[Backport v8] Support wildcard values for content scope dimensions

[VPS-thodax]

Backport of #6114 to v8.x.x.

Original description

Problem

Content scopes could only grant access to concrete dimension values that are part of availableContentScopes. There was no way to grant a user access to any value of a single dimension (e.g. every language within a domain, or every product) without enumerating all values — which is not feasible for dimensions with many (potentially thousands) of values.

Solution

getContentScopesForUser can now use the wildcard value "*" as the value of a single content scope dimension to grant access to any value for that dimension. The wildcard is matched during the content scope check, so it does not need to be part of availableContentScopes.

For users with access to all content scopes, currentUser.permissions[].contentScopes now returns a single wildcard scope (e.g. [{ domain: "*", language: "*" }]) instead of the enumerated availableContentScopes. The default isAllowed and currentUser.allowedContentScopes handle the wildcard; a custom isAllowed must treat "*" as matching any value of a dimension.

Backport notes

Cherry-picking the squash commit (a00f0b2ed6bed7a53b0aad6c5c31f41aa19e1f39) from main produced conflicts in packages/api/cms-api/src/user-permissions/access-control.service.ts and packages/api/cms-api/src/warnings/warning.resolver.ts, both resolved by applying the incoming change on top of v8.x.x's existing code (an older checkContentScope helper replaced by the new isScopeWithin helper, and an import path difference from a later entity-info directory move on main that isn't part of v8.x.x).

Verification

• @comet/cms-api and @comet/cms-admin: build, lint (prettier/eslint/tsc) pass.
• demo/api: lint (api-generator regeneration + prettier/eslint/tsc) passes, generated files unchanged.
• packages/api/cms-api unit tests for access-control.service pass.
• demo/api AppModule initializes correctly via pnpm run console --help (schema/block-meta regenerate); it only fails afterwards on connecting to Postgres, since the full Docker demo could not be started in this sandbox — Docker Hub image pulls are blocked by the environment's network policy (403 from CloudFront).

---

🤖 Generated with Claude Code

https://claude.ai/code/session_01B37BzfVeTSW2Kn9Qgvtd1v

---

Generated by Claude Code

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

_{Comment @coderabbitai help to get the list of available commands.}