[Bug] OIDC role mapping fails when OIDC_ROLE_* contains multiple comma-separated group names

[ChrisS85]

Disclosure: AI generated report, but I can confirm the workaround fixes my issue.

RomM version: 5.2.0

Describe the bug:
The docs (and code comments/examples) describe OIDC_ROLE_ADMIN/OIDC_ROLE_EDITOR/OIDC_ROLE_VIEWER as comma-separated lists of group names (e.g. OIDC_ROLE_ADMIN=romm-admin,platform-admins). However, in backend/config/__init__.py these env vars are read as raw strings with no comma-splitting:

OIDC_ROLE_VIEWER: Final[str | None] = _get_env("OIDC_ROLE_VIEWER")
OIDC_ROLE_EDITOR: Final[str | None] = _get_env("OIDC_ROLE_EDITOR")
OIDC_ROLE_ADMIN: Final[str | None] = _get_env("OIDC_ROLE_ADMIN")

And in backend/handler/auth/base_handler.py:

if OIDC_ROLE_ADMIN and OIDC_ROLE_ADMIN in roles:

This checks whether the entire raw string (e.g. "romm-admin,admins") is present as a single element in the roles list from the token's claim — it never matches, since the claim contains individual group names (e.g. ["users", "admins"]), not the joined string. As a result, any user whose access depends on a role mapped to more than one group name is rejected with:

{"detail": "User has not been granted any roles for this application."}

even when their token correctly contains a matching group.

To Reproduce:

1. Set OIDC_CLAIM_ROLES=groups
2. Set OIDC_ROLE_ADMIN=romm-admin,platform-admins (two names)
3. Log in as a user whose groups claim contains platform-admins but not the exact string romm-admin,platform-admins
4. Login is rejected with 403 "User has not been granted any roles for this application."

Expected behavior: Login should succeed and assign the role, since the user is a member of one of the listed groups — this is what the docs and env var naming (comma-separated list) imply.

Workaround: Only use a single group name per OIDC_ROLE_* variable (no commas).