@ -60,6 +62,10 @@ type (
 	CampaignCancelledError struct {
 		CampaignID gid.GID
 	}
+
+	MissingOAuthScopesError struct {
+		Scopes []string
+	}
 )
 
 func NewCampaignMissingSourcesError(campaignID gid.GID) error {
@@ -142,3 +148,20 @@ func (e *CampaignCancelledError) Error() string {
 func (e *CampaignCancelledError) Is(target error) bool {
 	return target == ErrCampaignCancelled
 }
+
+func NewMissingOAuthScopesError(scopes []string) error {
+	return &MissingOAuthScopesError{Scopes: append([]string(nil), scopes...)}
+}
+
+func (e *MissingOAuthScopesError) Error() string {
+	display := make([]string, len(e.Scopes))
+	for i, scope := range e.Scopes {
+		display[i] = strings.TrimPrefix(scope, "https://graph.microsoft.com/")
+	}
+
+	return "Missing required OAuth scopes: " + strings.Join(display, ", ")
+}
+
+func (e *MissingOAuthScopesError) Is(target error) bool {
+	return target == ErrMissingOAuthScopes
+}