Add scope override for Azure Entra OAuth SASL config

[Waleed2660]

Summary

Hi @mostafa, hope you're doing well!

I've added an optional scope field to SASLConfig so we can override the OAuth scope/audience requested for sasl_azure_entra. Currently the scope is always derived from the broker hostname https://<broker-host>/.default, which doesn't work for setups where the token is tied to an Azure App ID e.g. api://<app-id>/.default rather than the broker's connection endpoint. Hence, auth fails with no workaround.

When scope is left empty, the existing hostname-derived behaviour is unchanged.

---

We've tested my fork with Azure & it worked with our custom scope.

---

Note: I haven't regenerated api-docs/ to keep this diff focused, happy to generate docs if you'd like that included in this PR.

[tnewman]

@mostafa can you take a look?

[mostafa]

Review

This is a real gap and the approach is right: optional SASLConfig.scope for sasl_azure_entra, hostname-derived https://<host>/.default when empty. Default behavior stays the same, and the unit tests cover both paths.

Workflows were waiting on first-time-contributor approval. I approved them; Test xk6-kafka, lint-pr, and zizmor are queued.

Blocking

1. Public JS API docs are missing. scope is a user-facing SASLConfig field, and the FAQ already links to api-docs/v2/docs/interfaces/SASLConfig.md, which will not list it. Please add scope?: string to api-docs/index.d.ts and regenerate (yarn --cwd api-docs run generate-docs:v2). CI's check-docs:v2 will not catch this if index.d.ts is left unchanged.

2. FAQ overstates GCP support. The new FAQ says the override helps "Azure Entra OAuth (or GCP OAuth)", but scope is only threaded into newAzureEntraOAuthTokenProvider. GCP still uses a hardcoded https://www.googleapis.com/auth/cloud-platform. Please drop the GCP mention (or implement a GCP override separately).

Non-blocking

• Wiring scope as a new positional arg on NewOAuthProvider(algorithm, scope, brokers, opts) works. Putting it on OAuthProviderOpts would keep the constructor smaller as more providers grow options.
• scope == "" does not trim whitespace. " " would be sent as the Azure scope. Fine unless you want strings.TrimSpace.
• GitHub reports the PR as mergeable onto current main (Kerberos/GCP). Worth a rebase if CI merge produces a conflict in oauth.go / auth.go.

After docs + FAQ wording this looks good to merge.

[Waleed2660]

Thanks for looking into this @mostafa. I've added the missing Docs & updated to FAQ to clarify that custom scope is only supported for Azure at the moment.

[mostafa]

@Waleed2660 Please fix the failing test/lint.

[Waleed2660]

@mostafa I've pushed the fix now.

[mostafa]

LGTM! Thank you for your contribution.