fix: handle access denied errors properly

src/Security/BpnAuthenticator.php

@@ -53,6 +53,7 @@ class BpnAuthenticator extends AbstractLoginFormAuthenticator implements Authent
         private readonly Crypt $crypt,
         private readonly ProfileCompletenessChecker $completenessChecker,
         private readonly LoggerInterface $authLogger,
+        private readonly DefaultRouteResolver $defaultRouteResolver,
     ) {
     }
 
@@ -174,7 +175,7 @@ class BpnAuthenticator extends AbstractLoginFormAuthenticator implements Authent
         ]);
 
         $targetPath = $this->getTargetPath($request->getSession(), $firewallName)
-            ?? $this->urlGenerator->generate('app_account');
+            ?? $this->defaultRouteResolver->resolveUrl();
 
         // When redirecting to admin from an HTMX request, force a full page navigation
         // to avoid layout issues between frontend (hx-boost) and EasyAdmin

src/Security/DefaultRouteResolver.php

@@ -0,0 +1,39 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Security;
+
+use App\Security\Voter\AdministrativeAccessVoter;
+use Symfony\Component\Routing\Generator\UrlGeneratorInterface;
+use Symfony\Component\Security\Core\Authorization\AuthorizationCheckerInterface;
+
+/**
+ * Resolves the route a user belongs to when no specific destination is known.
+ *
+ * Used after login (when no target path was stored) and when access to a page is
+ * denied, so users land somewhere they are actually allowed to be instead of on an
+ * error page.
+ */
+class DefaultRouteResolver
+{
+    public function __construct(
+        private readonly AuthorizationCheckerInterface $authorizationChecker,
+        private readonly UrlGeneratorInterface $urlGenerator,
+    ) {
+    }
+
+    public function resolveRoute(): string
+    {
+        if ($this->authorizationChecker->isGranted(AdministrativeAccessVoter::ADMINISTRATIVE_ACCESS)) {
+            return 'app_admin_dashboard';
+        }
+
+        return 'app_account';
+    }
+
+    public function resolveUrl(): string
+    {
+        return $this->urlGenerator->generate($this->resolveRoute());
+    }
+}