added additional_role_id when checking the roles

handlers/authorize.go

@@ -147,6 +147,13 @@ func collectClaimRoles(claims *models.Claims) []int {
 		}
 	}
 
+	for _, role := range claims.AdditionalRoleID {
+		if _, exists := unique[role]; !exists {
+			unique[role] = struct{}{}
+			roles = append(roles, role)
+		}
+	}
+
 	for _, project := range claims.Projects {
 		for _, role := range project.RoleID {
 			if _, exists := unique[role]; !exists {

handlers/authorize_test.go

@@ -424,3 +424,19 @@ func TestCollectRequestedRolesFromArray(t *testing.T) {
 		t.Fatalf("unexpected requested roles: %v", result)
 	}
 }
+
+func TestCollectClaimRolesIncludesAdditionalRoles(t *testing.T) {
+	claims := &models.Claims{
+		RoleID:           models.RoleIDs{30},
+		AdditionalRoleID: models.RoleIDs{4, 5, 30},
+	}
+
+	roles := collectClaimRoles(claims)
+	if len(roles) != 3 {
+		t.Fatalf("expected 3 unique roles, got %d (%v)", len(roles), roles)
+	}
+
+	if roles[0] != 30 || roles[1] != 4 || roles[2] != 5 {
+		t.Fatalf("unexpected role order/content: %v", roles)
+	}
+}