[ngjunsiang]

Closes #67

Summary

The audit service has a named role catalogue for API keys (campus#918, campus PR #935): a role name is accepted wherever a scope list is accepted, and resolves to exactly one scope list.

Role	Grants
traces-viewer	traces:read
traces-searcher	traces:read, traces:search
traces-producer	traces:read, traces:search, traces:write
key-operator	apikeys:read, apikeys:write

campus audit keys new still took a raw --scope list, so the operator assembling scopes by hand was exactly what the catalogue exists to remove. Now:

campus audit keys new --name "Alice" --owner alice@school.edu --role traces-viewer
campus audit keys update --key-id <id> --role traces-searcher

The rules the CLI mirrors

• --role and --scope are mutually exclusive. The service refuses both together — it leaves it ambiguous which was meant — so the CLI refuses them first rather than sending a request that will be rejected.
• Exactly one is required. campus audit keys new with neither now fails with a clear message rather than sending an empty privilege set.
• The catalogue is the service's, not the CLI's. The CLI passes the name through and lets the service refuse an unknown role with the names of the roles it does have. The CLI keeps no copy that could drift — the README names the current roles, but the behaviour never depends on that list.

The relock

The second commit relocks campus-python to pick up campus-api-python#113, which adds the role parameter to the SDK's apikeys resource — the one this flag depends on. Same shape as #52 (relock campus-python for the grants resource).

The lock moves campus-api-python from dad0442 to 2667846, and the installed SDK's APIKeys.new() and APIKey.update() now both carry role.

Testing

Six new cases in tests/unit/test_audit.py (TestKeysRole): the role is forwarded with no scope list; --scope still works and forwards no role; role and scope together are refused before any request is made; neither is refused; keys update accepts a role; keys update refuses role and scope together.

poetry run pytest: 302 passed. ruff check . clean.

Related

• campus#918 (the role catalogue — the server side), campus#927 (the key-management page — the same vocabulary, in the browser), campus-api-python#112 / #113 (the SDK parameter this depends on)