feat(oidc): add roles_claim and jwt:roles policy support (#2509)

Co-authored-by: GatewayJ <8352692332qq.com>
Co-authored-by: houseme <housemecn@gmail.com>
Co-authored-by: loverustfs <hello@rustfs.com>

crates/policy/src/policy/function/key_name.rs

@@ -79,6 +79,7 @@ impl KeyName {
         KeyName::Jwt(JwtKeyName::JWTName),
         KeyName::Jwt(JwtKeyName::JWTUpn),
         KeyName::Jwt(JwtKeyName::JWTGroups),
+        KeyName::Jwt(JwtKeyName::JWTRoles),
         KeyName::Jwt(JwtKeyName::JWTGivenName),
         KeyName::Jwt(JwtKeyName::JWTFamilyName),
         KeyName::Jwt(JwtKeyName::JWTMiddleName),
@@ -231,6 +232,9 @@ pub enum JwtKeyName {
     #[strum(serialize = "jwt:groups")]
     JWTGroups,
 
+    #[strum(serialize = "jwt:roles")]
+    JWTRoles,
+
     #[strum(serialize = "jwt:given_name")]
     JWTGivenName,
 
@@ -403,4 +407,9 @@ mod tests {
         let data = serde_json::to_string(&TestCase { data: value }).expect("marshal failed");
         assert_eq!(data, except);
     }
+
+    #[test]
+    fn key_name_from_str_supports_jwt_roles() {
+        assert!(KeyName::try_from("jwt:roles").is_ok());
+    }
 }

crates/policy/src/policy/function/string.rs

@@ -320,6 +320,31 @@ mod tests {
         pollster::block_on(result) ^ negate
     }
 
+    #[test]
+    fn test_jwt_roles_condition_uses_roles_values() {
+        assert!(test_eval(
+            new_fkv("jwt:roles", vec!["RustFS.ConsoleAdmin"]),
+            false,
+            false,
+            false,
+            vec![("roles", vec!["RustFS.ConsoleAdmin"])]
+        ));
+        assert!(!test_eval(
+            new_fkv("jwt:roles", vec!["RustFS.ConsoleAdmin"]),
+            false,
+            false,
+            false,
+            vec![("roles", vec!["readonly"])]
+        ));
+        assert!(!test_eval(
+            new_fkv("jwt:roles", vec!["RustFS.ConsoleAdmin"]),
+            false,
+            false,
+            false,
+            vec![("groups", vec!["RustFS.ConsoleAdmin"])]
+        ));
+    }
+
     #[test_case(new_fkv("s3:x-amz-copy-source", vec!["mybucket/myobject"]), false, vec![("x-amz-copy-source", vec!["mybucket/myobject"])] => true ; "1")]
     #[test_case(new_fkv("s3:x-amz-copy-source", vec!["mybucket/myobject"]), false, vec![("x-amz-copy-source", vec!["yourbucket/myobject"])] => false ; "2")]
     #[test_case(new_fkv("s3:x-amz-copy-source", vec!["mybucket/myobject"]), false, vec![] => false ; "3")]