Make SAML role mapping optional

Signed-off-by: Bryan Frimin <bryan@getprobo.com>

pkg/auth/saml_mapper.go

@@ -77,12 +77,13 @@ func ExtractEmailDomain(email string) (string, error) {
 	return domain, nil
 }
 
-func MapSAMLRoleToSystemRole(samlRole string) coredata.Role {
+func MapSAMLRoleToSystemRole(samlRole string) *coredata.Role {
 	if samlRole != "" && isValidRole(samlRole) {
-		return coredata.Role(samlRole)
+		role := coredata.Role(samlRole)
+		return &role
 	}
 
-	return coredata.RoleMember
+	return nil
 }
 
 func isValidRole(role string) bool {

pkg/auth/saml_service.go

@@ -407,7 +407,7 @@ func (s *SAMLService) InitiateSAMLLogin(
 type SAMLUserInfo struct {
 	Email          string
 	FullName       string
-	Role           coredata.Role
+	Role           *coredata.Role
 	SAMLSubject    string
 	OrganizationID gid.GID
 	SAMLConfigID   gid.GID

pkg/authz/service.go

@@ -827,7 +827,7 @@ func (s *TenantAuthzService) EnsureSAMLMembership(
 	ctx context.Context,
 	userID gid.GID,
 	organizationID gid.GID,
-	role coredata.Role,
+	role *coredata.Role,
 ) error {
 	now := time.Now()
 
@@ -842,12 +842,17 @@ func (s *TenantAuthzService) EnsureSAMLMembership(
 					return fmt.Errorf("cannot load membership: %w", err)
 				}
 
+				membershipRole := coredata.RoleMember
+				if role != nil {
+					membershipRole = *role
+				}
+
 				membershipID := gid.New(s.scope.GetTenantID(), coredata.MembershipEntityType)
 				membership = coredata.Membership{
 					ID:             membershipID,
 					UserID:         userID,
 					OrganizationID: organizationID,
-					Role:           role,
+					Role:           membershipRole,
 					CreatedAt:      now,
 					UpdatedAt:      now,
 				}
@@ -859,8 +864,8 @@ func (s *TenantAuthzService) EnsureSAMLMembership(
 				return nil
 			}
 
-			if membership.Role != role {
-				membership.Role = role
+			if role != nil && membership.Role != *role {
+				membership.Role = *role
 				membership.UpdatedAt = now
 
 				if err := membership.Update(ctx, tx, s.scope); err != nil {