Fix Homebox OIDC invalid_scope error by allowing per-client extra scopes

_authelia_provision_oidc_client() hardcoded openid/profile/email as the
only scopes a registered client could ever request, but Homebox's own
Authelia integration needs 'groups' too — requesting it without it being
in the client's own scopes allowlist made Authelia reject every login
with invalid_scope, even though the server supports 'groups' generally.

Add an EXTRA_SCOPES positional arg (space-separated, right after
REQUIRE_PKCE) that only Homebox's caller populates ("groups"); every
other existing caller passes "" and gets a byte-for-byte unchanged
client registration.

services/authelia.sh

@@ -2985,7 +2985,13 @@ _authelia_remove_oidc_client() {
 # Guard every cross-file call with `declare -F` per this repo's chaining
 # convention (services/gitea.sh does).
 #
-# Args: APP_NAME CLIENT_ID AUTH_POLICY RESTART_AUTH(y/n) <redirect_uri> [<redirect_uri> ...]
+# Args: APP_NAME CLIENT_ID AUTH_POLICY RESTART_AUTH(y/n) REQUIRE_PKCE(y/n) EXTRA_SCOPES <redirect_uri> [<redirect_uri> ...]
+#   EXTRA_SCOPES — space-separated scope names to add on top of the
+#   always-included openid/profile/email (e.g. "groups" for an app whose own
+#   OIDC settings request group membership, like Homebox). Pass "" when the
+#   app only needs the three defaults — every existing caller before this
+#   parameter was added does exactly that, so their registered client is
+#   byte-for-byte unchanged.
 # Out-params (not `local` — read them after the call returns):
 #   OIDC_CLIENT_SECRET_PLAIN   the plaintext secret. Shown once — Authelia's
 #                              config only ever stores the hash — so the
@@ -3010,7 +3016,7 @@ _authelia_remove_oidc_client() {
 # that's already registered is NOT a failure — it gets replaced (see the
 # comment at that check below).
 _authelia_provision_oidc_client() {
-    local APP_NAME="$1" CLIENT_ID="$2" AUTH_POLICY="$3" RESTART_AUTH="$4" REQUIRE_PKCE="$5"; shift 5
+    local APP_NAME="$1" CLIENT_ID="$2" AUTH_POLICY="$3" RESTART_AUTH="$4" REQUIRE_PKCE="$5" EXTRA_SCOPES="$6"; shift 6
     local -a REDIRECT_URIS=("$@")
 
     OIDC_CLIENT_SECRET_PLAIN=""
@@ -3121,6 +3127,19 @@ _authelia_provision_oidc_client() {
         pkce_challenge_method: 'S256'"
     fi
 
+    # EXTRA_SCOPES is space-separated (e.g. "groups") and additive to the
+    # three always-included scopes below — Authelia rejects a callback
+    # requesting any scope not in this exact per-client allowlist, even one
+    # the server otherwise supports (confirmed live: Homebox's own
+    # HBOX_OIDC_SCOPE=openid profile email groups was rejected with
+    # invalid_scope until 'groups' was added here too).
+    local EXTRA_SCOPES_YAML=""
+    local _scope
+    for _scope in $EXTRA_SCOPES; do
+        EXTRA_SCOPES_YAML="${EXTRA_SCOPES_YAML}
+          - '${_scope}'"
+    done
+
     local CLIENT_BLOCK="      - client_id: '${CLIENT_ID}'
         client_name: '${APP_NAME}'
         client_secret: '${CLIENT_SECRET_HASH}'
@@ -3131,7 +3150,7 @@ ${REDIRECT_URIS_YAML}
         scopes:
           - 'openid'
           - 'profile'
-          - 'email'
+          - 'email'${EXTRA_SCOPES_YAML}
         grant_types:
           - 'authorization_code'
         response_types:
@@ -3287,7 +3306,7 @@ _authelia_add_oidc_client() {
     local RESTART_AUTH=""
     prompt_yn "  Restart Authelia to apply? (y/n):" "y" RESTART_AUTH
 
-    _authelia_provision_oidc_client "$APP_NAME" "$CLIENT_ID" "$AUTH_POLICY" "$RESTART_AUTH" "$REQUIRE_PKCE" "${REDIRECT_URIS[@]}" \
+    _authelia_provision_oidc_client "$APP_NAME" "$CLIENT_ID" "$AUTH_POLICY" "$RESTART_AUTH" "$REQUIRE_PKCE" "" "${REDIRECT_URIS[@]}" \
         || return 1
     local CLIENT_SECRET_PLAIN="$OIDC_CLIENT_SECRET_PLAIN"