feat: add scopes (CM-1333)

[ulemons]

Summary

Adds support for the new "Akrites Enclave" Auth0 M2M client on the akrites-external
public API. The Akrites program is moving from the old Self Serve client to a
dedicated client with its own scopes (read:akrites-packages,
read:akrites-advisories, read:akrites-maintainers), but their consumer hasn't
cut over yet, so both the new dedicated scopes and the old Self Serve scopes are
accepted in parallel until the migration completes.

Changes

• Added 3 new scope constants to backend/src/security/scopes.ts: READ_AKRITES_PACKAGES,
  READ_AKRITES_ADVISORIES, READ_AKRITES_MAINTAINERS.
• Updated every sub-router in akrites-external/index.ts (packages, advisories,
  contacts, blast-radius) to accept either the new dedicated scope or the old
  Self Serve scope(s) via requireScopes([...], 'any').
• The packages endpoint previously required read:packages AND read:stewardships
  together ('all' mode); this is intentionally loosened to a flat 'any' across
  all three scopes for now, since the old scopes will be dropped entirely once
  Akrites' client cuts over — matches the pattern already used for the other
  endpoint groups.
• Extracted a shared advisoriesScopes const (advisories and blast-radius use the
  identical scope list) to avoid duplicating the array, mirroring the existing
  contactsScopes pattern.
• Updated openapi.yaml to document both the dedicated and fallback scopes on
  every affected operation, tag description, and 403 response.
• Old scopes (READ_PACKAGES, READ_STEWARDSHIPS, READ_MAINTAINER_ROLES) are
  temporary here — drop them once Akrites' consumer migrates to the new client.

Type of change

• Bug fix
• New feature
• Refactor / cleanup
• Performance improvement
• Chore / dependency update
• Documentation

JIRA ticket

CM-1333

[cursor]

PR Summary

Medium Risk
Changes authorization on a public M2M API (including contact PII); packages access is intentionally loosened from requiring two scopes to any one of three until cutover.

Overview
Adds dedicated Akrites Enclave Auth0 scopes (read:akrites-packages, read:akrites-advisories, read:akrites-maintainers) and wires them into the akrites-external public API alongside the existing Self Serve scopes until Akrites finishes client cutover.

Router behavior: Every sub-router now uses requireScopes(..., 'any') so a token with either the new scope or the legacy fallback is accepted. Packages moves from requiring both read:packages and read:stewardships to any of read:akrites-packages, read:packages, or read:stewardships. Advisories and blast-radius share a new advisoriesScopes list (read:akrites-advisories or read:packages). Contacts accept read:akrites-maintainers or read:maintainer-roles (still not package scopes). Comments note dropping legacy scopes after migration.

Contract: openapi.yaml documents the dual-scope model on global security, tag descriptions, OAuth scope definitions, per-operation security blocks, and 403 messages.

^{Reviewed by Cursor Bugbot for commit 2d2a567. Bugbot is set up for automated code reviews on this repo. Configure here.}

[Copilot]

Pull request overview

Adds dedicated Auth0 M2M scopes for Akrites while temporarily retaining Self Serve scope compatibility.

Changes:

• Defines three Akrites-specific scopes.
• Applies alternative scope authorization across Akrites endpoints.
• Updates the OpenAPI security contract.

Required metadata fix: Update the incomplete title to feat: add Akrites M2M scopes (CM-1333).

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated no comments.

File	Description
backend/src/security/scopes.ts	Adds Akrites scope constants.
backend/src/api/public/v1/akrites-external/index.ts	Updates endpoint scope authorization.
backend/src/api/public/v1/akrites-external/openapi.yaml	Documents dedicated and fallback scopes.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated 1 comment.

Comments suppressed due to low confidence (1)

backend/src/api/public/v1/akrites-external/openapi.yaml:25

• This says all three legacy scopes work on every operation, but the operation-level requirements are intentionally separated: read:packages does not authorize Contacts, and read:maintainer-roles does not authorize Packages or Advisories. Rephrase this as operation-specific fallbacks so the API-level description does not contradict the requirements below.

    scopes. Until Akrites cuts over to that client's credentials, the Self Serve
    client's existing scopes (read:packages, read:stewardships,
    read:maintainer-roles) still work on every operation below — each operation
    lists both the new dedicated scope(s) and the old fallback scope(s) as
    alternatives. Drop the old alternative once the cutover is confirmed.