fix: make NewSession behave same way like UpdateSession method (#594)

Before submitting this PR:

Noticed session creation behave is different when `UpdateSession` method
is called vs `NewSession` method is called.
keeping the behavior same for both methods, producing similar
`allowedRoles` in session.

### Checklist

- [x] No breaking changes
- [x] Tests pass
- [x] New features have new tests
- [x] Documentation is updated

### Breaking changes

Avoid breaking changes and regressions. If you feel it is unavoidable,
make it explicit in your PR comment so we can review it and see how to
handle it.

### Tests

- please make sure your changes pass the current tests (Use the `make
test` or the `make watch` command).
- if you are introducing a new feature, please write as much tests as
possible.

### Documentation

Please make sure the documentation is updated accordingly, in
particular:

-
[Workflows](https://github.com/nhost/hasura-auth/tree/main/docs/workflows).
Workflows are [Mermaid sequence
diagrams](https://mermaid-js.github.io/mermaid/#/sequenceDiagram)
-
[Schema](https://github.com/nhost/hasura-auth/blob/main/docs/schema.md).
The schema in a [Mermaid ER
diagram](https://mermaid-js.github.io/mermaid/#/entityRelationshipDiagram)
- [Environment
variables](https://github.com/nhost/hasura-auth/blob/main/docs/environment-variables.md).
Please adjust the
[.env.example](https://github.com/nhost/hasura-auth/blob/main/.env.example)
file accordingly
- OpenApi specifications. We are using inline [JSDoc
annotations](https://www.npmjs.com/package/express-jsdoc-swagger)

---------

Co-authored-by: David Barroso <[email protected]>

go/controller/workflows.go

@@ -458,7 +458,7 @@ func (wf *Workflows) UpdateSession( //nolint:funlen
 	}, nil
 }
 
-func (wf *Workflows) NewSession(
+func (wf *Workflows) NewSession( //nolint:funlen
 	ctx context.Context,
 	user sql.AuthUser,
 	logger *slog.Logger,
@@ -467,9 +467,13 @@ func (wf *Workflows) NewSession(
 	if err != nil {
 		return nil, fmt.Errorf("error getting roles by user id: %w", err)
 	}
-	allowedRoles := make([]string, len(userRoles))
-	for i, role := range userRoles {
-		allowedRoles[i] = role.Role
+	allowedRoles := make([]string, 0, len(userRoles))
+	for _, role := range userRoles {
+		allowedRoles = append(allowedRoles, role.Role)
+	}
+
+	if !slices.Contains(allowedRoles, user.DefaultRole) {
+		allowedRoles = append(allowedRoles, user.DefaultRole)
 	}
 
 	refreshToken := uuid.New()