fix gateway loopback validation chains

apps/api/internal/auth/auth.go

@@ -40,6 +40,7 @@ type User struct {
 	APIKeySecret    string   `json:"apiKeySecret,omitempty"`
 	APIKeyName      string   `json:"apiKeyName,omitempty"`
 	APIKeyPrefix    string   `json:"apiKeyPrefix,omitempty"`
+	APIKeyScopes    []string `json:"apiKeyScopes,omitempty"`
 }
 
 type contextKey string
@@ -137,6 +138,7 @@ func (a *Authenticator) verifyJWT(tokenString string) (*User, error) {
 		APIKeySecret:    stringClaim(claims, "apiKeySecret"),
 		APIKeyName:      stringClaim(claims, "apiKeyName"),
 		APIKeyPrefix:    stringClaim(claims, "apiKeyPrefix"),
+		APIKeyScopes:    stringSliceClaim(claims, "apiKeyScopes"),
 	}
 	if user.Source == "" {
 		user.Source = "gateway"
@@ -167,6 +169,7 @@ func (a *Authenticator) SignJWT(user *User, ttl time.Duration) (string, error) {
 		"apiKeyId":        user.APIKeyID,
 		"apiKeyName":      user.APIKeyName,
 		"apiKeyPrefix":    user.APIKeyPrefix,
+		"apiKeyScopes":    user.APIKeyScopes,
 		"iat":             now.Unix(),
 		"exp":             now.Add(ttl).Unix(),
 	}