ENT-1556 - Adding in roles claim to jwt for use with edx rbac

Adding logic that adds roles to jwt

Quality fixes

openedx/core/djangoapps/oauth_dispatch/jwt.py

@@ -6,6 +6,8 @@ from django.conf import settings
 from jwkest import jwk
 from jwkest.jws import JWS
 
+from edx_rbac.utils import create_role_auth_claim_for_user
+
 from edx_django_utils.monitoring import set_custom_metric
 from openedx.core.djangoapps.oauth_dispatch.toggles import ENFORCE_JWT_SCOPES
 from student.models import UserProfile, anonymous_id_for_user
@@ -122,6 +124,9 @@ def _create_jwt(
     }
     payload.update(additional_claims or {})
     _update_from_additional_handlers(payload, user, scopes)
+    role_claims = create_role_auth_claim_for_user(user)
+    if role_claims:
+        payload['roles'] = role_claims
     return _encode_and_sign(payload, use_asymmetric_key, secret)
 
 

openedx/core/djangoapps/oauth_dispatch/tests/test_jwt.py

@@ -2,6 +2,8 @@
 import itertools
 from datetime import timedelta
 
+from mock import patch
+
 import ddt
 from django.test import TestCase
 from django.utils.timezone import now
@@ -82,8 +84,10 @@ class TestCreateJWTs(AccessTokenMixin, TestCase):
             )
             self._assert_jwt_is_valid(jwt_token, should_be_asymmetric_key=scopes_enforced and client_restricted)
 
+    @patch('openedx.core.djangoapps.oauth_dispatch.jwt.create_role_auth_claim_for_user')
     @ddt.data(True, False)
-    def test_create_jwt_for_user(self, user_email_verified):
+    def test_create_jwt_for_user(self, user_email_verified, mock_create_roles):
+        mock_create_roles.return_value = ['superuser', 'enterprise-admin']
         self.user.is_active = user_email_verified
         self.user.save()
 
@@ -96,3 +100,4 @@ class TestCreateJWTs(AccessTokenMixin, TestCase):
         )
         self.assertDictContainsSubset(additional_claims, token_payload)
         self.assertEqual(user_email_verified, token_payload['email_verified'])
+        self.assertEqual(token_payload['roles'], mock_create_roles.return_value)