feat: bpn as single source of truth for role and hotel code assignments

tests/Security/MyEpAuthenticatorTest.php

@@ -110,9 +110,10 @@ class MyEpAuthenticatorTest extends TestCase
     }
 
     /**
-     * A super admin's manual demotion has to survive the user's next SSO login.
+     * A claimed administrative role is marked for approval, never granted - not even when
+     * the identity provider reports it outright.
      */
-    public function testExistingGrantedRolesAreNeverOverwritten(): void
+    public function testClaimedAdministrativeRolesAreNeverGrantedOnLogin(): void
     {
         $user = (new User())->setEmail('[email protected]')->setRoles(['ROLE_TEAMER']);
         $this->repository->method('findOneBy')->willReturn($user);
@@ -130,7 +131,7 @@ class MyEpAuthenticatorTest extends TestCase
     /**
      * An already approved role must not be demoted back to a marker on the next login.
      */
-    public function testAnAlreadyGrantedAdministrativeRoleIsKept(): void
+    public function testAnAlreadyGrantedAdministrativeRoleIsKeptWhileStillClaimed(): void
     {
         $user = (new User())->setEmail('[email protected]')->setRoles(['ROLE_ADMIN', 'ROLE_TEAMER']);
         $this->repository->method('findOneBy')->willReturn($user);
@@ -141,6 +142,32 @@ class MyEpAuthenticatorTest extends TestCase
         $this->assertSame([], $user->getPendingRoles());
     }
 
+    /**
+     * MyE&P leads exactly as BusPro does: a role it stops reporting is withdrawn on the
+     * next login, and the hotel codes are re-imported with it.
+     */
+    public function testGrantedRolesNoLongerClaimedAreRevoked(): void
+    {
+        $user = (new User())
+            ->setEmail('[email protected]')
+            ->setRoles(['ROLE_ADMIN', 'ROLE_TEAMER'])
+            ->setSuperAdmin(true)
+            ->setHotelCodes(['SSL'])
+        ;
+        $this->repository->method('findOneBy')->willReturn($user);
+
+        $this->loadUser($this->createUserinfo(['ROLE_TEAMER']));
+
+        $this->assertSame(['ROLE_TEAMER'], $user->getAssignedRoles());
+        $this->assertSame([], $user->getPendingRoles());
+
+        // the flag would otherwise outlive the role it depends on
+        $this->assertFalse($user->isSuperAdmin());
+        $this->assertNotContains('ROLE_SUPER_ADMIN', $user->getRoles());
+
+        $this->assertSame(['HOTEL'], $user->getHotelCodes());
+    }
+
     public function testTeamerRoleIsGrantedToAnExistingUser(): void
     {
         $user = (new User())->setEmail('[email protected]')->setRoles([User::PENDING_ROLES['ROLE_MANAGER']]);