[PM-44796] feat: Require scoped policies on the Admin Console public API

[withinfocus]

🎟️ Tracking

PM-44796, part of epic PM-28993. Third of nine stacked PRs.

📔 Objective

Moves the public Members, Groups, Collections, Policies and import endpoints to scoped policies, and limits scoped keys to members with the User role.

• Reads take the read scope and writes the write scope. PUT public/policies/{type} stays on the legacy policy. Import needs both members write and groups write.
• The threat model found that the public API acts as a system user, and system users skip role checks, so a members write key could have made anyone an Owner. With a scoped key, Core now rejects inviting or changing anyone to a role other than User and acting on Owner, Admin or Custom members. That covers update, invite, revoke, remove, restore and reinvite.
• A scoped key also can't change the group membership of Owner, Admin or Custom members. PUT public/members/{id}/group-ids, group create and update, PUT public/groups/{id}/member-ids and deleting a group that contains one are rejected. A group can keep elevated members it already has while Users are added or removed. Group member-ids and delete write straight to the repository today, so the controller calls the Core validator before writing; routing them through the group commands would add events and checks the legacy key doesn't have.
• Import with a scoped key skips members who aren't User when removing, linking or syncing groups, the same way it already skips Owners.
• ICurrentContext.IsScopedOrganizationApiKey tells Core a scoped key is acting. It's true only for the scoped client ID shape, organization.{organizationId}.{keyId}, so legacy keys and the SCIM principal (organization.{organizationId} with api.scim) are unaffected. The commands read it directly, so enforcement doesn't depend on each controller passing the right actor.
• The SCIM integration test factory now builds the same principal as the real SCIM authentication handler. Before, it built a different one, so no SCIM test could have caught a change like this. New tests deprovision an Admin through SCIM.
• The legacy key behaves as before.

[github-actions]

🤖 Bitwarden Claude Code Review

Overall Assessment: APPROVE

This PR replaces the class-level Organization policy on the public Members, Groups, Collections, Policies and import endpoints with per-action read and write scoped policies. It also uses ICurrentContext.IsScopedOrganizationApiKey to restrict scoped keys to members with the User role. I checked that every write path enforces that restriction in Core: invite, the role check in UpdateOrganizationUserValidator, revoke, remove, restore, reinvite and member group updates. ScopedApiKeyGroupMemberValidator is applied to group create, update, PUT member-ids and delete. The latest commit switches the import removal filter to TryGetValue. Scoped-key import still leaves elevated members alone when removing, overwriting, linking by email and syncing groups. No findings met the bar for an inline comment.

[codecov]

Codecov Report

❌ Patch coverage is 99.10714% with 1 line in your changes missing coverage. Please review.
✅ Project coverage is 66.96%. Comparing base (3bcd7e4) to head (9a458b6).

Files with missing lines	Patch %	Lines
...dminConsole/Public/Controllers/GroupsController.cs	90.00%	0 Missing and 1 partial ⚠️

Additional details and impacted files

@@                       Coverage Diff                        @@
##           arch/pm-44795/org-api-scopes    #8564      +/-   ##
================================================================
+ Coverage                         66.86%   66.96%   +0.09%     
================================================================
  Files                              2591     2593       +2     
  Lines                            111158   111258     +100     
  Branches                          10123    10144      +21     
================================================================
+ Hits                              74328    74505     +177     
+ Misses                            34350    34271      -79     
- Partials                           2480     2482       +2     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.