code: func parseClaimScopes(token *jwt.Token) (map[string]bool, []string, error) {
  	scopesInClaim := make(map[string]bool)
  	var scopesInClaimList []string
  	claims, ok := token.Claims.(jwt.MapClaims)
  	if !ok {
  		return nil, nil, fmt.Errorf("unsupported claims shape")
  	}
  	for _, k := range validScopeClaimKeys {
  		if rawscopes, ok := claims[k]; ok && rawscopes != nil {
  			switch scopes := rawscopes.(type) {
  			case string:
  				for _, scope := range strings.Split(scopes, " ") {
  					scopesInClaim[scope] = true
  					scopesInClaimList = append(scopesInClaimList, scope)
  				}
  			case []interface{}:
  				for _, scope := range scopes {
  					if val, ok := scope.(string); ok {
  						scopesInClaim[val] = true
  						scopesInClaimList = append(scopesInClaimList, val)
  					}
  				}
  			default:
  				return nil, nil, fmt.Errorf("unsupported scope format in incoming JWT claim, was type %T", scopes)
  			}
  			break
  		}
  	}
  	sort.Strings(scopesInClaimList)
  	return scopesInClaim, scopesInClaimList, nil
  }
docs: // parseClaimScopes parses the "scope" or "scopes" parameter in the Claims. It
  // supports two formats:
  //
  // * a list of strings
  //
  // * a single string with space-separated scopes (akin to OAuth2's "scope").
  //
  // An empty string is an explicit claim of no scopes.