fix: never persist a half-built user on first login

src/Security/BpnAuthenticator.php

@@ -106,13 +106,7 @@ class BpnAuthenticator extends AbstractLoginFormAuthenticator implements Authent
 
         $userRepository = $this->entityManager->getRepository(User::class);
 
-        if (null === $user = $userRepository->findOneBy(['email' => $email])) {
-            $user = new User($email);
-
-            $this->entityManager->persist($user);
-        }
-
-        $this->syncFromCrm($user, $crmAttributes);
+        $user = $userRepository->findOneBy(['email' => $email]) ?? new User($email);
 
         $user
             ->setPassword($encryptedPassword)
@@ -124,6 +118,13 @@ class BpnAuthenticator extends AbstractLoginFormAuthenticator implements Authent
             ->setProfileComplete($this->completenessChecker->isComplete($personalData))
         ;
 
+        $this->syncFromCrm($user, $crmAttributes);
+
+        // Registered only once it is fully populated: syncFromCrm() logs on a channel that writes
+        // to the database, and an account already managed at that point would be flushed
+        // half-built — which is how a NULL password used to reach the user table. A no-op for an
+        // account that came from the repository.
+        $this->entityManager->persist($user);
         $this->entityManager->flush();
 
         return $user;