[CORL-476] Add badges to user from SSO token (#2470)

* fix: bug in lookup not checking object properly before accessing

* fix: Recursive types not handling optional arrays

* add user badges component

* create user badges from sso token

* update badges type

* revert src/core/client/embed/index.html

* remove duplicated line

* add user badges component

* create user badges from sso token

* revert src/core/client/embed/index.html

* remove duplicated line

* fix types

* fix tests and snaps

* add user badges to user drawer

* update snaps

* update readme

* [CORL-476] add user role from SSO token (#2475)

* add role from token

* use joi to validate role values

Co-Authored-By: Wyatt Johnson <wyattjoh@gmail.com>

* simplify sso.role validation

* add test for invalid role in sso token

src/core/server/models/user/helpers.ts

@@ -1,5 +1,8 @@
+import { isEqual } from "lodash";
+
 import { GQLUSER_ROLE } from "coral-server/graph/tenant/schema/__generated__/types";
 
+import { SSOUserProfile } from "coral-server/app/middleware/passport/strategies/verifiers/sso";
 import { STAFF_ROLES } from "./constants";
 import { LocalProfile, SSOProfile, User } from "./user";
 
@@ -22,10 +25,15 @@ export function getSSOProfile(user: Pick<User, "profiles">) {
 }
 
 export function needsSSOUpdate(
-  token: Pick<User, "email" | "username">,
-  user: Pick<User, "email" | "username">
+  token: SSOUserProfile,
+  user: Pick<User, "email" | "username" | "badges" | "role">
 ) {
-  return user.email !== token.email || user.username !== token.username;
+  return (
+    user.email !== token.email ||
+    user.username !== token.username ||
+    (token.role && user.role !== token.role) ||
+    !isEqual(user.badges, token.badges)
+  );
 }
 
 /**

src/core/server/models/user/user.ts

@@ -292,6 +292,12 @@ export interface User extends TenantResource {
    */
   email?: string;
 
+  /**
+   *
+   * badges are user display badges
+   */
+  badges?: string[];
+
   /**
    * emailVerificationID is used to store state regarding the verification state
    * of an email address to prevent replay attacks.
@@ -668,6 +674,8 @@ export async function updateUserPassword(
 export interface UpdateUserInput {
   email?: string;
   username?: string;
+  badges?: string[];
+  role?: GQLUSER_ROLE;
 }
 
 export async function updateUserFromSSO(
@@ -677,7 +685,7 @@ export async function updateUserFromSSO(
   update: UpdateUserInput,
   lastIssuedAt: Date
 ) {
-  // Update the user with the new password.
+  // Update the user with the new properties.
   const result = await collection(mongo).findOneAndUpdate(
     {
       tenantID,