[rami-hatoum]

What this changes

A client names the scopes it may ask. A registered client under registered_clients may list scopes, the scopes it may ask at its issuers. A way is served by the first client at its issuer whose scopes cover the way's scope, every scope the way asks being one the client names; a client that names none covers every way, so nothing changes for a vendor with one client. Where several clients serve one issuer, each names its scopes, and a configuration with two clients at one issuer of which one names none is refused at that client's scopes, since the one naming none would serve every way the clients before it leave and a client after it never. An empty list is refused too: a client that may ask any scope leaves scopes out.

Auto's clients follow the same rule. The consent service lists each of its clients with the scopes it names, and a way takes Auto's client by coverage; a listed client without scopes covers every way, as before.

A connection renews with the client that got its tokens. A renewal or a revocation of a registered connection finds the client the connection names, by its id at its issuer, not the first at the issuer; a client no longer configured fails the call as a client gone, as before.

The self-host page registers a Google client per verification tier. Google verifies a project at the tier of its most demanding scope, and two scopes the five Workspace servers require are restricted, so their project goes through the restricted review with a yearly security assessment while the eight API providers' scopes are sensitive and need the justifications and the video alone. The page's table names each provider's tier; the steps say one project per tier an operator offers, both or one, with the scopes of that tier on its consent screen and one client per project; the registered_clients example shows the two clients with their scopes. The configuration page documents scopes and the two refusals.

Tests

• Two registered clients at one issuer with different scopes: a way covered by the second takes the second, a way neither covers is set up first, a way both cover takes the first; a client naming no scopes serves every way; the refusal of two clients at one issuer where one names none, at its path, in either order; an empty scopes refused.
• The service's listing with and without scopes, and a way taken from Auto's client by coverage; a listing whose scope is empty is unanswered.
• A renewal and a revocation of a registered connection with the client its id names while another client stands first at the issuer.
• The page's example read through the configuration gives two clients of nine scopes each, and the shipped entries take the first for the eight API providers and the second for the five Workspace servers.

Checklist

• The PR title is a conventional commit with a workspace scope, such as feat(reasoning): .... It becomes the squash commit and the changelog entry.
• pnpm check passes locally, with every file at 100% coverage.
• I've signed the Contributor License Agreement (the CLA bot asks on your first PR).