fix merged claims

Emyrk · Emyrk · commit 7be88017ee81 · 2023-11-22T09:20:05.000-06:00
diff --git a/coderd/database/dbauthz/dbauthz_test.go b/coderd/database/dbauthz/dbauthz_test.go
@@ -1022,6 +1022,7 @@ func (s *MethodTestSuite) TestUser() {
 			OAuthExpiry:       link.OAuthExpiry,
 			UserID:            link.UserID,
 			LoginType:         link.LoginType,
+			DebugContext:      json.RawMessage("{}"),
 		}).Asserts(link, rbac.ActionUpdate).Returns(link)
 	}))
 	s.Run("UpdateUserRoles", s.Subtest(func(db database.Store, check *expects) {
diff --git a/coderd/userauth.go b/coderd/userauth.go
@@ -800,7 +800,8 @@ func (api *API) userOIDC(rw http.ResponseWriter, r *http.Request) {
 	// UserInfo endpoint, so we allow users to disable it and only rely on the
 	// ID token.
 	userInfoClaims := make(map[string]interface{})
-	mergedClaims := make(map[string]interface{})
+	// If user info is skipped, the idtokenClaims are the claims.
+	mergedClaims := idtokenClaims
 	if !api.OIDCConfig.IgnoreUserInfo {
 		userInfo, err := api.OIDCConfig.Provider.UserInfo(ctx, oauth2.StaticTokenSource(state.Token))
 		if err == nil {
