From 1f0e3250af51d56951f379fe5a0117b617562195 Mon Sep 17 00:00:00 2001
From: Hermes Agent <hermes@litecharms.co.za>
Date: Sun, 13 Sep 2026 11:02:52 +0200
Subject: [PATCH] Ensured claims injector is more exhaustive

---
 .../Services/ClaimsInjectorProfileService.cs  | 27 +++++++++++++++----
 .../Services/OpenIdClaimsMappingConfig.cs     | 13 ++-------
 2 files changed, 24 insertions(+), 16 deletions(-)

diff --git a/src/LiteCharmsSecurity.STS.Identity/Services/ClaimsInjectorProfileService.cs b/src/LiteCharmsSecurity.STS.Identity/Services/ClaimsInjectorProfileService.cs
index 1264c8c..e113224 100644
--- a/src/LiteCharmsSecurity.STS.Identity/Services/ClaimsInjectorProfileService.cs
+++ b/src/LiteCharmsSecurity.STS.Identity/Services/ClaimsInjectorProfileService.cs
@@ -2,6 +2,8 @@
 using Duende.IdentityServer.Services;
 using LiteCharmsSecurity.Admin.EntityFramework.Shared.Entities.Identity;
 using Microsoft.AspNetCore.Identity;
+using System.Collections.Generic;
+using System.Linq;
 using System.Security.Claims;
 using System.Threading;
 using System.Threading.Tasks;
@@ -16,15 +18,30 @@ public sealed class ClaimsInjectorProfileService(UserManager<UserIdentity> userM
     public async Task GetProfileDataAsync(ProfileDataRequestContext context, CancellationToken ct)
     {
         var user = await userManager.GetUserAsync(context.Subject);
+
         if (user != null && !string.IsNullOrEmpty(user.Email))
         {
-            context.IssuedClaims.Add(new Claim("email", user.Email));
-            context.IssuedClaims.Add(new Claim("email_verified", user.EmailConfirmed ? "true" : "false"));
+            var claims = new List<Claim>
+            {
+                new("email", user.Email),
+                new("email_verified", user.EmailConfirmed ? "true" : "false")
+            };
 
             if (!string.IsNullOrEmpty(user.UserName))
-            {
-                context.IssuedClaims.Add(new Claim("preferred_username", user.UserName));
-            }
+                claims.Add(new Claim("preferred_username", user.UserName));
+
+            var roles = await userManager.GetRolesAsync(user);
+
+            foreach (var role in roles)
+                claims.Add(new Claim("role", role));
+
+            var userClaims = await userManager.GetClaimsAsync(user);
+
+            foreach (var claim in userClaims)
+                if (!claims.Any(c => c.Type == claim.Type && c.Value == claim.Value))
+                    claims.Add(claim);
+            
+            context.IssuedClaims = claims;
         }
     }
 
diff --git a/src/LiteCharmsSecurity.STS.Identity/Services/OpenIdClaimsMappingConfig.cs b/src/LiteCharmsSecurity.STS.Identity/Services/OpenIdClaimsMappingConfig.cs
index c48bbba..6b02100 100644
--- a/src/LiteCharmsSecurity.STS.Identity/Services/OpenIdClaimsMappingConfig.cs
+++ b/src/LiteCharmsSecurity.STS.Identity/Services/OpenIdClaimsMappingConfig.cs
@@ -1,23 +1,14 @@
-using System;
-using System.Linq;
 using Duende.IdentityServer.Hosting.DynamicProviders;
 using Duende.IdentityServer.Models;
-using Microsoft.AspNetCore.Authentication;
 using Microsoft.AspNetCore.Authentication.OpenIdConnect;
 using Microsoft.AspNetCore.Http;
-using LiteCharmsSecurity.STS.Identity.Helpers;
-using System.Security.Claims;
 using Microsoft.Extensions.Logging;
-using Microsoft.IdentityModel.Tokens;
 
 namespace LiteCharmsSecurity.STS.Identity.Services;
 
-public class OpenIdClaimsMappingConfig : ConfigureAuthenticationOptions<OpenIdConnectOptions, OidcProvider>
+public class OpenIdClaimsMappingConfig(IHttpContextAccessor httpContextAccessor, ILogger<ConfigureAuthenticationOptions<OpenIdConnectOptions, 
+    OidcProvider>> logger) : ConfigureAuthenticationOptions<OpenIdConnectOptions, OidcProvider>(httpContextAccessor, logger)
 {
-    public OpenIdClaimsMappingConfig(IHttpContextAccessor httpContextAccessor, ILogger<ConfigureAuthenticationOptions<OpenIdConnectOptions, OidcProvider>> logger) : base(httpContextAccessor, logger)
-    {
-    }
-    
     protected override void Configure(ConfigureAuthenticationContext<OpenIdConnectOptions, OidcProvider> context)
     {
         var oidcProvider = context.IdentityProvider;