feat: identify the authenticated account in the userinfo claims

tests/Security/BpnAuthenticatorTest.php

@@ -240,6 +240,28 @@ class BpnAuthenticatorTest extends TestCase
         self::assertSame(['ROLE_USER', Role::CUSTOMER], $user->getRoles());
     }
 
+    public function testAStaffContactAddressOnTheBusProRecordDoesNotMakeTheLoginStaff(): void
+    {
+        $persisted = null;
+        $persistedPassword = null;
+        $authenticator = $this->authenticator(
+            $this->crmAttributes([Role::ADMIN, Role::TEAMER], []),
+            null,
+            $persisted,
+            $persistedPassword,
+            '[email protected]',
+        );
+
+        $user = $this->loadUser($authenticator, '[email protected]');
+
+        // BusPro accepts any address on the record as a login and answers with the first contact
+        // address regardless of which one was used, so only the typed address may decide. Reading
+        // the response instead would hand ROLE_EMPLOYEE — and every EMPLOYEE_ONLY role with it —
+        // to anyone who can add a staff address to their own BusPro record.
+        self::assertSame(['ROLE_USER', Role::TEAMER], $user->getRoles());
+        self::assertSame([], $this->dispatched);
+    }
+
     public function testEmployeeOnlyClaimFromAnotherDomainIsIgnored(): void
     {
         $persisted = null;
@@ -321,10 +343,12 @@ class BpnAuthenticatorTest extends TestCase
         ?User $existing,
         ?User &$persisted,
         ?string &$persistedPassword = null,
+        ?string $contactEmail = null,
     ): BpnAuthenticator {
         $personalData = new PersonalData();
         $personalData->personId = 42;
         $personalData->addressId = 4711;
+        $personalData->communication->email = $contactEmail;
 
         $apiClient = $this->createStub(ApiClient::class);
         $apiClient->method('getPersonalData')->willReturn($personalData);