extend access token

rule.js

function (user, context, callback) {
  let role = user.app_metadata.role || 'limied-authority';
  
  if (role === 'legal-lessee' || role === 'full-authority')
    context.accessToken.scope = ['read:usage', 'read:bill', 'pay:bill', 'update:email'];
  else
    context.accessToken.scope = ['read:bill'];

  context.accessToken['http://custom.ns/role'] = role; // plain text role, for audit
  
  callback(null, user, context);
}