restrict_scopes_in_rule.js

function (user, context, callback) {
  
  function getAllowedScopes(audience, clientID) {
    // openid profile email are OIDC scopes
    // real code would calculate allowedScopes based on
    // contextual information like audience, 
    // context.clientID, context.clientName, context.connection, user
    let allowedScopes = ["openid","profile","email","read:timesheets"];
    return allowedScopes;
  }
  
  var requestedScopes = (
    (context.request.body && context.request.body.scope) || 
    (context.request.query && contest.request.query.scope) || 
    ''
  ).split(' ');
  console.log('Requested scopes:' + requestedScopes.join(', '));

  var requestedAudience = context.request.body.audience || 
    context.request.query.audience ||
    // if you don't have a default audience configured
    // you can remove this line
      "your-default-tenant-audience-if-you-have-one"  ;
  
  console.log('Requested audience:' + requestedAudience);

  const allowedScopes = getAllowedScopes(requestedAudience, context.clientID);
  console.log('Allowed scopes:' + allowedScopes.join(', '));
  
  let intersection = requestedScopes.filter(x => allowedScopes.includes(x));  
  console.log('Filtered scopes:' + intersection.join(', '));
  
  context.accessToken.scope = intersection;
             
  callback(null, user, context);
}