From 53465cc66a065adf157f39beab47e26876cf58d1 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Bj=C3=B6rn=20Fromme?= <fromme@dreipunktnull.com>
Date: Thu, 20 Aug 2026 14:03:19 +0200
Subject: [PATCH] fix: enforce lowercase email addresses

---
 src/BusProNet/UserDataHandler.php  | 2 +-
 src/Entity/User.php                | 2 +-
 src/Security/MyEpAuthenticator.php | 5 +++--
 3 files changed, 5 insertions(+), 4 deletions(-)

diff --git a/src/BusProNet/UserDataHandler.php b/src/BusProNet/UserDataHandler.php
index 30af5d6..5b8da4b 100644
--- a/src/BusProNet/UserDataHandler.php
+++ b/src/BusProNet/UserDataHandler.php
@@ -142,7 +142,7 @@ class UserDataHandler
         }
 
         $users = $repository->findBy([
-            'email' => $email,
+            'email' => mb_strtolower(trim($email)),
         ]);
 
         if (1 !== count($users)) {
diff --git a/src/Entity/User.php b/src/Entity/User.php
index 638a4b7..225a7a1 100644
--- a/src/Entity/User.php
+++ b/src/Entity/User.php
@@ -184,7 +184,7 @@ class User implements UserInterface, TimestampableEntityInterface, SoftDeletable
 
     public function setEmail(string $email): static
     {
-        $this->email = $email;
+        $this->email = mb_strtolower(trim($email));
 
         return $this;
     }
diff --git a/src/Security/MyEpAuthenticator.php b/src/Security/MyEpAuthenticator.php
index baee9f2..034a1df 100644
--- a/src/Security/MyEpAuthenticator.php
+++ b/src/Security/MyEpAuthenticator.php
@@ -255,6 +255,7 @@ class MyEpAuthenticator extends AbstractAuthenticator
 
         $addressId = $userinfo['address_id'] ?? null;
         $personId = $userinfo['person_id'] ?? null;
+        $email = mb_strtolower(trim($userinfo['email']));
 
         if (null !== $addressId && null !== $personId) {
             $user = $repository->findOneBy([
@@ -267,12 +268,12 @@ class MyEpAuthenticator extends AbstractAuthenticator
             }
         }
 
-        $users = $repository->findBy(['email' => $userinfo['email']]);
+        $users = $repository->findBy(['email' => $email]);
 
         if (1 !== count($users)) {
             if (1 < count($users)) {
                 $this->logger->warning('Unable to match local user by email: multiple users found', [
-                    'email' => $userinfo['email'],
+                    'email' => $email,
                     'count' => count($users),
                 ]);
             }