Revoke membership and roles previously assigned by authorization

Problem/Motivation

Group membership is granted and revoked based on mappings. This conflicts with manual assignment.

Steps to reproduce

Proposed resolution

Use the user.data service to store the mappings. This will allow every profile to revoke group:roles previously granted correctly.

$user = \Drupal::currentUser();

// Define an array of role => profile.
$roles= [
  'group:1' => [
    'team--administrator' => 'profile_a',
  ],
  'group:3' => [
      'team--teacher' => 'profile_b',
  ],
  'group:5' => [
    'team--staff' => 'profile_b',
  ],
];

// Store the array as user data.
\Drupal::service('user.data')->set('authorization_group', $user->id(), 'roles', $roles);

Remaining tasks

User interface changes

API changes

Data model changes