feat(oidc): request configurable scopes incl. groups (admin gate)

src/intervalsicu_mcp_ui/app.py

@@ -40,7 +40,7 @@ def create_app(config: Config | None = None) -> FastAPI:
         server_metadata_url=f"{cfg.oidc_issuer}.well-known/openid-configuration",
         client_id=cfg.oidc_client_id,
         client_secret=cfg.oidc_client_secret,
-        client_kwargs={"scope": "openid email profile"},
+        client_kwargs={"scope": cfg.oidc_scopes},
     )
 
     app = FastAPI(title="Intervals.icu MCP portal")

src/intervalsicu_mcp_ui/config.py

@@ -16,6 +16,7 @@ class Config:
     session_secret: str
     admin_group: str
     intervals_api_base: str
+    oidc_scopes: str
 
 
 def load_config() -> Config:
@@ -28,4 +29,5 @@ def load_config() -> Config:
         session_secret=os.environ["SESSION_SECRET"],
         admin_group=os.environ.get("ADMIN_GROUP", "intervalsicu-mcp-admins"),
         intervals_api_base=os.environ.get("INTERVALS_API_BASE_URL", "https://intervals.icu/api/v1"),
+        oidc_scopes=os.environ.get("OIDC_SCOPES", "openid email profile groups"),
     )

tests/test_app.py

@@ -40,6 +40,7 @@ def app_url(tmp_path, monkeypatch):
         session_secret="x" * 32,
         admin_group="intervalsicu-mcp-admins",
         intervals_api_base="https://intervals.icu/api/v1",
+        oidc_scopes="openid email profile groups",
     )
     return appmod.create_app(cfg), url