Improve push failure error message for package ID scope mismatch

Agent-Logs-Url: https://github.com/NuGet/NuGetGallery/sessions/aa085293-31cc-41ec-b433-e820261dd577

Co-authored-by: chabiss <[email protected]>

Author: Copilot

src/NuGetGallery/Controllers/ApiController.cs

@@ -1227,7 +1227,11 @@ private HttpStatusCodeWithBodyResult GetHttpResultFromFailedApiScopeEvaluationHe
             }
 
             string message;
-            if (result.PermissionsCheckResult == PermissionsCheckResult.Allowed && !result.IsOwnerConfirmed)
+            if (!result.ScopesAreValid)
+            {
+                message = Strings.ApiKeyNotAuthorized_PackageIdScopeMismatch;
+            }
+            else if (result.PermissionsCheckResult == PermissionsCheckResult.Allowed && !result.IsOwnerConfirmed)
             {
                 message = Strings.ApiKeyOwnerUnconfirmed;
             }

src/NuGetGallery/Strings.resx

@@ -138,6 +138,9 @@
   <data name="ApiKeyNotAuthorized" xml:space="preserve">
     <value>The specified API key is invalid, has expired, or does not have permission to access the specified package.</value>
   </data>
+  <data name="ApiKeyNotAuthorized_PackageIdScopeMismatch" xml:space="preserve">
+    <value>The specified API key does not have permission to push to this package. The API key may have a package ID scope that does not include this package ID.</value>
+  </data>
   <data name="PackageExistsAndCannotBeModified" xml:space="preserve">
     <value>A package with ID '{0}' and version '{1}' already exists and cannot be modified.</value>
   </data>

tests/NuGetGallery.Facts/Controllers/ApiControllerFacts.cs

@@ -205,7 +205,7 @@ public static IEnumerable<object[]> InvalidScopes_Data
         {
             get
             {
-                yield return MemberDataHelper.AsData(new ApiScopeEvaluationResult(null, PermissionsCheckResult.Unknown, scopesAreValid: false), HttpStatusCode.Forbidden, Strings.ApiKeyNotAuthorized);
+                yield return MemberDataHelper.AsData(new ApiScopeEvaluationResult(null, PermissionsCheckResult.Unknown, scopesAreValid: false), HttpStatusCode.Forbidden, Strings.ApiKeyNotAuthorized_PackageIdScopeMismatch);
 
                 foreach (var result in Enum.GetValues(typeof(PermissionsCheckResult)).Cast<PermissionsCheckResult>())
                 {