Make user roles available in approval policies input data

Workaround

Use the IdP provided groups or enable login policies to automatically adds groups to users that have a certain role.

Problem

Our organisation uses a somewhat special approach towards authn/authz, where the IdP only provides authentication. Authorisation is managed via a system of temporary permissions. We are in the process of implementing this approach in Spacelift. The process is as follows: - We a predefine a set of Spacelift roles. - The basic role, is given to every user allowed to login by the IdP. This is a red only role. - For the remaining roles, users request them via a CLI tool, for a specific space, for a predefined amount of time. - This tool, invokes a service that using the Spacelift graphql API binds roles to spaces and users during x amount of time - Once that time passes, the binding is deleted. The issue comes when we need to verify approvals, as the roles are not available in the approval policy, so we have to resort to IdP group membership, which breaks a bit our patterns. We know that we could enable login policies, and make a mapping between roles and groups, so when a user with certain role logs in automatically gets a specific group, but this would force us to enable login policies only for that specific case, losing all the simplicity of the user management. This is why we would like to make the roles available as part of the input data of the approval policy.