[6.x] Don't save group-inherited roles as explicit roles

src/Auth/Eloquent/User.php

@@ -45,7 +45,7 @@ public function data($data = null)
     {
         if (func_num_args() === 0) {
             $data = array_merge($this->model()->attributesToArray(), [
-                'roles' => $this->roles()->map->handle()->values()->all(),
+                'roles' => $this->explicitRoles()->map->handle()->values()->all(),
                 'groups' => $this->groups()->map->handle()->values()->all(),
             ]);
 
@@ -112,7 +112,7 @@ public function explicitRoles($roles = null)
 
     protected function saveRoles()
     {
-        $roles = $this->roles()->map->id();
+        $roles = $this->explicitRoles()->map->id();
 
         (new Roles($this))->sync($roles);
     }

tests/Auth/Eloquent/EloquentUserTest.php

@@ -241,6 +241,24 @@ public function handle(?string $handle = null)
         $this->assertSame([$user->email(), $userTwo->email(), $userThree->email(), $userFour->email()], Facades\User::query()->whereGroupIn(['a', 'b'])->orWhereGroupIn(['c'])->get()->map->email()->all());
     }
 
+    #[Test]
+    public function it_doesnt_save_roles_inherited_from_groups_to_the_role_user_table()
+    {
+        $directRole = Facades\Role::make('direct');
+        $groupRole = Facades\Role::make('grouped');
+        $group = (new UserGroup)->handle('usergroup')->assignRole($groupRole);
+
+        Facades\Role::shouldReceive('find')->with('direct')->andReturn($directRole);
+        Facades\Role::shouldReceive('find')->with('grouped')->andReturn($groupRole);
+        Facades\UserGroup::shouldReceive('find')->with('usergroup')->andReturn($group);
+
+        $user = $this->createPermissible()->assignRole($directRole)->addToGroup($group);
+        $user->save();
+
+        $this->assertSame(['direct'], \DB::table(config('statamic.users.tables.role_user', 'role_user'))->where('user_id', $user->id())->pluck('role_id')->all());
+        $this->assertSame(['usergroup'], \DB::table(config('statamic.users.tables.group_user', 'group_user'))->where('user_id', $user->id())->pluck('group_id')->all());
+    }
+
     public function makeUser()
     {
         return (new EloquentUser)

tests/Auth/PermissibleContractTests.php

@@ -172,6 +172,27 @@ public function handle(?string $handle = null)
         $this->assertFalse($user->hasRole('b'));
     }
 
+    #[Test]
+    public function it_doesnt_treat_roles_inherited_from_groups_as_explicitly_assigned()
+    {
+        $directRole = RoleAPI::make('direct');
+        $groupRole = RoleAPI::make('grouped');
+        $group = (new UserGroup)->handle('usergroup')->assignRole($groupRole);
+
+        RoleAPI::shouldReceive('find')->with('direct')->andReturn($directRole);
+        RoleAPI::shouldReceive('find')->with('grouped')->andReturn($groupRole);
+        RoleAPI::shouldReceive('all')->andReturn(collect([$directRole, $groupRole]));
+        UserGroupAPI::shouldReceive('find')->with('usergroup')->andReturn($group);
+        UserGroupAPI::shouldReceive('all')->andReturn(collect([$group]));
+
+        $user = $this->createPermissible()->assignRole($directRole)->addToGroup($group);
+        $user->save();
+
+        $this->assertEquals(['direct', 'grouped'], $user->roles()->map->handle()->values()->all());
+        $this->assertEquals(['direct'], $user->explicitRoles()->map->handle()->values()->all());
+        $this->assertEquals(['direct'], $user->data()->get('roles'));
+    }
+
     #[Test]
     public function it_gets_and_checks_permissions()
     {