Enhance JWT user claims with configurable roles

Updated Program.cs to include "CommonUserRoles" from configuration in JWT claims for users, adding them under ClaimTypes.Role if present. Also added System.Security.Claims using directive to support this change. This enables dynamic role assignment in user tokens.

src/DigitalData.Auth.API/Program.cs

@@ -9,12 +9,12 @@ using DigitalData.Core.Security.Extensions;
 using DigitalData.UserManager.Application;
 using DigitalData.UserManager.Application.DTOs.User;
 using Microsoft.AspNetCore.Authentication.JwtBearer;
-using Microsoft.Extensions.Options;
 using Microsoft.IdentityModel.JsonWebTokens;
 using Microsoft.IdentityModel.Tokens;
 using Microsoft.OpenApi.Models;
 using NLog;
 using NLog.Web;
+using System.Security.Claims;
 
 var logger = LogManager.Setup().LoadConfigurationFromAppSettings().GetCurrentClassLogger();
 logger.Info("Logging initialized.");
@@ -49,7 +49,12 @@ try
         { JwtRegisteredClaimNames.Sub, api.Id },
         { JwtRegisteredClaimNames.Iat, DateTimeOffset.UtcNow.ToUnixTimeSeconds() }
     });
-    builder.Services.AddJwtSignatureHandler<UserReadDto>(user => new Dictionary<string, object>
+
+    var commonUserRoles = config.GetSection("CommonUserRoles").Get<string[]>()?.Where(r => !string.IsNullOrWhiteSpace(r)).ToArray() ?? Array.Empty<string>();
+
+    builder.Services.AddJwtSignatureHandler<UserReadDto>(user =>
+    {
+        var claims = new Dictionary<string, object>
         {
             { JwtRegisteredClaimNames.Sub, user.Id },
             { JwtRegisteredClaimNames.UniqueName, user.Username },
@@ -57,6 +62,12 @@ try
             { JwtRegisteredClaimNames.GivenName, user.Prename ?? string.Empty },
             { JwtRegisteredClaimNames.FamilyName, user.Name ?? string.Empty },
             { JwtRegisteredClaimNames.Iat, DateTimeOffset.UtcNow.ToUnixTimeSeconds() }
+        };
+
+        if (commonUserRoles.Length > 0)
+            claims.Add(ClaimTypes.Role, commonUserRoles);
+
+        return claims;
     });
     builder.Services.AddDirectorySearchService(config.GetSection("DirectorySearchOptions"));
     builder.Services.AddSignalR();