Admin UI: proxy client Allowed scopes + mixed-case scope support

[rowan-stein]

User request

For proxy-mode OAuth clients, the admin UI currently hides the Allowed scopes editor. However, /oidc/authorize still validates requested scopes against client.allowedScopes, so proxy clients cannot add provider-specific scopes (e.g., LinkedIn scopes) and authorization fails with:

Client does not allow scopes: ...

Specification (research)

Root cause

• Client detail page (src/app/admin/clients/[clientId]/page.tsx) renders the scopes card only when client.oauthClientMode === "regular".
• Backend updates already support proxy clients:
  • updateClientScopesAction and updateClientAllowedScopes() have no oauthClientMode restriction.

Proposed fix (minimal)

• Render the Allowed scopes card for both regular and proxy clients on the client detail page.
• Update proxy-mode helper copy to avoid implying scopes can’t be configured.

Tests

• Update src/app/admin/clients/__tests__/client-detail.proxy.test.tsx to assert client-scopes-card is present for proxy clients.

Acceptance criteria

1. Proxy client detail page shows the Allowed scopes card.
2. Admin can add + save provider scopes (e.g., LinkedIn scopes) and they persist after refresh.
3. /oidc/authorize accepts scopes that are a subset of configured allowed scopes and continues to reject disallowed scopes (existing behavior).
4. Other local-only settings remain hidden in proxy mode (unchanged).

[rowan-stein]

Follow-up: preserve scope casing (LinkedIn mixed-case scopes)

A user reported that some providers (notably LinkedIn) require mixed-case scope values, e.g.

• r_member_profileAnalytics
• r_member_postAnalytics

Today, MockAuth forces scopes to lowercase:

• Admin UI UpdateClientScopesForm lowercases input
• Server normalizeScopes() lowercases and SCOPE_VALUE_PATTERN rejects A-Z

This breaks proxy/preauthorized flows that use client.allowedScopes to build upstream provider scope requests.

Proposed fix (extend this issue/PR #172):

• Update src/server/oidc/scopes.ts to:
  • allow uppercase in SCOPE_VALUE_PATTERN (^[A-Za-z0-9:_-]{1,64}$)
  • make normalizeScopes() trim-only (no .toLowerCase()), so scope handling is case-sensitive.
• Update admin scopes editor to stop lowercasing input and update displayed regex copy.
• Update/add tests to cover mixed-case scopes and enforce case-sensitive allowlist behavior.

(Emerson Gray findings; see internal thread.)