refactor(auth): declare each OAuth scope in a single list

[jpage-godaddy]

Summary

Each OAuth scope was declared in three places: a constant, a separate description-and-default table, and the login scope list derived from it. This replaces them with one declaration per scope.

declare_scopes! {
    permissions {
        default {
            /// Read the caller's registered applications
            APP_REGISTRY_READ => "apps.app-registry:read",
            ...
        }
        step_up {
            // Spends money.
            /// Register a domain
            DOMAINS_CREATE => "domains.domain:create",
            ...
        }
    }
    directives { ... }
}

• The /// line is the scope's description (what gddy auth scope shows) and its rustdoc.
• default scopes are requested at login; step_up scopes are requested only when a command that needs them runs.
• The macro generates the constants, ALL, DIRECTIVES, SCOPE_REGISTRY and DEFAULT_OAUTH_SCOPES (now a plain const instead of a LazyLock), so a scope can't exist without a description and a login policy.
• src/scopes.rs and src/scopes_cmd.rs move into a src/scopes/ module: declarations.rs (the list), declare.rs (the macro), command_tree.rs, auth_scope.rs (gddy auth scope) and tests.rs.
• docs/maintainers.md now points at the declarations file and states the default/step-up rule.

Behavior

The scopes, descriptions, default flags and login request order are unchanged (the 30 gddy auth scope entries were compared against main). The one visible difference: gddy auth scope lists default scopes first, then step-up scopes, then the OIDC directives, rather than grouping by product area.

Test plan

• cargo check --workspace
• cargo clippy --workspace -- -D warnings
• cargo test --workspace
• cargo fmt --check
• ./rust/scripts/check-module-size.sh

🤖 Generated with Claude Code

[Copilot]

🟢 Approval recommended

Static review found no blocking issues in the generated scope data, preserved consent policy, or updated command wiring.

0 open findings

What changed in this PR

Centralizes OAuth scope declarations in the CLI, preserving scope values, descriptions, login order, and consent policy.

Changes:

• Generates scope constants, registry entries, and login defaults from one declaration list.
• Splits scope handling into focused modules and updates command wiring.
• Updates tests and maintainer guidance; scope listings now group entries by login policy.

File	Description
rust/​src/​spec_cmd.rs	Updates the scope command reference.
rust/​src/​scopes/​tests.rs	Consolidates registry and login-policy checks.
rust/​src/​scopes/​mod.rs	Wires and exports scope modules.
rust/​src/​scopes/​declare.rs	Generates scope data through one macro.
rust/​src/​scopes/​declarations.rs	Defines scopes, descriptions, and login policies.
rust/​src/​scopes/​command_tree.rs	Houses command-to-scope and alias mappings.
rust/​src/​scopes/​auth_scope.rs	Houses scope listing and command tests.
rust/​src/​scopes.rs	Removes the superseded monolithic module.
rust/​src/​main.rs	Updates scope command registration.
rust/​src/​auth.rs	Uses the constant login-scope slice.
docs/​maintainers.md	Documents declarations and login-policy rules.

🧠 Review effort: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.