Filter roles when querying role service

src/layman/authz/role_service.py

@@ -1,6 +1,7 @@
 from db import util as db_util
 from layman import settings
 
+ROLE_NAME_PATTERN = r'^[A-Z][A-Z0-9]*(?:_[A-Z0-9]+)*$'
 ROLE_SERVICE_SCHEMA = settings.LAYMAN_INTERNAL_ROLE_SERVICE_SCHEMA
 
 
@@ -25,6 +26,12 @@ def ensure_admin_roles():
 
 
 def get_user_roles(username):
-    query = f"""select rolename from {ROLE_SERVICE_SCHEMA}.user_roles where username = %s"""
-    roles = db_util.run_query(query, (username, ))
+    query = f"""
+select rolename from {ROLE_SERVICE_SCHEMA}.user_roles
+where username = %s
+  and rolename not in (%s, %s, %s)
+  and LEFT(rolename, 5) != 'USER_'
+  and rolename ~ %s
+"""
+    roles = db_util.run_query(query, (username, 'ADMIN', 'GROUP_ADMIN', settings.LAYMAN_GS_ROLE, ROLE_NAME_PATTERN))
     return {role[0] for role in roles}