Include user roles in routes manifest

src/Directory.Packages.props

@@ -82,6 +82,7 @@
     <PackageVersion Include="System.Reflection.MetadataLoadContext" Version="10.0.9" />
     <PackageVersion Include="System.ServiceProcess.ServiceController" Version="10.0.9" />
     <PackageVersion Include="Validar.Fody" Version="1.9.0" />
+    <PackageVersion Include="Verify.NUnit" Version="31.20.0" />
     <PackageVersion Include="Yarp.ReverseProxy" Version="2.3.0" />
   </ItemGroup>
   <ItemGroup Label="Versions to pin transitive references">

src/ServiceControl.Hosting/Auth/MyRoutesController.cs

@@ -1,18 +1,20 @@
 #nullable enable
 namespace ServiceControl.Hosting.Auth;
 
-using System.Collections.Generic;
+using System.Linq;
+using System.Security.Claims;
 using Microsoft.AspNetCore.Authorization;
 using Microsoft.AspNetCore.Mvc;
 using ServiceControl.Infrastructure;
 using ServiceControl.Infrastructure.Auth;
 
 /// <summary>
-/// Returns the API routes the current token may call, as <c>{ method, url_template }</c> entries.
-/// This is the per-instance authorization contract for clients (ServicePulse): each instance reports
-/// only the routes it serves, so a client matches its outgoing request against the allowed set without
-/// ever learning the server's internal permission vocabulary. The endpoint is the bootstrap of that
-/// contract, so it is reachable by any authenticated user ([Authorize], no specific permission).
+/// Returns the caller's role claims and the API routes the current token may call, as
+/// <c>{ method, url_template }</c> entries. This is the per-instance authorization contract for
+/// clients (ServicePulse): each instance reports only the routes it serves, so a client matches its
+/// outgoing request against the allowed set without ever learning the server's internal permission
+/// vocabulary. The endpoint is the bootstrap of that contract, so it is reachable by any authenticated
+/// user ([Authorize], no specific permission).
 /// </summary>
 [ApiController]
 [Route("api")]
@@ -21,9 +23,10 @@ public sealed class MyRoutesController(RouteAuthorizationTable table, OpenIdConn
 {
     [HttpGet]
     [Route("my/routes")]
-    public ActionResult<IReadOnlyList<RouteManifestEntry>> GetMyRoutes()
+    public ActionResult<MyRoutesResponse> GetMyRoutes()
     {
         var effective = EffectivePermissions.ForUser(User, settings);
-        return Ok(RouteManifestFilter.Filter(table.Entries, effective));
+        var roles = User.FindAll(ClaimTypes.Role).Select(claim => claim.Value).Distinct().ToArray();
+        return Ok(new MyRoutesResponse(roles, RouteManifestFilter.Filter(table.Entries, effective)));
     }
 }

src/ServiceControl.Infrastructure.Tests/Auth/RouteManifestEntrySerializationTests.Response_wraps_roles_and_routes_under_pinned_field_names.verified.txt

@@ -0,0 +1,11 @@
+{
+  roles: [
+    admin
+  ],
+  routes: [
+    {
+      method: GET,
+      url_template: /api/errors
+    }
+  ]
+}

src/ServiceControl.Infrastructure.Tests/Auth/RouteManifestEntrySerializationTests.cs

@@ -2,8 +2,10 @@
 namespace ServiceControl.Infrastructure.Tests.Auth;
 
 using System.Text.Json;
+using System.Threading.Tasks;
 using NUnit.Framework;
 using ServiceControl.Infrastructure.Auth;
+using VerifyNUnit;
 
 [TestFixture]
 class RouteManifestEntrySerializationTests
@@ -24,4 +26,16 @@ public void Emits_snake_case_field_names_even_under_a_camelCase_policy()
         Assert.That(json, Does.Contain("\"url_template\""));
         Assert.That(json, Does.Not.Contain("urlTemplate"));
     }
+
+    // Same contract as above, but for the response wrapper: roles are reported once at the top level,
+    // not duplicated onto every route entry.
+    [Test]
+    public Task Response_wraps_roles_and_routes_under_pinned_field_names()
+    {
+        var json = JsonSerializer.Serialize(
+            new MyRoutesResponse(["admin"], [new RouteManifestEntry("GET", "/api/errors")]),
+            new JsonSerializerOptions { PropertyNamingPolicy = JsonNamingPolicy.CamelCase });
+
+        return Verifier.VerifyJson(json);
+    }
 }

src/ServiceControl.Infrastructure.Tests/ServiceControl.Infrastructure.Tests.csproj

@@ -15,6 +15,7 @@
     <PackageReference Include="NUnit" />
     <PackageReference Include="NUnit.Analyzers" />
     <PackageReference Include="NUnit3TestAdapter" />
+    <PackageReference Include="Verify.NUnit" />
   </ItemGroup>
 
 </Project>

src/ServiceControl.Infrastructure/Auth/RouteManifest.cs

@@ -40,6 +40,16 @@ public sealed record RouteManifestEntry(
     [property: JsonPropertyName("method")] string Method,
     [property: JsonPropertyName("url_template")] string UrlTemplate);
 
+/// <summary>
+/// The full my/routes payload: the caller's role claims alongside the routes they may invoke. Roles
+/// are reported once at the top level rather than repeated per entry, since they describe the caller,
+/// not the individual route. Field names are pinned for the same cross-instance reason as
+/// <see cref="RouteManifestEntry"/>.
+/// </summary>
+public sealed record MyRoutesResponse(
+    [property: JsonPropertyName("roles")] IReadOnlyList<string> Roles,
+    [property: JsonPropertyName("routes")] IReadOnlyList<RouteManifestEntry> Routes);
+
 /// <summary>
 /// Projects the route table down to the entries a caller may invoke. A route is included when it is
 /// anonymous, requires only authentication (no specific permission), or its required permission is in