CLEN3748-category permissions support at grant and grantToken

.pubnub.yml

@@ -1,5 +1,10 @@
 ---
 changelog:
+  - date: 2026-10-12
+    version: v13.1.0
+    changes:
+      - type: feature
+        text: "Add Access Manager `categories` enumeration support to grantToken and parseToken, and to the legacy grant method, so a token or auth key can list all channel and UUID metadata."
   - date: 2026-09-22
     version: v13.0.3
     changes:
@@ -1503,7 +1508,7 @@ supported-platforms:
       - 'Ubuntu 14.04 and up'
       - 'Windows 7 and up'
     version: 'Pubnub Javascript for Node'
-version: '13.0.3'
+version: '13.1.0'
 sdks:
   - full-name: PubNub Javascript SDK
     short-name: Javascript
@@ -1519,7 +1524,7 @@ sdks:
           - distribution-type: source
             distribution-repository: GitHub release
             package-name: pubnub.js
-            location: https://github.com/pubnub/javascript/archive/refs/tags/v13.0.3.zip
+            location: https://github.com/pubnub/javascript/archive/refs/tags/v13.1.0.zip
             requires:
               - name: 'agentkeepalive'
                 min-version: '3.5.2'
@@ -2190,7 +2195,7 @@ sdks:
           - distribution-type: library
             distribution-repository: GitHub release
             package-name: pubnub.js
-            location: https://github.com/pubnub/javascript/releases/download/v13.0.3/pubnub.13.0.3.js
+            location: https://github.com/pubnub/javascript/releases/download/v13.1.0/pubnub.13.1.0.js
             requires:
               - name: 'agentkeepalive'
                 min-version: '3.5.2'

CHANGELOG.md

@@ -1,3 +1,9 @@
+## v13.1.0
+October 12 2026
+
+#### Added
+- Add Access Manager `categories` enumeration support to grantToken and parseToken, and to the legacy grant method, so a token or auth key can list all channel and UUID metadata.
+
 ## v13.0.3
 September 22 2026
 

README.md

@@ -1,4 +1,6 @@
-# PubNub JavaScript SDK (V4)
+<img width="1920" height="600" alt="image" src="https://github.com/user-attachments/assets/b60b4e27-a140-4784-8b34-85ae421023e2" />
+
+# PubNub JavaScript SDK
 
 [![Codacy Badge](https://api.codacy.com/project/badge/Grade/2859917905c549b8bfa27630ff276fce)](https://www.codacy.com/app/PubNub/javascript?utm_source=github.com&amp;utm_medium=referral&amp;utm_content=pubnub/javascript&amp;utm_campaign=Badge_Grade)
 [![npm](https://img.shields.io/npm/v/pubnub.svg)]()
@@ -27,8 +29,8 @@ Watch [Getting Started with PubNub JS SDK](https://app.dashcam.io/replay/64ee0d2
      npm install pubnub
      ```
    * or download one of our builds from our CDN: 
-     * https://cdn.pubnub.com/sdk/javascript/pubnub.13.0.3.js
-     * https://cdn.pubnub.com/sdk/javascript/pubnub.13.0.3.min.js
+     * https://cdn.pubnub.com/sdk/javascript/pubnub.13.1.0.js
+     * https://cdn.pubnub.com/sdk/javascript/pubnub.13.1.0.min.js
 
    > **React Native:** the SDK relies on a global `URL` implementation, which React Native does not
    > provide, so it depends on [`react-native-url-polyfill`](https://www.npmjs.com/package/react-native-url-polyfill).

dist/web/pubnub.js

@@ -5613,7 +5613,7 @@
 	            return base.PubNubFile;
 	        },
 	        get version() {
-	            return '13.0.3';
+	            return '13.1.0';
 	        },
 	        getVersion() {
 	            return this.version;
@@ -5796,6 +5796,9 @@
 	            const patternDataSync = this.extractDataSyncScopes(parsed.pat);
 	            if (patternDataSync)
 	                ((_b = result.patterns) !== null && _b !== void 0 ? _b : (result.patterns = {})).dataSync = patternDataSync;
+	            const categories = this.extractCategories(parsed.cat);
+	            if (categories)
+	                result.categories = categories;
 	            if (parsed.meta && Object.keys(parsed.meta).length > 0)
 	                result.meta = parsed.meta;
 	            return result;
@@ -5835,6 +5838,26 @@
 	            permissionsResult.read = true;
 	        return permissionsResult;
 	    }
+	    /**
+	     * Extract category-level permissions from the token `cat` section.
+	     *
+	     * `chan` maps to `channels` and `uuid` maps to `uuids`. `get` is set from the `32` bit. The
+	     * section is omitted when `cat` is absent or empty.
+	     *
+	     * @param cat - Raw `cat` section decoded from the token.
+	     *
+	     * @returns Human-readable category permissions, or `undefined` when none are present.
+	     */
+	    extractCategories(cat) {
+	        if (!cat)
+	            return undefined;
+	        const result = {};
+	        if (typeof cat.chan === 'number')
+	            result.channels = { get: (cat.chan & 32) === 32 };
+	        if (typeof cat.uuid === 'number')
+	            result.uuids = { get: (cat.uuid & 32) === 32 };
+	        return Object.keys(result).length > 0 ? result : undefined;
+	    }
 	    /**
 	     * Extract DataSync permission scopes from a token permissions section.
 	     *

lib/core/components/configuration.js

@@ -174,7 +174,7 @@ const makeConfiguration = (base, setupCryptoModule) => {
             return base.PubNubFile;
         },
         get version() {
-            return '13.0.3';
+            return '13.1.0';
         },
         getVersion() {
             return this.version;

lib/core/components/token_manager.js

@@ -117,6 +117,9 @@ class TokenManager {
             const patternDataSync = this.extractDataSyncScopes(parsed.pat);
             if (patternDataSync)
                 ((_b = result.patterns) !== null && _b !== void 0 ? _b : (result.patterns = {})).dataSync = patternDataSync;
+            const categories = this.extractCategories(parsed.cat);
+            if (categories)
+                result.categories = categories;
             if (parsed.meta && Object.keys(parsed.meta).length > 0)
                 result.meta = parsed.meta;
             return result;
@@ -156,6 +159,26 @@ class TokenManager {
             permissionsResult.read = true;
         return permissionsResult;
     }
+    /**
+     * Extract category-level permissions from the token `cat` section.
+     *
+     * `chan` maps to `channels` and `uuid` maps to `uuids`. `get` is set from the `32` bit. The
+     * section is omitted when `cat` is absent or empty.
+     *
+     * @param cat - Raw `cat` section decoded from the token.
+     *
+     * @returns Human-readable category permissions, or `undefined` when none are present.
+     */
+    extractCategories(cat) {
+        if (!cat)
+            return undefined;
+        const result = {};
+        if (typeof cat.chan === 'number')
+            result.channels = { get: (cat.chan & 32) === 32 };
+        if (typeof cat.uuid === 'number')
+            result.uuids = { get: (cat.uuid & 32) === 32 };
+        return Object.keys(result).length > 0 ? result : undefined;
+    }
     /**
      * Extract DataSync permission scopes from a token permissions section.
      *

lib/core/endpoints/access_manager/grant.js

@@ -60,27 +60,28 @@ const JOIN_PERMISSION = false;
  */
 class GrantRequest extends request_1.AbstractRequest {
     constructor(parameters) {
-        var _a, _b, _c, _d, _e, _f, _g, _h, _j, _k;
-        var _l, _m, _o, _p, _q, _r, _s, _t, _u, _v;
+        var _a, _b, _c, _d, _e, _f, _g, _h, _j, _k, _l;
+        var _m, _o, _p, _q, _r, _s, _t, _u, _v, _w, _x;
         super();
         this.parameters = parameters;
         // Apply defaults.
-        (_a = (_l = this.parameters).channels) !== null && _a !== void 0 ? _a : (_l.channels = []);
-        (_b = (_m = this.parameters).channelGroups) !== null && _b !== void 0 ? _b : (_m.channelGroups = []);
-        (_c = (_o = this.parameters).uuids) !== null && _c !== void 0 ? _c : (_o.uuids = []);
-        (_d = (_p = this.parameters).read) !== null && _d !== void 0 ? _d : (_p.read = READ_PERMISSION);
-        (_e = (_q = this.parameters).write) !== null && _e !== void 0 ? _e : (_q.write = WRITE_PERMISSION);
-        (_f = (_r = this.parameters).delete) !== null && _f !== void 0 ? _f : (_r.delete = DELETE_PERMISSION);
-        (_g = (_s = this.parameters).get) !== null && _g !== void 0 ? _g : (_s.get = GET_PERMISSION);
-        (_h = (_t = this.parameters).update) !== null && _h !== void 0 ? _h : (_t.update = UPDATE_PERMISSION);
-        (_j = (_u = this.parameters).manage) !== null && _j !== void 0 ? _j : (_u.manage = MANAGE_PERMISSION);
-        (_k = (_v = this.parameters).join) !== null && _k !== void 0 ? _k : (_v.join = JOIN_PERMISSION);
+        (_a = (_m = this.parameters).channels) !== null && _a !== void 0 ? _a : (_m.channels = []);
+        (_b = (_o = this.parameters).channelGroups) !== null && _b !== void 0 ? _b : (_o.channelGroups = []);
+        (_c = (_p = this.parameters).uuids) !== null && _c !== void 0 ? _c : (_p.uuids = []);
+        (_d = (_q = this.parameters).categories) !== null && _d !== void 0 ? _d : (_q.categories = []);
+        (_e = (_r = this.parameters).read) !== null && _e !== void 0 ? _e : (_r.read = READ_PERMISSION);
+        (_f = (_s = this.parameters).write) !== null && _f !== void 0 ? _f : (_s.write = WRITE_PERMISSION);
+        (_g = (_t = this.parameters).delete) !== null && _g !== void 0 ? _g : (_t.delete = DELETE_PERMISSION);
+        (_h = (_u = this.parameters).get) !== null && _h !== void 0 ? _h : (_u.get = GET_PERMISSION);
+        (_j = (_v = this.parameters).update) !== null && _j !== void 0 ? _j : (_v.update = UPDATE_PERMISSION);
+        (_k = (_w = this.parameters).manage) !== null && _k !== void 0 ? _k : (_w.manage = MANAGE_PERMISSION);
+        (_l = (_x = this.parameters).join) !== null && _l !== void 0 ? _l : (_x.join = JOIN_PERMISSION);
     }
     operation() {
         return operations_1.default.PNAccessManagerGrant;
     }
     validate() {
-        const { keySet: { subscribeKey, publishKey, secretKey }, uuids = [], channels = [], channelGroups = [], authKeys = [], } = this.parameters;
+        const { keySet: { subscribeKey, publishKey, secretKey }, uuids = [], channels = [], channelGroups = [], categories = [], authKeys = [], read, write, manage, delete: del, update, join, get, ttl, } = this.parameters;
         if (!subscribeKey)
             return 'Missing Subscribe Key';
         if (!publishKey)
@@ -91,6 +92,16 @@ class GrantRequest extends request_1.AbstractRequest {
             return 'authKeys are required for grant request on uuids';
         if (uuids.length && (channels.length !== 0 || channelGroups.length !== 0))
             return 'Both channel/channel group and uuid cannot be used in the same request';
+        if (categories.length > 0) {
+            if (authKeys.length === 0)
+                return 'authKeys are required for grant request on categories';
+            if (categories.some((category) => category !== 'channels' && category !== 'uuids'))
+                return 'Invalid category: only channels and uuids are supported';
+            if (read || write || manage || del || update || join)
+                return 'Category permissions must be exactly the get permission';
+            if (ttl === 1 && get)
+                return 'One-minute category grants are not supported';
+        }
     }
     parse(response) {
         return __awaiter(this, void 0, void 0, function* () {
@@ -101,8 +112,8 @@ class GrantRequest extends request_1.AbstractRequest {
         return `/v2/auth/grant/sub-key/${this.parameters.keySet.subscribeKey}`;
     }
     get queryParameters() {
-        const { channels, channelGroups, authKeys, uuids, read, write, manage, delete: del, get, join, update, ttl, } = this.parameters;
-        return Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign({}, (channels && (channels === null || channels === void 0 ? void 0 : channels.length) > 0 ? { channel: channels.join(',') } : {})), (channelGroups && (channelGroups === null || channelGroups === void 0 ? void 0 : channelGroups.length) > 0 ? { 'channel-group': channelGroups.join(',') } : {})), (authKeys && (authKeys === null || authKeys === void 0 ? void 0 : authKeys.length) > 0 ? { auth: authKeys.join(',') } : {})), (uuids && (uuids === null || uuids === void 0 ? void 0 : uuids.length) > 0 ? { 'target-uuid': uuids.join(',') } : {})), { r: read ? '1' : '0', w: write ? '1' : '0', m: manage ? '1' : '0', d: del ? '1' : '0', g: get ? '1' : '0', j: join ? '1' : '0', u: update ? '1' : '0' }), (ttl || ttl === 0 ? { ttl } : {}));
+        const { channels, channelGroups, categories, authKeys, uuids, read, write, manage, delete: del, get, join, update, ttl, } = this.parameters;
+        return Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign({}, (channels && (channels === null || channels === void 0 ? void 0 : channels.length) > 0 ? { channel: channels.join(',') } : {})), (channelGroups && (channelGroups === null || channelGroups === void 0 ? void 0 : channelGroups.length) > 0 ? { 'channel-group': channelGroups.join(',') } : {})), (authKeys && (authKeys === null || authKeys === void 0 ? void 0 : authKeys.length) > 0 ? { auth: authKeys.join(',') } : {})), (uuids && (uuids === null || uuids === void 0 ? void 0 : uuids.length) > 0 ? { 'target-uuid': uuids.join(',') } : {})), (categories && categories.length > 0 ? { category: categories.join(',') } : {})), { r: read ? '1' : '0', w: write ? '1' : '0', m: manage ? '1' : '0', d: del ? '1' : '0', g: get ? '1' : '0', j: join ? '1' : '0', u: update ? '1' : '0' }), (ttl || ttl === 0 ? { ttl } : {}));
     }
 }
 exports.GrantRequest = GrantRequest;