private void AddRolesFromClaim(ClaimsIdentity identity, string claimType, HashSet<string> roles)
{
    foreach (var claim in identity.FindAll(claimType))
    {
        if (string.IsNullOrWhiteSpace(claim.Value))
            continue;

        if (TryAddJsonArrayRoles(claim.Value, roles))
            continue;

        AddDelimitedOrSingleRole(claim.Value, roles);
    }
}

private bool TryAddJsonArrayRoles(string claimValue, HashSet<string> roles)
{
    if (!IsJsonArray(claimValue))
        return false;

    try
    {
        using var doc = JsonDocument.Parse(claimValue);
        if (doc.RootElement.ValueKind != JsonValueKind.Array)
            return false;

        foreach (var element in doc.RootElement.EnumerateArray())
        {
            var role = element.GetString();
            if (!string.IsNullOrEmpty(role))
                roles.Add(role);
        }
        return true;
    }
    catch
    {
        // Ignore invalid JSON
        return false;
    }
}

private static bool IsJsonArray(string value)
{
    return value.StartsWith("[") && value.EndsWith("]");
}

private static void AddDelimitedOrSingleRole(string claimValue, HashSet<string> roles)
{
    if (claimValue.Contains(","))
    {
        foreach (var role in claimValue.Split(',', StringSplitOptions.RemoveEmptyEntries))
            roles.Add(role.Trim());
    }
    else
    {
        roles.Add(claimValue);
    }
}