fix(oidc): roles in userinfo for client credentials token (#7763)

* fix(oidc): roles in userinfo for client credentials token

When tokens were obtained using the client credentials grant,
with audience and role scopes, userinfo would not return the role claims. This had multiple causes:

1. There is no auth request flow, so for legacy userinfo project data was never attached to the token
2. For optimized userinfo, there is no client ID that maps to an application. The client ID for client credentials is the machine user's name. There we can't obtain a project ID. When the project ID remained empty, we always ignored the roleAudience.

This PR fixes situation 2, by always taking the roleAudience into account, even when the projectID is empty. The code responsible for the bug is also refactored to be more readable and understandable, including additional godoc.

The fix only applies to the optimized userinfo code introduced in #7706 and released in v2.50 (currently in RC). Therefore it can't be back-ported to earlier versions.

Fixes #6662

* chore(deps): update all go deps (#7764)

This change updates all go modules, including oidc, a major version of go-jose and the go 1.22 release.

* Revert "chore(deps): update all go deps" (#7772)

Revert "chore(deps): update all go deps (#7764)"

This reverts commit 6893e7d060.

---------

Co-authored-by: Livio Spring <livio.a@gmail.com>

internal/api/oidc/userinfo.go

@@ -53,18 +53,28 @@ func (s *Server) UserInfo(ctx context.Context, r *op.Request[oidc.UserInfoReques
 		}
 	}
 
-	userInfo, err := s.userInfo(ctx, token.userID, projectID, assertion, token.scope, nil)
+	userInfo, err := s.userInfo(ctx, token.userID, token.scope, projectID, assertion, false)
 	if err != nil {
 		return nil, err
 	}
 	return op.NewResponse(userInfo), nil
 }
 
-func (s *Server) userInfo(ctx context.Context, userID, projectID string, projectRoleAssertion bool, scope, roleAudience []string) (_ *oidc.UserInfo, err error) {
+// userInfo gets the user's data based on the scope.
+// The returned UserInfo contains standard and reserved claims, documented
+// here: https://zitadel.com/docs/apis/openidoauth/claims.
+//
+// projectID is an optional parameter which defines the default audience when there are any (or all) role claims requested.
+// projectRoleAssertion sets the default of returning all project roles, only if no specific roles were requested in the scope.
+//
+// currentProjectOnly can be set to use the current project ID only and ignore the audience from the scope.
+// It should be set in cases where the client doesn't need to know roles outside its own project,
+// for example an introspection client.
+func (s *Server) userInfo(ctx context.Context, userID string, scope []string, projectID string, projectRoleAssertion, currentProjectOnly bool) (_ *oidc.UserInfo, err error) {
 	ctx, span := tracing.NewSpan(ctx)
 	defer func() { span.EndWithError(err) }()
 
-	roleAudience, requestedRoles := prepareRoles(ctx, projectID, projectRoleAssertion, scope, roleAudience)
+	roleAudience, requestedRoles := prepareRoles(ctx, scope, projectID, projectRoleAssertion, currentProjectOnly)
 	qu, err := s.query.GetOIDCUserInfo(ctx, userID, roleAudience)
 	if err != nil {
 		return nil, err
@@ -74,31 +84,35 @@ func (s *Server) userInfo(ctx context.Context, userID, projectID string, project
 	return userInfo, s.userinfoFlows(ctx, qu, userInfo)
 }
 
-// prepareRoles scans the requested scopes, appends to roleAudience and returns the requestedRoles.
+// prepareRoles scans the requested scopes and builds the requested roles
+// and the audience for which roles need to be asserted.
 //
 // Scopes with [ScopeProjectRolePrefix] are added to requestedRoles.
-// When [ScopeProjectsRoles] is present and roleAudience was empty,
-// project IDs with the [domain.ProjectIDScope] prefix are added to the roleAudience.
+// When [ScopeProjectsRoles] is present project IDs with the [domain.ProjectIDScope]
+// prefix are added to the returned audience.
 //
-// If projectRoleAssertion is true and the resulting requestedRoles or roleAudience are not empty,
-// the current projectID will always be parts or roleAudience.
-// Else nil, nil is returned.
-func prepareRoles(ctx context.Context, projectID string, projectRoleAssertion bool, scope, roleAudience []string) (ra, requestedRoles []string) {
-	// if all roles are requested take the audience for those from the scopes
-	if slices.Contains(scope, ScopeProjectsRoles) && len(roleAudience) == 0 {
-		roleAudience = domain.AddAudScopeToAudience(ctx, roleAudience, scope)
-	}
-	requestedRoles = make([]string, 0, len(scope))
+// If projectRoleAssertion is true and there were no specific roles requested,
+// the current projectID will always be parts of the returned audience.
+func prepareRoles(ctx context.Context, scope []string, projectID string, projectRoleAssertion, currentProjectOnly bool) (roleAudience, requestedRoles []string) {
 	for _, s := range scope {
 		if role, ok := strings.CutPrefix(s, ScopeProjectRolePrefix); ok {
 			requestedRoles = append(requestedRoles, role)
 		}
 	}
-	if !projectRoleAssertion && len(requestedRoles) == 0 && len(roleAudience) == 0 {
-		return nil, nil
+
+	// If roles are requested take the audience for those from the scopes,
+	// when currentProjectOnly is not set.
+	if !currentProjectOnly && (len(requestedRoles) > 0 || slices.Contains(scope, ScopeProjectsRoles)) {
+		roleAudience = domain.AddAudScopeToAudience(ctx, roleAudience, scope)
 	}
 
-	if projectID != "" && !slices.Contains(roleAudience, projectID) {
+	// When either:
+	// - Project role assertion is set;
+	// - Roles for the current project (only) are requested;
+	// - There is already a roleAudience requested through scope;
+	// - There are requested roles through the scope;
+	// and the projectID is not empty, projectID must be part of the roleAudience.
+	if (projectRoleAssertion || currentProjectOnly || len(roleAudience) > 0 || len(requestedRoles) > 0) && projectID != "" && !slices.Contains(roleAudience, projectID) {
 		roleAudience = append(roleAudience, projectID)
 	}
 	return roleAudience, requestedRoles