feat(cloud-auth): enforce public scopes

packages/cloud-platform/cloud/auth.py

@@ -6,11 +6,21 @@ from hmac import compare_digest
 from typing import Protocol, runtime_checkable
 
 
+TASKS_SUBMIT_SCOPE = "tasks:submit"
+TASKS_READ_SCOPE = "tasks:read"
+POOL_READ_SCOPE = "pool:read"
+PLUGINS_READ_SCOPE = "plugins:read"
+PLUGINS_ADMIN_SCOPE = "plugins:admin"
+
+
 @dataclass(frozen=True)
 class Principal:
     id: str = "anonymous"
     scopes: frozenset[str] = field(default_factory=frozenset)
 
+    def has_scope(self, scope: str) -> bool:
+        return "*" in self.scopes or scope in self.scopes
+
 
 @runtime_checkable
 class AuthProvider(Protocol):