RequireAuthMiddleware built its 401/403 WWW-Authenticate challenges with
error/error_description (and optional resource_metadata) but never the
scope attribute, even though required_scopes is configured on the
middleware instance. Clients therefore could not discover the required
scopes from the challenge: the SDK client reads scope from
WWW-Authenticate as the highest-priority source both for initial
authorization (401) and for SEP-2350 step-up on 403 insufficient_scope,
so that path was always empty and fell back to protected resource
metadata scopes_supported.
Emit scope="<space-delimited required_scopes>" whenever required_scopes
is non-empty, per RFC 6750 section 3 (section 3.1 for the
insufficient_scope case).
Fixes#3103
Claude
4ff2ab8e54