feat: demotion of user accounts via crm

src/BusProNet/UserDataHandler.php

@@ -218,6 +218,37 @@ class UserDataHandler
         $this->entityManager->flush();
     }
 
+    /**
+     * Blocks a user the CRM no longer grants anything in this application.
+     *
+     * The granted roles are deliberately kept: they stay visible for review and are what
+     * makes the user reappear in the administrative list, where a super admin can unblock
+     * them. Only the privilege-free markers are dropped, as they no longer reflect the CRM.
+     * Regaining a CRM role does not unblock the account, that is a manual decision.
+     */
+    public function disableForRevokedCrmRoles(User $user): void
+    {
+        // an existing block may be a disciplinary one and must never be overwritten
+        if (true === $user->isDisabled()) {
+            return;
+        }
+
+        $this->refreshPendingRoles($user, []);
+
+        $user
+            ->setDisabledAt(new \DateTimeImmutable())
+            ->setDisabledReason('Für deinen Account liegt in BusPro keine Berechtigung mehr vor.')
+            ->setDisabledReasonInternal('Automatisch gesperrt: keine Rollen in BusPro.')
+        ;
+
+        $this->entityManager->flush();
+
+        $this->logger->info('Disable user without CRM roles', [
+            'user_id' => $user->getId(),
+            'user_email' => $user->getEmail(),
+        ]);
+    }
+
     /**
      * Keeps the pending markers in sync with the administrative roles claimed in the CRM.
      * The markers grant no privileges, so tracking them on every login is safe: only a