@thunderid/browser 1.9.0 → 1.9.1

package/dist/index.js

@@ -1,6 +1,6 @@
 import { Buffer } from 'buffer/index.js';
 if (typeof window !== 'undefined' && !window.Buffer) { window.Buffer = Buffer; }
-import { DEFAULT_THEME, HttpClient, OIDCRequestConstants, ThunderIDAuthException, ThunderIDJavaScriptClient, ThunderIDRuntimeError, TokenConstants, arrayBufferToBase64url, base64urlToArrayBuffer, createPackageComponentLogger, extractEmojiFromUri, extractPkceStorageKeyFromState, generateFlattenedUserProfile, getUsersMe, isEmojiUri, resolveBackendEndpoints, resolveResourceEndpoint } from "@thunderid/javascript";
+import { DEFAULT_THEME, HttpClient, OIDCRequestConstants, ThunderIDAuthException, ThunderIDJavaScriptClient, ThunderIDRuntimeError, TokenConstants, arrayBufferToBase64url, base64urlToArrayBuffer, createPackageComponentLogger, extractEmojiFromUri, extractPkceStorageKeyFromState, generateFlattenedUserProfile, getTokenPermissions, getUsersMe, isEmojiUri, resolveBackendEndpoints, resolveResourceEndpoint } from "@thunderid/javascript";
 import base64url from "base64url";
 import sha256 from "fast-sha256";
 import { createLocalJWKSet, jwtVerify } from "jose";
@@ -3097,6 +3097,23 @@ var ThunderIDBrowserClient = class ThunderIDBrowserClient extends ThunderIDJavaS
 		return super.getAccessToken(sessionId);
 	}
 	/**
+	* The permissions the signed-in user's access token grants, for example to hide a page the user
+	* cannot use. The server still checks every request.
+	*
+	* In backend mode they come only from the backend's session (`scope`): the token stays on the backend,
+	* so a session without `scope` grants nothing. Otherwise they are read from the access token's `scope`
+	* or `scopes` claim.
+	*
+	* @returns The granted permissions, or an empty list when none can be read.
+	*/
+	async getGrantedPermissions() {
+		if (this._backend) {
+			const { scope } = await this._backend.getSession();
+			return typeof scope === "string" ? scope.split(" ").filter((entry) => entry.length > 0) : [];
+		}
+		return getTokenPermissions(await this.getAccessToken());
+	}
+	/**
 	* The access token for requests under `endpoints.backend.bypass`. Like a client credentials token it
 	* has no refresh token: it is kept in the session storage until it nears expiry, then requested again.
 	*