fix: lower case role provisioning

src/env.mjs

@@ -130,6 +130,8 @@ export const env = createEnv({
 
     AUTH_SYNC_OIDC_ROLES_ON_LOGIN: process.env.AUTH_SYNC_OIDC_ROLES_ON_LOGIN,
 
+    AUTH_ROLE_MAP: process.env.AUTH_ROLE_MAP,
+
     AUTH_ALLOW_LINKING: process.env.AUTH_ALLOW_LINKING,
     AUTH_ALLOW_UNLINKING: process.env.AUTH_ALLOW_UNLINKING,
 

src/lib/auth/auth.ts

@@ -187,16 +187,33 @@ export const auth = betterAuth({
         const roleMapStr = oidcProvider?.roleMap;
 
         const rawGroups = userInfo?.groups || userInfo?.roles || [];
+
         const userGroups: string[] = Array.isArray(rawGroups)
-          ? rawGroups
-          : [rawGroups];
+          ? rawGroups.reduce((carry: string[], group) => {
+              carry.push(String(group).toLowerCase());
+              return carry;
+            }, [])
+          : [String(rawGroups).toLowerCase()];
 
         let roleToAssign: string | undefined;
 
         if (roleMapStr) {
           const mappings = roleMapStr.split(",").map((m) => m.split(":"));
           for (const [group, role] of mappings) {
+            console.log(
+              "Checking role mapping:",
+              group.trim(),
+              "against user groups:",
+              userGroups,
+            );
+
             if (userGroups.includes(group.trim())) {
+              console.log(
+                "Role mapping matched for group:",
+                group.trim(),
+                "->",
+                role.trim(),
+              );
               roleToAssign = role.trim();
               break;
             }