Lab 'access-controlling' -- Adding additional scope does not work (only replacing `User.Read`

[ulkeba]

The instruction says:

Then, copy the full scope (app:///scope) and add it to the scopes array below.

(By the way, markdown will not render the <id> here, so that it shows as "app:///scope" instead of app://<id>/scope...)

However, I tried

flow = app.initiate_device_flow(scopes=["api://<id>/the-scope", "User.Read"])

as well as

flow = app.initiate_device_flow(scopes=["User.Read", "api://<id>/the-scope"])

but both did not work -- no clain roles and the scope in JWT was only:

{
  ...
  "scp": "openid profile User.Read email",
}

Only when I replaced User.Read, the token contained the app roles:

flow = app.initiate_device_flow(scopes=["api://<id>/the-scope"])

{
  ...
  "roles": [
    "OpenAI.ChatCompletion"
  ],
  "scp": "the-scope",
}