@forge/api

Index: package/out/api/permissions.js
===================================================================
--- package/out/api/permissions.js
+++ package/out/api/permissions.js
@@ -47,8 +47,37 @@
         return !isUrlAlreadyGranted;
     });
     return missingUrls;
 };
+const VALID_REQUIREMENT_KEYS = ['scopes', 'external'];
+const VALID_EXTERNAL_TYPES = [
+    'fetch',
+    'fonts',
+    'frames',
+    'images',
+    'media',
+    'scripts',
+    'styles'
+];
+const VALID_FETCH_TYPES = ['backend', 'client'];
+const validateKeys = (obj, validKeys) => {
+    const validKeysSet = new Set(validKeys);
+    const providedKeys = Object.keys(obj);
+    const invalidKeys = providedKeys.filter((key) => !validKeysSet.has(key));
+    if (invalidKeys.length > 0) {
+        throw new Error(`Invalid permission key(s): ${invalidKeys.join(', ')}. ` +
+            `Visit https://go.atlassian.com/forge-permissions for more information.`);
+    }
+};
+const validatePermissionRequirements = (requirements) => {
+    validateKeys(requirements, VALID_REQUIREMENT_KEYS);
+    if (requirements.external) {
+        validateKeys(requirements.external, VALID_EXTERNAL_TYPES);
+        if (requirements.external.fetch) {
+            validateKeys(requirements.external.fetch, VALID_FETCH_TYPES);
+        }
+    }
+};
 const getMissingFetchPermissions = (requiredFetch, currentlyGrantedFetch) => {
     if (!requiredFetch) {
         return undefined;
     }
@@ -101,8 +130,9 @@
     const arePermissionsAvailable = !!(currentlyGrantedPermissions && typeof currentlyGrantedPermissions === 'object');
     if (!arePermissionsAvailable) {
         throw new errors_1.ApiNotReadyError('This feature is not available yet');
     }
+    validatePermissionRequirements(requirements);
     const missingPermissions = {};
     let hasMissingPermissions = false;
     const missingScopes = getMissingScopes(requirements.scopes, currentlyGrantedPermissions.scopes);
     if (missingScopes) {