@forge/bridge

Index: package/out/permissions/permissionsUtil.js
===================================================================
--- package/out/permissions/permissionsUtil.js
+++ package/out/permissions/permissionsUtil.js
@@ -105,13 +105,42 @@
         Object.assign(missingExternal, missingResources);
     }
     return missingExternal;
 }
+function validateObjectField(value, fieldPath) {
+    if (value !== undefined) {
+        if (typeof value !== 'object' || value === null || Array.isArray(value)) {
+            throw new TypeError(`${fieldPath} should be an object, not ${Array.isArray(value) ? 'an array' : `a ${typeof value}`}`);
+        }
+    }
+}
+function validateArrayField(value, fieldPath) {
+    if (value !== undefined && !Array.isArray(value)) {
+        throw new TypeError(`${fieldPath} should be an array, not a ${typeof value}`);
+    }
+}
+function validatePermissionShape(requiredPermissions) {
+    validateArrayField(requiredPermissions.scopes, 'scopes');
+    const external = requiredPermissions.external;
+    if (external === undefined)
+        return;
+    validateObjectField(external, 'external');
+    if (external.fetch !== undefined) {
+        validateObjectField(external.fetch, 'external.fetch');
+        for (const type of FETCH_TYPES) {
+            validateArrayField(external.fetch[type], `external.fetch.${type}`);
+        }
+    }
+    for (const type of RESOURCE_TYPES) {
+        validateArrayField(external[type], `external.${type}`);
+    }
+}
 async function checkPermissions(requiredPermissions, runtimePermissions) {
     var _a;
     if (!requiredPermissions) {
         return { granted: false, missing: null };
     }
+    validatePermissionShape(requiredPermissions);
     if (!((_a = requiredPermissions.scopes) === null || _a === void 0 ? void 0 : _a.length) && !requiredPermissions.external) {
         return { granted: true, missing: null };
     }
     let permissionsToCheck = runtimePermissions;