Method syncSiteWideRoles

coderd/idpsync/role.go:220–261

(ctx context.Context, tx database.Store, user database.User, params RoleParams)

}

func (s AGPLIDPSync) syncSiteWideRoles(ctx context.Context, tx database.Store, user database.User, params RoleParams) error {
	// Apply site wide roles to a user.
	// ignored is the list of roles that are not valid Coder roles and will
	// be skipped.
	ignored := make([]string, 0)
	filtered := make([]string, 0, len(params.SiteWideRoles))
	for _, role := range params.SiteWideRoles {
		// Because we are only syncing site wide roles, we intentionally will always
		// omit 'OrganizationID' from the RoleIdentifier.
		// TODO: If custom site wide roles are introduced, this needs to use the
		// database to verify the role exists.
		if _, err := rbac.RoleByName(rbac.RoleIdentifier{Name: role}); err == nil {
			filtered = append(filtered, role)
		} else {
			ignored = append(ignored, role)
		}
	}
	if len(ignored) > 0 {
		s.Logger.Debug(ctx, "OIDC roles ignored in assignment",
			slog.F("ignored", ignored),
			slog.F("assigned", filtered),
			slog.F("user_id", user.ID),
			slog.F("username", user.Username),
		)
	}

	filtered = slice.Unique(filtered)
	slices.Sort(filtered)

	existing := slice.Unique(user.RBACRoles)
	slices.Sort(existing)
	if !slices.Equal(existing, filtered) {
		_, err := tx.UpdateUserRoles(ctx, database.UpdateUserRolesParams{
			GrantedRoles: filtered,
			ID:           user.ID,
		})
		if err != nil {
			return xerrors.Errorf("set site wide roles: %w", err)
		}
	}
	return nil
}

func (AGPLIDPSync) RolesFromClaim(field string, claims jwt.MapClaims) ([]string, error) {
	rolesRow, ok := claims[field]