feat: improved handling of roles determination from bpn api response

src/Security/BpnAuthenticator.php

@@ -118,6 +118,13 @@ class BpnAuthenticator extends AbstractLoginFormAuthenticator implements Authent
 
         // User is expected to have at least one role
         if (0 === count($roles)) {
+            // Revoke roles on existing local user to invalidate any active session
+            $existingUser = $this->userDataHandler->findLocalUser($profileResponse);
+            if (null !== $existingUser) {
+                $existingUser->setRoles([]);
+                $this->entityManager->flush();
+            }
+
             return null;
         }
 

src/Security/UserChecker.php

@@ -9,6 +9,13 @@ use Symfony\Component\Security\Core\User\UserInterface;
 
 class UserChecker implements UserCheckerInterface
 {
+    private const APPLICATION_ROLES = [
+        'ROLE_ADMIN',
+        'ROLE_MANAGER',
+        'ROLE_HOUSE_MANAGER',
+        'ROLE_TEAMER',
+    ];
+
     public function checkPreAuth(UserInterface $user): void
     {
         if (!$user instanceof User) {
@@ -18,6 +25,10 @@ class UserChecker implements UserCheckerInterface
         if (true === $user->isDisabled()) {
             throw new CustomUserMessageAccountStatusException('Dein Account wurde gesperrt: '.$user->getDisabledReason());
         }
+
+        if ([] === array_intersect($user->getRoles(), self::APPLICATION_ROLES)) {
+            throw new CustomUserMessageAccountStatusException('Keine gültige Rolle zugewiesen.');
+        }
     }
 
     public function checkPostAuth(UserInterface $user): void