Feature: Extend context
rules parameter with optional audience
filed.
Description: Currently audience
field not present in context
object and to extract it we have to write custom code to inspect context.request
. It feels too wordy and pollutes rules code.
Possible implementation: https://auth0.com/docs/manage-users/access-control/sample-use-cases-rules-with-authorization#deny-access-to-anyone-calling-an-api
Use-case: We are implementing “require verified email for login” rule following this example: https://auth0.com/docs/manage-users/access-control/sample-use-cases-rules-with-authorization#deny-access-to-anyone-calling-an-api but we want to add an exception. Access to our support portal should be allowed to a user without verified email, in case they dont receive it. Our UI is SPA and support portal backend is API. To allow access to support portal we have to make “Require verified email for login” rule conditional based on audience.