The current (and expected) behaviour is that roles and enrolment methods are not coupled, so suspending enrolment methods does not impact a user's assigned roles. Although this has no impact for anyone with single enrolments in a course, and is usually desirable behaviour with multiple enrolments as you may have other active enrolments in the course, you potentially do not want those roles to be active in the case where a user is accessing the course as a guest (which is its own enrolment method, and so will still honour any roles assigned to the user).

The current way to manage this is a little clunky and lacks visibility, in that it requires you to remove the roles from the user when their other enrolment methods (eg self/manual enrolment) are suspended, and there is no prompt to warn you that those will otherwise still be available if guest enrolment is active, and also because if the suspension is intended to be temporary, you then have to reinstate those roles when you unsuspend (and remember what they were).

This issue aims to improve all of the above, by implementing the following, if guest mode is enabled on the course (alongside one or more other enrolment methods):

1. When suspending the final enrolment method on a user (so they have no active enrolments), raise a prompt which informs them guest mode is enabled and the user will retain the role(s) if they access the course as a guest (we should also list the roles they would retain). Also provide a one-click option to remove all roles from the user, with a note that they will be recoverable upon unsuspending the user. For example: This course has guest mode enabled, so [name] will still be able to access this course as a "teacher" if that role is not removed. Would you like to remove [name]'s current role of "teacher"? This will be recoverable if they are unsuspended later.
2. When unsuspending a user who does not already have any active enrolments in the course, check whether we have any stored roles recorded from a previous suspension. If so, raise a prompt which offers a one-click option to reinstate the user's previous roles that aren't otherwise already assigned to them (which is possible if they were added back manually. We should list the roles that would be reinstated. For example: "While re-activating [name]'s enrolment, would you like to reinstate their previous role of "teacher"?

This will require us to record course role information for the user in the database, when the option is activated. We potentially want to delete that information at the time they are unsuspended, so the information is not stale and to prevent accidentally restoring "old" role information if a user's suspended status is toggled multiple times.

I'm marking this as a security improvement, because it makes it more obvious that roles are retained during suspension, including through guest access, and makes it easier to toggle that access appropriately.