[Bug] VerifyUserHasAnyAcceptedScope should throw UnauthorizedAccessException(message) (like roles)

[jmprieur]

Which version of Microsoft Identity Web are you using?
0.2.1-preview

Where is the issue?

• Web app
  • Sign-in users
  • Sign-in users and call web APIs
• Web API
  • [x ] Protected web APIs (validating tokens)
  • Protected web APIs (validating scopes)
  • Protected web APIs call downstream web APIs
• Token cache serialization
  • In-memory caches
  • Session caches
  • Distributed caches
• Other (please describe)

Repro

In tests\WebAppCallsWebApiCallsGraph\TodoListService\Controllers\TodoListController.cs, change line 22 to be

static readonly string[] scopeRequiredByApi = new string[] { "access_as_users" };

Runt the Web app and Web API

Expected behavior
The scope being invalid, the Web API should not process anything after calling HttpContext.VerifyUserHasAnyAcceptedScope(scopeRequiredByApi)

Actual behavior
The error is written in the HttpResponse, but the processing in the controller action continues

Possible solution
throw UnauthorizedAccessException(message) like what was done for roles in jennyf/roles for app roles

@jennyf19 : pre-assigning it to you as you've done the roles.

[jennyf19]

Included in 0.2.2-preview release