feat: reserve administrative roles for staff email addresses

src/Security/BpnAuthenticator.php

@@ -182,9 +182,11 @@ class BpnAuthenticator extends AbstractLoginFormAuthenticator implements Authent
             ->setHotelCodes(array_values(array_unique($crmAttributes->hotelCodes)))
         ;
 
+        // Compared on the full role sets rather than on the markers alone: nominatedFrom() needs
+        // to see ROLE_EMPLOYEE to know whether an EMPLOYEE_ONLY marker counts.
         $nominated = array_values(array_diff(
-            Role::pendingOnly($user->getRoles()),
-            Role::pendingOnly($previousRoles),
+            array_keys(Role::nominatedFrom($user->getRoles())),
+            array_keys(Role::nominatedFrom($previousRoles)),
         ));
 
         if ([] === $nominated) {
@@ -198,9 +200,9 @@ class BpnAuthenticator extends AbstractLoginFormAuthenticator implements Authent
             'roles' => $nominated,
         ]);
 
-        // Only the newly appeared markers reach this point, so a repeat login with a nomination
-        // still standing announces nothing. That difference is the whole de-duplication.
-        return array_keys(Role::nominatedFrom($nominated));
+        // Only the newly appeared nominations reach this point, so a repeat login with a
+        // nomination still standing announces nothing. That difference is the whole de-duplication.
+        return $nominated;
     }
 
     public function onAuthenticationSuccess(Request $request, TokenInterface $token, string $firewallName): ?Response