fix(observability-map): credit scoped API-key guards in auth-boundary

Fix an under-credit in the observability map's auth-boundary check: it
now recognises `authenticateApiKeyWithScope` and its private and scoped
siblings as guards. These authenticate the caller from a bearer key and
return an `{ ok }` result like the request guards already on the list,
so routes using them were being flagged as unguarded for want of the
name. No route behaviour changes; only the scanner.

Mono-RevId: 7b5a1562ff5aee1f578872216a34531f54736876

Author: 1stvamp

internal-packages/observability-map/src/checks/authBoundary.ts

@@ -28,6 +28,11 @@ export const GUARDS = new Set([
   "authenticateApiRequestWithPersonalAccessToken",
   "authenticateApiRequestWithOrganizationAccessToken",
   "authenticateApiKey",
+  // Scoped and private API-key entry points in the same `apiAuth.server.ts`, each returning a
+  // `{ ok }` result like `authenticateApiRequestWithFailure` above rather than throwing.
+  "authenticateApiKeyWithScope",
+  "authenticateApiKeyRequest",
+  "authenticateRequestWithScopedApiKey",
   "authenticateAuthorizationHeader",
   "authenticateOrganizationAccessToken",
   "authenticatePersonalAccessToken",

internal-packages/observability-map/src/checks/index.test.ts

@@ -1024,6 +1024,33 @@ describe("auth-boundary", () => {
     expect(r.status).toBe("pass");
   });
 
+  // All three scoped and private API-key helpers on the allowlist, so dropping any one of the names
+  // is caught here rather than only by the tree scan.
+  it.each([
+    [
+      "authenticateApiKeyWithScope",
+      'authenticateApiKeyWithScope(request, { action: "read", resource: { type: "envvars" } })',
+    ],
+    ["authenticateApiKeyRequest", "authenticateApiKeyRequest(request)"],
+    [
+      "authenticateRequestWithScopedApiKey",
+      "authenticateRequestWithScopedApiKey(request, { personalAccessToken: true, organizationAccessToken: true, apiKey })",
+    ],
+  ])("passes a sensitive route guarded by %s", (name, call) => {
+    const r = run(
+      "auth-boundary",
+      "api.v1.projects.$projectRef.envvars.ts",
+      `import { ${name} } from "~/services/apiAuth.server";
+       import { prisma } from "~/db.server";
+       export async function loader({ request }) {
+         const auth = await ${call};
+         if (!auth.ok) throw new Response(null, { status: 401 });
+         return prisma.environmentVariable.findMany();
+       }`
+    );
+    expect(r.status).toBe("pass");
+  });
+
   it("fails a sensitive route with no guard", () => {
     const r = run(
       "auth-boundary",