Comment #⁨6⁩

I created a simplified pair of models in my namespace WaterholeUser and WaterholeRole. they correspond to User and Group within waterhole.
I also have permissions of "forum_use", and "forum_manage" assigned to roles in the main app.

// in base application User.php
 public function toWaterholeUser(): ?PendingUser
        {
            if( $this->email ){
                // Check if the user already exists in Waterhole.dev
                $waterholeUser = WaterholeUser::getUserByEmail( $this->email );
                if( !$waterholeUser ){
                    // Create a new Waterhole.dev user account
                    $waterholeUser = WaterholeUser::createDefaultUser( [
                                                                           'email'    => $this->email,
                                                                           'username' => $this->getFullnameAttribute(),
                                                                       ] );
                    // Update the Waterhole.dev user's roles to match the Laravel user's roles
                    $role_ids=[];
                    if( $this->hasPermissionTo( 'forum_use' ) ){
                        $role_ids[] =[ WaterholeRole::where( 'name', 'Member' )->first()->id ];
                    }else if( $this->hasPermissionTo( 'forum_manage' ) ){
                        $role_ids[] = WaterholeRole::where( 'name','Admin')->first()->id;
                    }else {
                        $role_ids[] = WaterholeRole::where( 'name','Guest')->first()->id;
                    }

                    $waterholeUser->roles()->sync( $role_ids );
                }
            }

            return new PendingUser(
                identifier: $this->getAuthIdentifier(),
                email: $this->email,
                name: $this->getFullnameAttribute()
            );
    }