fix: unrecognized scopes can no longer fail PAR

Signed-off-by: Trezy <tre@trezy.com>

frontend/src/locales/en.json

@@ -607,6 +607,7 @@
       "unavailablePermissions": "Unavailable permissions",
       "unavailableLimited": "Limited by delegation",
       "unavailableFailed": "Failed to load",
+      "unavailableRejected": "Not granted",
       "setPartiallyLimited": "Some permissions in this bundle are limited by your delegation; see \"Unavailable Permissions\" to find out which permissions weren't allowed.",
       "setFailureReason": {
         "not_found": "This bundle could not be found and cannot be granted.",
@@ -617,6 +618,11 @@
         "empty_permissions": "This bundle does not currently grant any permissions.",
         "unknown": "This bundle cannot be granted."
       },
+      "scopeRejectionReason": {
+        "unrecognized": "This server does not recognize this permission, so it cannot be granted.",
+        "not_registered": "The application did not register this permission, so it cannot be granted.",
+        "unknown": "This permission cannot be granted."
+      },
       "permTable": {
         "data": "Data",
         "create": "Create",

frontend/src/routes/OAuthConsent.svelte

@@ -69,12 +69,27 @@
     return known[reason] ?? 'oauth.consent.setFailureReason.unknown'
   }
 
+  const SCOPE_REJECTION_LOCALE_KEYS = {
+    unrecognized: 'oauth.consent.scopeRejectionReason.unrecognized',
+    not_registered: 'oauth.consent.scopeRejectionReason.not_registered',
+  }
+
+  function scopeRejectionLocaleKey(reason: string): string {
+    const known: Partial<Record<string, string>> = SCOPE_REJECTION_LOCALE_KEYS
+    return known[reason] ?? 'oauth.consent.scopeRejectionReason.unknown'
+  }
+
   interface FailedSetInfo {
     nsid: string
     aud?: string
     reason: string
   }
 
+  interface RejectedScopeInfo {
+    scope: string
+    reason: string
+  }
+
   interface ConsentData {
     request_uri: string
     client_id: string
@@ -85,6 +100,7 @@
     permission_sets: PermissionSetInfo[]
     transition_supersedes?: boolean
     failed_sets: FailedSetInfo[]
+    rejected_scopes: RejectedScopeInfo[]
     show_consent: boolean
     did: string
     handle?: string
@@ -336,8 +352,12 @@
     consentData ? (consentData.permission_sets ?? []).filter(s => s.expanded.some(e => e.restricted)) : []
   )
   let failedSets = $derived(consentData?.failed_sets ?? [])
+  let rejectedScopes = $derived(consentData?.rejected_scopes ?? [])
   let hasUnavailable = $derived(
-    restrictedScopes.length > 0 || limitedBundles.length > 0 || failedSets.length > 0
+    restrictedScopes.length > 0 ||
+      limitedBundles.length > 0 ||
+      failedSets.length > 0 ||
+      rejectedScopes.length > 0
   )
 
   let hasGranularScopes = $derived(
@@ -652,6 +672,18 @@
                   </div>
                 {/each}
               {/if}
+
+              {#if rejectedScopes.length}
+                <p class="unavailable-subhead">{$_('oauth.consent.unavailableRejected')}</p>
+                {#each rejectedScopes as r}
+                  <div class="scope-item failed">
+                    <div class="scope-info">
+                      <span class="scope-name scope-raw">{r.scope}</span>
+                      <span class="scope-description">{$_(scopeRejectionLocaleKey(r.reason))}</span>
+                    </div>
+                  </div>
+                {/each}
+              {/if}
             </div>
           {/if}
         </div>

frontend/src/tests/OAuthConsentSupersede.test.ts

@@ -65,6 +65,7 @@ const consentPayload = {
   ],
   permission_sets: [],
   failed_sets: [],
+  rejected_scopes: [],
   show_consent: true,
   did: "did:plc:example",
 };