fix: dont crash if users have no roles when refreshing token (#511)

* fix: dont crash if users have no roles when refreshing token

* asd

go/controller/post_token_test.go

@@ -83,8 +83,8 @@ func TestPostToken(t *testing.T) { //nolint:maintidx
 						),
 					}),
 				).Return([]sql.RefreshTokenAndGetUserRolesRow{
-					{Role: "user", RefreshTokenID: tokenID},
-					{Role: "me", RefreshTokenID: tokenID},
+					{Role: sql.Text("user"), RefreshTokenID: tokenID},
+					{Role: sql.Text("me"), RefreshTokenID: tokenID},
 				}, nil)
 
 				return mock
@@ -167,7 +167,7 @@ func TestPostToken(t *testing.T) { //nolint:maintidx
 						),
 					}),
 				).Return([]sql.RefreshTokenAndGetUserRolesRow{
-					{Role: "anonymous", RefreshTokenID: tokenID},
+					{Role: sql.Text("anonymous"), RefreshTokenID: tokenID},
 				}, nil)
 
 				return mock

go/controller/workflows.go

@@ -297,7 +297,7 @@ func (wf *Workflows) GetUserByRefreshTokenHash(
 	return user, nil
 }
 
-func (wf *Workflows) UpdateSession(
+func (wf *Workflows) UpdateSession( //nolint:funlen
 	ctx context.Context,
 	user sql.AuthUser,
 	refreshToken string,
@@ -314,9 +314,15 @@ func (wf *Workflows) UpdateSession(
 		return &api.Session{}, ErrInvalidRefreshToken //nolint:exhaustruct
 	}
 
-	allowedRoles := make([]string, len(userRoles))
-	for i, role := range userRoles {
-		allowedRoles[i] = role.Role
+	allowedRoles := make([]string, 0, len(userRoles))
+	for _, role := range userRoles {
+		if role.Role.Valid {
+			allowedRoles = append(allowedRoles, role.Role.String)
+		}
+	}
+
+	if !slices.Contains(allowedRoles, user.DefaultRole) {
+		allowedRoles = append(allowedRoles, user.DefaultRole)
 	}
 
 	accessToken, expiresIn, err := wf.jwtGetter.GetToken(

go/sql/query.sql

@@ -159,7 +159,7 @@ updated_user AS (
     WHERE auth.users.id = refreshed_token.user_id
 )
 SELECT refreshed_token.refresh_token_id, role FROM auth.user_roles
-JOIN refreshed_token ON auth.user_roles.user_id = refreshed_token.user_id;
+RIGHT JOIN refreshed_token ON auth.user_roles.user_id = refreshed_token.user_id;
 
 -- name: UpdateUserLastSeen :one
 UPDATE auth.users