authkit: initial shared auth module

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

scopes.go

@@ -0,0 +1,58 @@
+package authkit
+
+import "strings"
+
+const (
+	ScopeUserRead         = "user:read"
+	ScopeUserWrite        = "user:write"
+	ScopeUserStats        = "user:stats"
+	ScopeUserPassword     = "user:password"
+	ScopeLoginManage      = "login:manage"
+	ScopeLoginRequest     = "login:request"
+	ScopeKick             = "kick"
+	ScopePlayerDisconnect = "player:disconnect"
+	ScopeEventsPublish    = "events:publish"
+	ScopeEventsSubscribe  = "events:subscribe"
+	ScopeServerRead       = "server:read"
+	ScopeServerState      = "server:state"
+	ScopeKeysProvision    = "keys:provision"
+	ScopeKeysRead         = "keys:read"
+)
+
+var defaultScopes = map[string][]string{
+	"bot":            {"user:*", "login:manage", "kick", "events:subscribe", "keys:read"},
+	"server-manager": {"events:publish", "keys:provision", "keys:read"},
+	"portal":         {"user:read", "server:read"},
+	"gate-waker":     {"user:read", "server:read"},
+	"addon":          {"user:read", "user:stats", "server:read", "player:disconnect", "login:request", "events:subscribe"},
+	"mc-wrapper":     {"user:read", "server:read", "server:state", "events:subscribe"},
+}
+
+// DefaultScopes returns the canonical scope set for a service, or nil for unknown.
+func DefaultScopes(service string) []string {
+	s, ok := defaultScopes[service]
+	if !ok {
+		return nil
+	}
+	out := make([]string, len(s))
+	copy(out, s)
+	return out
+}
+
+// HasScope reports whether want is satisfied by the scopes slice.
+// A granted scope ending in "*" matches any want sharing the same prefix
+// (e.g. "user:*" matches "user:read").
+func HasScope(scopes []string, want string) bool {
+	for _, g := range scopes {
+		if g == want {
+			return true
+		}
+		if strings.HasSuffix(g, "*") {
+			pfx := g[:len(g)-1]
+			if strings.HasPrefix(want, pfx) {
+				return true
+			}
+		}
+	}
+	return false
+}