R60: accept single-string groups/roles; fix mem over-evict

2026-10-17 04:37:48 +00:00 · 2026-08-13 16:06:43 +01:00
parent e61edaa5b3
commit 1df9b98aeb
5 changed files with 136 additions and 21 deletions
@@ -2299,10 +2299,20 @@ func TestExtractGroupsAndRoles(t *testing.T) {
 			expectRoles:  []string{},
 			expectError:  false,
 		},
+		{
+			name: "Single string groups and roles",
+			claims: map[string]interface{}{
+				"groups": "domain_users", // single string (not array)
+				"roles":  []interface{}{"role1"},
+			},
+			expectGroups: []string{"domain_users"},
+			expectRoles:  []string{"role1"},
+			expectError:  false,
+		},
 		{
 			name: "Invalid groups format",
 			claims: map[string]interface{}{
-				"groups": "not-an-array",
+				"groups": 12345, // non-string, non-array scalar
 				"roles":  []interface{}{"role1"},
 			},
 			expectError: true,