{"version":3,"file":"permissions-from-token.cjs","names":[],"sources":["../../src/access/permissions-from-token.ts"],"sourcesContent":["import { decodeJWT } from \"@/auth/jwt\";\n\nexport interface PermissionsFromTokenOptions {\n    /** JWT claim to read permissions from. Default: `\"permissions\"`. */\n    claim?: string;\n}\n\nfunction toPermissionList(value: unknown): string[] {\n    if (Array.isArray(value)) {\n        return value.filter((item): item is string => typeof item === \"string\");\n    }\n    if (typeof value === \"string\") {\n        // Space-delimited scope strings (OAuth convention).\n        return value.split(/\\s+/).filter(Boolean);\n    }\n    return [];\n}\n\n/**\n * Extract a permission list from a JWT.\n *\n * Reads the configured claim (default `\"permissions\"`); if absent, falls back to\n * the OAuth `\"scopes\"`/`\"scope\"` claims. Array claims are used as-is; string\n * claims are split on whitespace. Returns `[]` on any decode failure or when no\n * recognizable claim is present.\n *\n * @param token - The JWT to inspect (signature is **not** verified).\n * @param options - Optional claim override.\n * @returns The list of permission strings, or `[]` on failure.\n */\nexport function permissionsFromToken(\n    token: string,\n    options?: PermissionsFromTokenOptions,\n): string[] {\n    try {\n        const { payload } = decodeJWT(token);\n        const claim = options?.claim ?? \"permissions\";\n        const primary = toPermissionList(payload[claim]);\n        if (primary.length > 0) return primary;\n\n        if (options?.claim === undefined) {\n            const scopes = toPermissionList(payload[\"scopes\"]);\n            if (scopes.length > 0) return scopes;\n            return toPermissionList(payload[\"scope\"]);\n        }\n        return primary;\n    } catch {\n        return [];\n    }\n}\n"],"mappings":"mCAOA,SAAS,EAAiB,EAA0B,CAQhD,OAPI,MAAM,QAAQ,CAAK,EACZ,EAAM,OAAQ,GAAyB,OAAO,GAAS,QAAQ,EAEtE,OAAO,GAAU,SAEV,EAAM,MAAM,KAAK,CAAC,CAAC,OAAO,OAAO,EAErC,CAAC,CACZ,CAcA,SAAgB,EACZ,EACA,EACQ,CACR,GAAI,CACA,GAAM,CAAE,WAAY,EAAA,UAAU,CAAK,EAE7B,EAAU,EAAiB,EADnB,GAAS,OAAS,cACe,EAC/C,GAAI,EAAQ,OAAS,EAAG,OAAO,EAE/B,GAAI,GAAS,QAAU,IAAA,GAAW,CAC9B,IAAM,EAAS,EAAiB,EAAQ,MAAS,EAEjD,OADI,EAAO,OAAS,EAAU,EACvB,EAAiB,EAAQ,KAAQ,CAC5C,CACA,OAAO,CACX,MAAQ,CACJ,MAAO,CAAC,CACZ,CACJ"}