feat: pending roles from crm to be confirmed by superadmins

src/Security/BpnAuthenticator.php

@@ -64,8 +64,7 @@ class BpnAuthenticator extends AbstractLoginFormAuthenticator implements Authent
                 }
 
                 // Final checks and local user loading/creation
-                $preferredRole = $request->request->get('_role');
-                $user = $this->getOrCreateLocalUser($response, $email, $password, $preferredRole);
+                $user = $this->getOrCreateLocalUser($response, $email, $password);
 
                 if (null === $user) {
                     return null;
@@ -110,7 +109,6 @@ class BpnAuthenticator extends AbstractLoginFormAuthenticator implements Authent
         ProfileResponse $profileResponse,
         string $email,
         string $password,
-        ?string $preferredRole,
     ): ?User {
         // Fetch CRM attributes, early return in case of an API error
         try {
@@ -120,24 +118,6 @@ class BpnAuthenticator extends AbstractLoginFormAuthenticator implements Authent
             return null;
         }
 
-        // Collect user's roles from CRM attributes
-        $roles = $this
-            ->userDataHandler
-            ->collectRoles($crmAttributes, $preferredRole)
-        ;
-
-        // User is expected to have at least one role
-        if (0 === count($roles)) {
-            // Revoke roles on existing local user to invalidate any active session
-            $existingUser = $this->userDataHandler->findLocalUser($profileResponse);
-            if (null !== $existingUser) {
-                $existingUser->setRoles([]);
-                $this->entityManager->flush();
-            }
-
-            return null;
-        }
-
         // Flatten selected CRM attributes
         $crmSelections = $crmAttributes->toArray();
 
@@ -150,19 +130,33 @@ class BpnAuthenticator extends AbstractLoginFormAuthenticator implements Authent
             ->findLocalUser($profileResponse)
         ;
 
-        // Update existing user's roles and teamer data and return it
+        // Update existing user's teamer data and return it, leaving roles and hotel
+        // codes alone: they are imported once on creation and managed manually after
         if (null !== $user) {
             $this
                 ->userDataHandler
-                ->updateLocalUser($user, $profileResponse, $roles, $isTeamer, $crmSelections, $crmAttributes->getHotelCodes())
+                ->updateLocalUser(
+                    $user,
+                    $profileResponse,
+                    $isTeamer,
+                    $crmSelections,
+                    $this->userDataHandler->collectPendingRoles($crmAttributes),
+                )
             ;
 
             return $user;
         }
 
+        // Initial import of roles and hotel codes on user creation
         return $this
             ->userDataHandler
-            ->createLocalUser($profileResponse, $roles, $isTeamer, $crmSelections, $crmAttributes->getHotelCodes())
+            ->createLocalUser(
+                $profileResponse,
+                $this->userDataHandler->collectRoles($crmAttributes),
+                $isTeamer,
+                $crmSelections,
+                $crmAttributes->getHotelCodes(),
+            )
         ;
     }
 }