fromGrantedRoles
Unresolved convenience overload of fromGrantedRoles: no resolution map, so every granted userRoleId passes through unchanged as the accessLevelId — the safe interim passthrough (the engine resolves an unknown non-empty accessLevelId to the property's DEFAULT restrictions, so it cannot over-grant).
Parameters
propertyId -> granted userRoleId. A null/empty/blank role is treated as "no grant".
subset of properties that enforce role-based access.
Build the published UserRoleAccess from the server-granted roles, the UserRolesSource-resolved access ids, and the access-locked property list.
The auth userRoleId is NOT the engine accessLevelId — the engine keys on the CMS accessRestrictionId. Each granted property is published as RoleAccessPair(roleId = userRoleId, accessLevelId = resolvedRestrictionId). A property with a grant but no usable resolution entry falls back per-entry to the passthrough (accessLevelId = userRoleId): safe-but-unenforcing, because the engine resolves unknown non-empty ids to the property's DEFAULT restrictions. TODO(backend): the resolution endpoint is pending; see NetworkUserRolesSource.
Return
a UserRoleAccess containing one RoleAccessPair per granted property and one NO_ACCESS_SENTINEL pair per locked property with no grant. Unlocked properties with no grant are omitted (the property default applies).
Parameters
propertyId -> granted userRoleId from the login response. A null/empty/blank role is "no grant".
propertyId -> CMS accessRestrictionId resolved by a UserRolesSource; null means "no resolution available" (full passthrough).
subset of properties that enforce role-based access.