refactor: restructure PAT scopes to use role-resource type pairing

Makefile

@@ -4,7 +4,7 @@ TAG := $(shell git rev-list --tags --max-count=1)
 VERSION := $(shell git describe --tags ${TAG})
 .PHONY: build check fmt lint test test-race vet test-cover-html help install proto admin-app compose-up-dev
 .DEFAULT_GOAL := build
-PROTON_COMMIT := "dcca57385227df0690df54d66f73b3baacfc580d"
+PROTON_COMMIT := "9c069b5e749972014da7784f5c3802745a6e903e"
 
 admin-app:
 	@echo " > generating admin build"

core/userpat/errors/errors.go

@@ -14,5 +14,6 @@ var (
 	ErrExpiryInPast     = errors.New("expiry must be in the future")
 	ErrDeniedRole       = errors.New("one or more requested roles not permissible for personal access tokens")
 	ErrUnsupportedScope = errors.New("role scope is not supported for personal access tokens")
+	ErrScopeMismatch    = errors.New("role does not support the specified scope")
 	ErrRoleNotFound     = errors.New("one or more requested roles do not exist")
 )

core/userpat/models/pat.go

@@ -7,15 +7,21 @@ import (
 	"github.com/raystack/frontier/pkg/utils"
 )
 
+// PATScope pairs a role with its resource type and optional resource IDs.
+type PATScope struct {
+	RoleID       string   // role UUID
+	ResourceType string   // schema.OrganizationNamespace ("app/organization") or schema.ProjectNamespace ("app/project")
+	ResourceIDs  []string // specific resource UUIDs; empty = all resources in scope
+}
+
 type PAT struct {
 	ID         string `rql:"name=id,type=string"`
 	UserID     string `rql:"name=user_id,type=string"`
 	OrgID      string `rql:"name=org_id,type=string"`
 	Title      string `rql:"name=title,type=string"`
 	SecretHash string `json:"-"`
 	Metadata   metadata.Metadata
-	RoleIDs    []string   `json:"role_ids,omitempty"`
-	ProjectIDs []string   `json:"project_ids,omitempty"`
+	Scopes     []PATScope
 	LastUsedAt *time.Time `rql:"name=last_used_at,type=datetime"` // last_used_at can be null
 	ExpiresAt  time.Time  `rql:"name=expires_at,type=datetime"`
 	CreatedAt  time.Time  `rql:"name=created_at,type=datetime"`