def METHOD_NAME(
    app_with_extensions,
    staff_user,
    permission_manage_apps,
    permission_manage_products,
    permission_manage_channels,
    site_settings,
):
    # given
    staff_user.user_permissions.set([permission_manage_products])
    audience = f"https://{site_settings.site.domain}.com/app-123"
    app, extensions = app_with_extensions
    app.audience = audience
    app.save()
    extension = extensions[0]
    extension.permissions.set(
        [permission_manage_channels, permission_manage_apps, permission_manage_products]
    )
    # when
    access_token = create_access_token_for_app_extension(
        app_extension=extension,
        permissions=extension.permissions.all(),
        user=staff_user,
        app=app,
    )
    # then
    decoded_token = jwt_decode(access_token, verify_expiration=False)
    assert decoded_token["permissions"] == ["MANAGE_PRODUCTS"]
    _, decode_extension_id = graphene.Node.from_global_id(
        decoded_token["app_extension"]
    )
    _, decode_app_id = graphene.Node.from_global_id(decoded_token["app"])
    assert decoded_token["user_permissions"] == ["MANAGE_PRODUCTS"]
    assert int(decode_extension_id) == extension.id
    assert int(decode_app_id) == app.id
    assert decoded_token["aud"] == audience