feat: derive ROLE_EMPLOYEE from the account's email domain

tests/Security/BpnAuthenticatorTest.php

@@ -11,6 +11,7 @@ use App\BusProNet\Model\PersonalData;
 use App\Entity\User;
 use App\Security\BpnAuthenticator;
 use App\Security\Crypt;
+use App\Security\EmployeeDomainMatcher;
 use App\Security\Role;
 use App\Service\ProfileCompletenessChecker;
 use Doctrine\ORM\EntityManagerInterface;
@@ -196,6 +197,38 @@ class BpnAuthenticatorTest extends TestCase
         return $attributes;
     }
 
+    public function testStaffEmailDomainGrantsTheEmployeeRole(): void
+    {
+        $persisted = null;
+        $authenticator = $this->authenticator($this->crmAttributes([], []), null, $persisted);
+
+        $user = $this->loadUser($authenticator, '[email protected]');
+
+        // Effective, so it displaces the customer fallback the same account would get otherwise.
+        self::assertSame(['ROLE_USER', Role::EMPLOYEE], $user->getRoles());
+    }
+
+    public function testAnotherEmailDomainStillFallsBackToCustomer(): void
+    {
+        $persisted = null;
+        $authenticator = $this->authenticator($this->crmAttributes([], []), null, $persisted);
+
+        $user = $this->loadUser($authenticator, '[email protected]');
+
+        self::assertSame(['ROLE_USER', Role::CUSTOMER], $user->getRoles());
+    }
+
+    public function testEmployeeRoleIsWithdrawnWhenTheAddressIsNoLongerStaff(): void
+    {
+        $existing = (new User('[email protected]'))->setRoles([Role::EMPLOYEE]);
+        $persisted = null;
+        $authenticator = $this->authenticator($this->crmAttributes([], []), $existing, $persisted);
+
+        $user = $this->loadUser($authenticator, '[email protected]');
+
+        self::assertSame(['ROLE_USER', Role::CUSTOMER], $user->getRoles());
+    }
+
     private function authenticator(
         CrmAttributes $crmAttributes,
         ?User $existing,
@@ -238,13 +271,14 @@ class BpnAuthenticatorTest extends TestCase
             $crypt,
             $completenessChecker,
             $this->createStub(LoggerInterface::class),
+            new EmployeeDomainMatcher(['ep-reisen.de']),
         );
     }
 
-    private function loadUser(BpnAuthenticator $authenticator): User
+    private function loadUser(BpnAuthenticator $authenticator, string $email = '[email protected]'): User
     {
         $request = new Request();
-        $request->request->set('_username', '[email protected]');
+        $request->request->set('_username', $email);
         $request->request->set('_password', 'secret');
 
         $badge = $authenticator->authenticate($request)->getBadge(UserBadge::class);