fix(oidc): parse JSON array strings in mapstructure decode hook

[redhat-chai-bot]

Summary

Fix stringOrSliceDecodeHook to correctly parse JSON array strings when loading tenant config via mapstructure.Decode.

Problem

When GroupClaim is set to ["org_id", "rh-org-id"] in the config (generated by configuration_go where GroupClaim is typed string), the YAML serializes it as a quoted string:

groupClaim: '["org_id", "rh-org-id"]'

The stringOrSliceDecodeHook wraps this as StringOrSlice{"[\"org_id\", \"rh-org-id\"]"} — a single-element slice containing the literal JSON text. The runtime then looks for a claim named ["org_id", "rh-org-id"] in the JWT, which doesn't exist, returning "group cannot be empty".

Fix

In the case string: branch, try json.Unmarshal first to detect JSON-encoded arrays before falling back to single-element wrapping:

case string:
    var arr []string
    if err := json.Unmarshal([]byte(v), &arr); err == nil {
        return StringOrSlice(arr), nil
    }
    return StringOrSlice{v}, nil

Tests

6 new test cases:

• 3 integration tests via TestCheckAuthMapstructureJSONArrayString (full OIDC flow with mapstructure-loaded config)
• 3 unit tests via TestStringOrSliceDecodeHookJSONArrayString (decode hook directly)

Related

• RHOBS-1802 — rh-org-id claim support (blocked by this bug)
• RHOBS-1795 — Ordered claim list feature (PR feat: accept ordered list of claim names for OIDC username and group claims #66)

---

AI-generated. Review for accuracy.

@philipgough requested from Slack

[philipgough]

/lgtm