Is your feature request related to a problem? Please describe.
Some oidc providers (in my case specifically Rauthy) do not include the granted scopes in their token endpoint response. This results in getGrantedScopes() returning undefined, making it impossible to write route guards based on the granted scopes.
If the access token is a jwt, the granted scopes can instead be obtained from the scope claim on the access token, but so far there is no easy way to obtain that information, except parsing the access token as a jwt manually.
Describe the solution you'd like
If the token endpoint response is successful, but does not include the granted scopes, the library should attempt to parse the access token as a jwt. If successful, use the scope claim to provide the granted scopes.
If not successful, leave the granted scopes undefined. (current behaviour)
Describe alternatives you've considered
A function similar to getIdentityClaims(), but instead parsing the access token as if it was a jwt (and returning undefined if the access token cannot be parsed as a jwt). This would make extracting the scopes from a jwt access token significantly easier without altering the behaviour of any existing api functions.
Is your feature request related to a problem? Please describe.
Some oidc providers (in my case specifically Rauthy) do not include the granted scopes in their token endpoint response. This results in
getGrantedScopes()returning undefined, making it impossible to write route guards based on the granted scopes.If the access token is a jwt, the granted scopes can instead be obtained from the scope claim on the access token, but so far there is no easy way to obtain that information, except parsing the access token as a jwt manually.
Describe the solution you'd like
If the token endpoint response is successful, but does not include the granted scopes, the library should attempt to parse the access token as a jwt. If successful, use the scope claim to provide the granted scopes.
If not successful, leave the granted scopes undefined. (current behaviour)
Describe alternatives you've considered
A function similar to
getIdentityClaims(), but instead parsing the access token as if it was a jwt (and returning undefined if the access token cannot be parsed as a jwt). This would make extracting the scopes from a jwt access token significantly easier without altering the behaviour of any existing api functions.