change: use RFC 9535 syntax for jwt-role-claim-key config

BREAKING CHANGE

Breaks the string comparison operators implemented in #3813. Those can
be replaced with regex searches using JSON Path `search()` function.

Signed-off-by: Taimoor Zaeem <taimoorzaeem@gmail.com>

test/io/fixtures/db_config.sql

@@ -17,7 +17,7 @@ ALTER ROLE db_config_authenticator SET pgrst.db_timezone_enabled = 'false';
 ALTER ROLE db_config_authenticator SET pgrst.db_tx_end = 'commit-allow-override';
 ALTER ROLE db_config_authenticator SET pgrst.jwt_aud = 'https://example.org';
 ALTER ROLE db_config_authenticator SET pgrst.jwt_cache_max_entries = '86400';
-ALTER ROLE db_config_authenticator SET pgrst.jwt_role_claim_key = '."a"."role"';
+ALTER ROLE db_config_authenticator SET pgrst.jwt_role_claim_key = '$.a.role';
 ALTER ROLE db_config_authenticator SET pgrst.jwt_secret = 'REALLY=REALLY=REALLY=REALLY=VERY=SAFE';
 ALTER ROLE db_config_authenticator SET pgrst.jwt_secret_is_base64 = 'false';
 ALTER ROLE db_config_authenticator SET pgrst.not_existing = 'should be ignored';
@@ -93,7 +93,7 @@ returns void as $$
 begin
   if current_user = 'other_authenticator' then
     perform
-      set_config('pgrst.jwt_role_claim_key', '."other"."pre_config_role"', true)
+      set_config('pgrst.jwt_role_claim_key', '$.other.pre_config_role', true)
     , set_config('pgrst.db_anon_role', 'pre_config_role', true)
     , set_config('pgrst.db_schemas', 'will be overriden with the above ALTER ROLE.. db_schemas', true)
     , set_config('pgrst.db_tx_end', 'rollback-allow-override', true);

test/io/fixtures/fixtures.yaml

@@ -120,13 +120,13 @@ cli:
       PGRST_DB_TX_END: rollback
 
 roleclaims:
-  - key: '.postgrest.a_role'
+  - key: '$.postgrest.a_role'
     data:
       postgrest:
         a_role: postgrest_test_author
       other: claims
     expected_status: 200
-  - key: '.customObject.manyRoles[1]'
+  - key: '$.customObject.manyRoles[1]'
     data:
       customObject:
         manyRoles:
@@ -134,92 +134,60 @@ roleclaims:
           - postgrest_test_author
       other: {}
     expected_status: 200
-  - key: '."https://www.example.com/roles"[0].value'
+  - key: '$["https://www.example.com/roles"][0].value'
     data:
       'https://www.example.com/roles':
         - value: postgrest_test_author
       other: 666
     expected_status: 200
-  - key: '.myDomain[3]'
+  - key: '$.myDomain[3]'
     data:
       myDomain:
         - other
         - postgrest_test_author
       other: 1.23
     expected_status: 401
-  - key: '.myRole'
+  - key: '$.myRole'
     data:
       role: postgrest_test_author
       other: true
     expected_status: 401
-  # https://github.com/PostgREST/postgrest/pull/3813
-  - key: '.realm_access.roles[?(@ == "postgrest_test_author")]'
+  - key: '$.realm_access.roles[?(@ == "postgrest_test_author")]'
     data:
       realm_access:
         roles:
           - other
           - postgrest_test_author
     expected_status: 200
-  - key: '.realm_access.roles[?(@ != "other")]'
+  - key: '$.realm_access.roles[?(@ != "other")]'
     data:
       realm_access:
         roles:
           - other
           - postgrest_test_author
     expected_status: 200
-  - key: '.realm_access.roles[?(@ ^== "postgrest_te")]'
-    data:
-      realm_access:
-        roles:
-          - other
-          - postgrest_test_author
-    expected_status: 200
-  - key: '.realm_access.roles[?(@ ==^ "st_test_author")]'
-    data:
-      realm_access:
-        roles:
-          - other
-          - postgrest_test_author
-    expected_status: 200
-  - key: '.realm_access.roles[?(@ *== "_test_")]'
-    data:
-      realm_access:
-        roles:
-          - other
-          - postgrest_test_author
-    expected_status: 200
-  - key: '.realm_access.roles[?(@ == "string")]'
-    data:
-      realm_access:
-        roles:
-          - obj_key: obj_value
-    expected_status: 401 # fails because it compares an object with a string
 
 jwtaudroleclaims:
-  - key: '.aud'
+  - key: '$.aud'
     data:
       aud: postgrest_test_author
     expected_status: 200
-  - key: '.aud'
+  - key: '$.aud'
     data:
       aud: postgrest_test_invalid
     expected_status: 401
-  - key: '.aud[0]'
+  - key: '$.aud[0]'
     data:
       aud: [postgrest_test_author]
     expected_status: 200
-  - key: '.aud[1]' # succeeds the aud claims check, but fail when hits the db
+  - key: '$.aud[1]' # succeeds the aud claims check, but fail when hits the db
     data:
       aud: [postgrest_test_author, postgrest_test_invalid]
     expected_status: 401
 
 invalidroleclaimkeys:
-  - 'role.other'
-  - '.role##'
-  - '.my_role;;domain'
-  - '.#$$%&$%/'
-  - '1234'
-  - '.role[?(@ =)]'
+  - '.role.other'
+  - '$.my_role;;domain'
 
 invalidopenapimodes:
   - 'follow-'