feat: improved handling of roles determination from bpn api response

src/Security/BpnAuthenticator.php

@@ -118,6 +118,13 @@ class BpnAuthenticator extends AbstractLoginFormAuthenticator implements Authent
 
         // User is expected to have at least one role
         if (0 === count($roles)) {
+            // Revoke roles on existing local user to invalidate any active session
+            $existingUser = $this->userDataHandler->findLocalUser($profileResponse);
+            if (null !== $existingUser) {
+                $existingUser->setRoles([]);
+                $this->entityManager->flush();
+            }
+
             return null;
         }