Add client roles to zauth

[xerbalind]

This is unfortunately not in the OAUTH2 spec, but the implementation is loosely based on how Keycloak does it to guarantee interoperability.

Roles are given to users, which allows for more fine-grained client-level permissions. If a client requests the user info after login, roles: [...] is included and a client can give additional permissions based on this list.

There are two type of roles:

• Global roles are always returned
• Client-specific roles are only returned for that client.

The OAuth scope must include 'roles' for the roles to be included in the ID token or user info.

For example the bestuur role can be given to the Zeus WPI board. Applications like Gitmate can then automatically give the correct permissions. Or Tabdmin only allows users with that role, but Ieben can be given the tabdmin_admin tabdmin role to still gain access.

An additional tab Roles is added in the Zauth navbar.

TODO

• write tests 😞

[rien]

I have experimented with conventional comments in my inline comments to indicate my intention with each comment. Let me know if it is unclear or if you don't like them.

I do think this is a nice improvement and it looks thoroughly implemented. My suggestions are mostly naming-related.

Nice job 👍

[rien]

thought: The difference between global and client-specific roles are not clear in the code.

Roles are now implicitly global when their client_id is None. I am wondering how we could make this more explicit.

[xerbalind]

The only time there really needs to be made some distinction, is when the roles are returned. So I honestly see no better way, without adding additional unnecessary redundancy.

I realise now, I never showed it in the frontend 😅.

[xerbalind]

praise: @rien for the in depth feedback 👍

I find the convential comments helpful, so I quite like them 😄

[rien]

👍

I only have one non-blocking UI-related suggestion left about how roles are presented. Because this is only a minor details and this feature is mostly admin-facing, I leave it to you whether you want to implement it or not.