title: Where to define security roles?
body: <p>I have an User and a Group Entity which both hold an array of roles.</p>
  
  <p>Now I would like to keep the option open to modificate the roles, add them and so on.</p>
  
  <p>Should I use constants in the classes for this or should I relate an OneToOne-relation to a table which keeps all the roles?</p>
  
  <p>Best Regards,
  pus.dev</p>
  
  <p>User &lt;=> Role
  Group &lt;=> Role</p>
  
  <pre><code>public function getRoles()
  {
      $roles = $this-&gt;roles;
  
      foreach ($this-&gt;getGroups() as $group) {
          $roles = array_merge($roles, $group-&gt;getRoles());
      }
  
      // we need to make sure to have at least one role
      $roles[] = static::ROLE_DEFAULT;
  
      return array_unique($roles);
  }
  </code></pre>