feat: demotion of user accounts via crm

src/Security/BpnAuthenticator.php

@@ -124,12 +124,31 @@ class BpnAuthenticator extends AbstractLoginFormAuthenticator implements Authent
         // Determine teamer status from CRM attributes
         $isTeamer = $crmAttributes->isTeamer();
 
+        // Everything the CRM grants this person here: pending markers plus ROLE_TEAMER
+        $claimedRoles = $this
+            ->userDataHandler
+            ->collectRoles($crmAttributes)
+        ;
+
         // Check if user is already present in local database
         $user = $this
             ->userDataHandler
             ->findLocalUser($profileResponse)
         ;
 
+        // BusPro knows this person but grants them nothing in this application, so they
+        // are no user of it: never create an account, block an existing one. Returning
+        // the blocked user lets the UserChecker explain why the login was refused.
+        if ([] === $claimedRoles) {
+            if (null === $user) {
+                return null;
+            }
+
+            $this->userDataHandler->disableForRevokedCrmRoles($user);
+
+            return $user;
+        }
+
         // Update existing user's teamer data and return it, leaving roles and hotel
         // codes alone: they are imported once on creation and managed manually after
         if (null !== $user) {
@@ -152,7 +171,7 @@ class BpnAuthenticator extends AbstractLoginFormAuthenticator implements Authent
             ->userDataHandler
             ->createLocalUser(
                 $profileResponse,
-                $this->userDataHandler->collectRoles($crmAttributes),
+                $claimedRoles,
                 $isTeamer,
                 $crmSelections,
                 $crmAttributes->getHotelCodes(),