Report required scope in authorization failures

app/security/middleware.py

@@ -52,6 +52,7 @@ class APIKeyAuthenticationMiddleware(BaseHTTPMiddleware):
         context_token = None
         http_auth_token = None
         response_code = 500
+        required_scope: str | None = None
         bytes_uploaded = self._content_length(request.headers.get("content-length"))
         bytes_downloaded = 0
         try:
@@ -140,7 +141,8 @@ class APIKeyAuthenticationMiddleware(BaseHTTPMiddleware):
             )
         except ForbiddenError:
             response_code = 403
-            response = self._error(403, "Forbidden", "Missing required scope.", request)
+            detail = f"Missing required scope: {required_scope}." if required_scope else "Workspace identity or membership authorization was denied."
+            response = self._error(403, "Forbidden", detail, request)
             bytes_downloaded = len(response.body)
             return response
         except RateLimitError as exc: