I am using Auth0 for authentication in my Spring Boot backend. To authenticate, I create an API in Auth0, fetch an access token from the frontend, and pass it to the backend. However, after decoding the token, I see that the permissions are present in the token, but they are not included in the scope section.

Without including the permissions in the scope, the following hasAuthority() check does not work:

http
    .authorizeHttpRequests((authorize) -> authorize
        .requestMatchers("/api/public").permitAll()
        .requestMatchers("/api/private/**").authenticated()
        .requestMatchers("/api/private-scoped/**").hasAuthority("SCOPE_read:advices"));

This is preventing me from using the hasAuthority() method to check for permissions correctly.

Previously, it was suggested (in this StackOverflow answer) that a custom rule in Auth0 could be used to include permissions in the scope, but as rules are no longer supported in Auth0, that solution is no longer valid.

My question:
Is there a new method or a configuration in Auth0 to include permissions in the scope claim of the access token?

If not, is there an alternative way to handle permissions in the access token while still being able to use hasAuthority() or similar methods in Spring Security?