feat(32.1-02): expand OAuth MCP scopes from the published catalog

- Publish the compiled member-token catalog as pact.MemberTokenScopeCatalog
- Imply declared names only when the MCP subject has a ClientID
- Reject a bad Implies and the reserved names backend and offline_access

classes/api_token_scopes.go

@@ -15,23 +15,29 @@ import (
 // a built-in (read, write, ai) or one a plugin declared through
 // pact.HasFrontendTokenScopes. Label and Description are phrase keys
 // (containing "::") or literal text; PluginID is the declaring plugin, empty
-// for a built-in.
+// for a built-in. Implies is empty on a built-in. On a declared scope it is
+// empty, read, or write: an OAuth MCP grant of that stock scope also
+// satisfies the declared name. The name is not stored on the grant.
 type APITokenScope struct {
 	Name        string
 	Label       string
 	Description string
 	PluginID    string
 	BuiltIn     bool
+	Implies     string
 }
 
 // APITokenScopeCatalog is the compiled list of member token scopes of one
 // application: the built-ins first, then the declared scopes in activation
-// order. Boot publishes it; APITokenScopesFor reads it.
+// order. Boot publishes it, and the same value as pact.MemberTokenScopeCatalog.
+// APITokenScopesFor reads the concrete catalog.
 type APITokenScopeCatalog struct {
 	scopes []APITokenScope
 	byName map[string]int
 }
 
+var _ pact.MemberTokenScopeCatalog = (*APITokenScopeCatalog)(nil)
+
 // Scopes returns a copy of the catalog, built-ins first.
 func (c *APITokenScopeCatalog) Scopes() []APITokenScope {
 	if c == nil {
@@ -49,6 +55,23 @@ func (c *APITokenScopeCatalog) Allowed(name string) bool {
 	return ok
 }
 
+// MemberTokenScopes returns the compiled list as pact scopes, built-ins
+// first, then declared scopes. Implied names are not a separate entry: they
+// are the Implies field of the declared scope.
+func (c *APITokenScopeCatalog) MemberTokenScopes() []pact.FrontendTokenScope {
+	scopes := c.Scopes()
+	out := make([]pact.FrontendTokenScope, 0, len(scopes))
+	for _, scope := range scopes {
+		out = append(out, pact.FrontendTokenScope{
+			Name:        scope.Name,
+			Label:       scope.Label,
+			Description: scope.Description,
+			Implies:     scope.Implies,
+		})
+	}
+	return out
+}
+
 // builtInAPITokenScopeKeys are the label and description phrase keys of
 // the built-in scopes, in AllowedAPITokenScopes order.
 var builtInAPITokenScopeKeys = map[string][2]string{
@@ -78,12 +101,14 @@ func newAPITokenScopeCatalog(scopes []APITokenScope) *APITokenScopeCatalog {
 // CompileAPITokenScopes builds the member token scope catalog from the
 // built-ins and every plugin that implements pact.HasFrontendTokenScopes, in
 // the order given (party.Activated). A declared name is trimmed and must
-// pass pact.ValidTokenScopeName, must not be a built-in (read, write, ai)
-// and must not repeat a name another plugin (or the same one) declared; its
-// label and description must not be empty. Any violation is an error, which
-// fails boot. Phrase keys are checked against the translator by Boot. Every
-// name of a catalog that compiles is added to the process-wide set the
-// legacy MintAPIToken accepts.
+// pass pact.ValidTokenScopeName, must not be a built-in (read, write, ai),
+// must not be the reserved name backend or offline_access, and must not
+// repeat a name another plugin (or the same one) declared; its label and
+// description must not be empty, and Implies must be empty, read, or write.
+// Built-ins keep Implies empty. Any violation is an error, which fails boot.
+// Phrase keys are checked against the translator by Boot. Every name of a
+// catalog that compiles is added to the process-wide set the legacy
+// MintAPIToken accepts.
 func CompileAPITokenScopes(plugins []party.Plugin) (*APITokenScopeCatalog, error) {
 	scopes := builtInAPITokenScopes()
 	owner := map[string]string{}
@@ -111,14 +136,22 @@ func CompileAPITokenScopes(plugins []party.Plugin) (*APITokenScopeCatalog, error
 				}
 				return nil, fmt.Errorf("golem15.user: duplicate member token scope %q declared by %s and %s", name, other, id)
 			}
+			if name == "backend" || name == "offline_access" {
+				return nil, fmt.Errorf("golem15.user: plugin %s declared the reserved member token scope %q", id, name)
+			}
 			if strings.TrimSpace(scope.Label) == "" {
 				return nil, fmt.Errorf("golem15.user: plugin %s member token scope %s has an empty label", id, name)
 			}
 			if strings.TrimSpace(scope.Description) == "" {
 				return nil, fmt.Errorf("golem15.user: plugin %s member token scope %s has an empty description", id, name)
 			}
+			if scope.Implies != "" && scope.Implies != "read" && scope.Implies != "write" {
+				return nil, fmt.Errorf("golem15.user: plugin %s member token scope %s has implies %q", id, name, scope.Implies)
+			}
 			owner[name] = id
-			scopes = append(scopes, APITokenScope{Name: name, Label: scope.Label, Description: scope.Description, PluginID: id})
+			scopes = append(scopes, APITokenScope{
+				Name: name, Label: scope.Label, Description: scope.Description, PluginID: id, Implies: scope.Implies,
+			})
 			declared = append(declared, name)
 		}
 	}

classes/mcp_guard.go

@@ -84,12 +84,16 @@ func (g *MCPUserGuard) MCPRequirements(middleware []string) (pact.MCPRequirement
 	return req, nil
 }
 
-// MCPAllows requires every scope of req in the subject's scopes, then every
-// permission code of req and of the tool, one by one (the route runs one
-// user.permission middleware per code), granted to the user's groups.
+// MCPAllows requires every scope of req in the subject's effective scopes,
+// then every permission code of req and of the tool, one by one (the route
+// runs one user.permission middleware per code), granted to the user's
+// groups. Effective scopes are the grant itself for a personal token, and
+// for an OAuth subject also the declared names the catalog implies. The
+// expanded list is not written back onto the subject.
 func (g *MCPUserGuard) MCPAllows(ctx context.Context, subject pact.MCPSubject, req pact.MCPRequirements, permissions []string) (bool, error) {
+	scopes := g.mcpEffectiveScopes(subject)
 	for _, scope := range req.Scopes {
-		if !slices.Contains(subject.Scopes, scope) {
+		if !slices.Contains(scopes, scope) {
 			return false, nil
 		}
 	}
@@ -114,13 +118,16 @@ func (g *MCPUserGuard) MCPAllows(ctx context.Context, subject pact.MCPSubject, r
 
 // MCPDispatch builds the principal (the user with the group grants, as the
 // api_token guard loads it) and an in-memory token credential carrying the
-// session's scopes, so user.scope sees what the session was granted. For a
-// personal-token subject (ClientID empty) the credential's ID is the
-// subject's TokenID, the user_api_tokens row the session was opened with, so
-// a handler can record which token made a change; an OAuth subject's TokenID
-// is the OAuth server's own token row, not one of this plugin's, and its
-// credential keeps ID 0. The credential is never saved. The marker is
-// honoured by the api_token guard only.
+// subject's effective scopes, so user.scope sees what the session may call.
+// For an OAuth subject that includes declared names the catalog marks as
+// implied by a stock scope the grant holds; a personal token's scopes are
+// the grant unchanged. For a personal-token subject (ClientID empty) the
+// credential's ID is the subject's TokenID, the user_api_tokens row the
+// session was opened with, so a handler can record which token made a
+// change; an OAuth subject's TokenID is the OAuth server's own token row,
+// not one of this plugin's, and its credential keeps ID 0. The credential
+// is never saved, and implied names are not written onto a token row or
+// onto subject.Scopes. The marker is honoured by the api_token guard only.
 func (g *MCPUserGuard) MCPDispatch(ctx context.Context, subject pact.MCPSubject, _ string) (pact.MCPDispatch, error) {
 	db, err := g.db()
 	if err != nil {
@@ -135,7 +142,7 @@ func (g *MCPUserGuard) MCPDispatch(ctx context.Context, subject pact.MCPSubject,
 	}
 	credential := &models.APIToken{
 		UserID: subject.UserID,
-		Scopes: lagoon.Jsonable[[]string]{Data: slices.Clone(subject.Scopes), Valid: true},
+		Scopes: lagoon.Jsonable[[]string]{Data: g.mcpEffectiveScopes(subject), Valid: true},
 	}
 	if subject.ClientID == "" {
 		credential.ID = subject.TokenID
@@ -143,6 +150,30 @@ func (g *MCPUserGuard) MCPDispatch(ctx context.Context, subject pact.MCPSubject,
 	return pact.MCPDispatch{Principal: principal, Credential: credential, Guards: []string{"api_token"}}, nil
 }
 
+// mcpEffectiveScopes is the scope list MCPAllows and MCPDispatch share.
+// A personal token (ClientID empty) is returned unchanged: the same slice,
+// with no declared name added. An OAuth subject gets a clone of its grant
+// plus each catalog name whose Implies is read or write, when the clone
+// holds that stock scope and not the name. write does not satisfy Implies
+// read. Nothing the catalog does not mark is appended. The clone is not
+// written back onto subject.Scopes, a token row, or a fingerprint.
+func (g *MCPUserGuard) mcpEffectiveScopes(subject pact.MCPSubject) []string {
+	if subject.ClientID == "" {
+		return subject.Scopes
+	}
+	scopes := slices.Clone(subject.Scopes)
+	for _, entry := range APITokenScopesFor(g.app()).MemberTokenScopes() {
+		if entry.Implies != "read" && entry.Implies != "write" {
+			continue
+		}
+		if entry.Name == "" || slices.Contains(scopes, entry.Name) || !slices.Contains(scopes, entry.Implies) {
+			continue
+		}
+		scopes = append(scopes, entry.Name)
+	}
+	return scopes
+}
+
 // MCPResolvePersonalToken resolves a personal API token of this plugin into
 // an MCP subject with the token's own scopes. A token without the configured
 // prefix answers false; one with it that is unknown, revoked, expired or