@@ -28,6 +28,45 @@ func TestUserOIDC(t *testing.T) {
2828t .Run ("RoleSync" ,func (t * testing.T ) {
2929t .Parallel ()
3030
31+ t .Run ("NoRoles" ,func (t * testing.T ) {
32+ t .Parallel ()
33+
34+ ctx := testutil .Context (t ,testutil .WaitMedium )
35+ conf := coderdtest .NewOIDCConfig (t ,"" )
36+
37+ oidcRoleName := "TemplateAuthor"
38+
39+ config := conf .OIDCConfig (t , jwt.MapClaims {},func (cfg * coderd.OIDCConfig ) {
40+ cfg .UserRoleMapping = map [string ][]string {oidcRoleName : {rbac .RoleTemplateAdmin (),rbac .RoleUserAdmin ()}}
41+ })
42+ config .AllowSignups = true
43+ config .UserRoleField = "roles"
44+
45+ client ,_ := coderdenttest .New (t ,& coderdenttest.Options {
46+ Options :& coderdtest.Options {
47+ OIDCConfig :config ,
48+ },
49+ LicenseOptions :& coderdenttest.LicenseOptions {
50+ Features : license.Features {codersdk .FeatureUserRoleManagement :1 },
51+ },
52+ })
53+
54+ admin ,err := client .User (ctx ,"me" )
55+ require .NoError (t ,err )
56+ require .Len (t ,admin .OrganizationIDs ,1 )
57+
58+ resp := oidcCallback (t ,client ,conf .EncodeClaims (t , jwt.MapClaims {
59+ "email" :"alice@coder.com" ,
60+ }))
61+ require .Equal (t ,http .StatusTemporaryRedirect ,resp .StatusCode )
62+ user ,err := client .User (ctx ,"alice" )
63+ require .NoError (t ,err )
64+
65+ require .Len (t ,user .Roles ,0 )
66+ roleNames := []string {}
67+ require .ElementsMatch (t ,roleNames , []string {})
68+ })
69+
3170t .Run ("NewUserAndRemoveRoles" ,func (t * testing.T ) {
3271t .Parallel ()
3372