Authorize SMS with operations scope

app/security/policy.py

@@ -45,9 +45,10 @@ class ScopePolicy:
             return "assets:write"
         if path.startswith("/v1/media/") and method == "GET":
             return "operations:read"
-        if path.startswith(
-            ("/v1/video", "/v1/audio", "/v1/image", "/v1/whisper", "/v1/ytdlp", "/v1/diarization")
-        ) or path == "/v1/probe":
+        if path.startswith((
+            "/v1/video", "/v1/audio", "/v1/image", "/v1/whisper",
+            "/v1/ytdlp", "/v1/diarization", "/v1/sms"
+        )) or path == "/v1/probe":
             return "operations:execute"
         if method == "GET":
             return "system:read"
@@ -72,18 +73,11 @@ class ScopePolicy:
     @staticmethod
     def is_job(required_scope: str | None) -> bool:
         return required_scope in {
-            "templates:run",
-            "operations:execute",
-            "jobs:create",
-            "mcp:execute",
+            "templates:run", "operations:execute", "jobs:create", "mcp:execute"
         }
 
     @staticmethod
     def is_upload(request: Request, required_scope: str | None) -> bool:
         return request.method in {"POST", "PUT", "PATCH"} and required_scope in {
-            "templates:run",
-            "operations:execute",
-            "jobs:create",
-            "assets:write",
-            "mcp:execute",
+            "templates:run", "operations:execute", "jobs:create", "assets:write", "mcp:execute"
         }