test(e2e): isolate the self-service specs with dedicated DigiD users (refs #111)

Resume-on-load (S-26) restores any open registration for the logged-in bsn, so on the
shared verify stack the specs can no longer share jan-burger: verify-domain submits as
jan-burger (123456782) before the e2e, and that open registration was being resumed on
login. Each self-service spec now uses its own citizen — registration→emma-burger,
resume→sanne-burger, withdrawal→lars-burger — none touched by the verify-* checks or
each other. jan-burger stays the documented citizen for the API-level verify checks.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

docs/synthetic-data.md

@@ -14,6 +14,7 @@ All test users share the password **`test123`**.
 | Realm | Mimics | User | Identifying claim |
 |---|---|---|---|
 | `digid` | DigiD (burgers) | `jan-burger` | `bsn` = `123456782` |
+| `digid` | DigiD (burgers) | `sanne-burger` | `bsn` = `231477813` (S-26 resume e2e — its own user so it can leave an open registration) |
 | `eherkenning` | eHerkenning (bedrijven) | `acme-ondernemer` | `kvk` = `12345678` |
 | `eidas` | eIDAS (EU) | `pierre-dupont` | `eidas_id` = `FR/NL/AB-1234-5678` |
 | `medewerker` | Internal staff | `merel-behandelaar` | role `behandelaar` |

infra/keycloak/realms/digid-realm.json

@@ -38,6 +38,36 @@
       "emailVerified": true,
       "credentials": [{ "type": "password", "value": "test123", "temporary": false }],
       "attributes": { "bsn": ["123456782"] }
+    },
+    {
+      "username": "sanne-burger",
+      "enabled": true,
+      "firstName": "Sanne",
+      "lastName": "Burger",
+      "email": "sanne.burger@example.nl",
+      "emailVerified": true,
+      "credentials": [{ "type": "password", "value": "test123", "temporary": false }],
+      "attributes": { "bsn": ["231477813"] }
+    },
+    {
+      "username": "emma-burger",
+      "enabled": true,
+      "firstName": "Emma",
+      "lastName": "Burger",
+      "email": "emma.burger@example.nl",
+      "emailVerified": true,
+      "credentials": [{ "type": "password", "value": "test123", "temporary": false }],
+      "attributes": { "bsn": ["231477805"] }
+    },
+    {
+      "username": "lars-burger",
+      "enabled": true,
+      "firstName": "Lars",
+      "lastName": "Burger",
+      "email": "lars.burger@example.nl",
+      "emailVerified": true,
+      "credentials": [{ "type": "password", "value": "test123", "temporary": false }],
+      "attributes": { "bsn": ["231477821"] }
     }
   ]
 }

tests/e2e/registration.spec.ts

@@ -13,8 +13,11 @@ test('DigiD submit → public INGEDIEND → documenten → behandelaar goedkeurt
   // Visiting the guarded page redirects to the Keycloak (mock DigiD) login.
   await page.goto('/');
 
-  // Keycloak's default login form (stable ids across themes).
-  await page.locator('#username').fill('jan-burger');
+  // Keycloak's default login form (stable ids across themes). Its own DigiD user: the verify-* API
+  // checks submit as jan-burger (bsn 123456782) before the e2e runs on the shared stack, and
+  // resume-on-load (S-26) would otherwise restore one of those on login — so each self-service spec
+  // uses a dedicated citizen no other actor touches.
+  await page.locator('#username').fill('emma-burger');
   await page.locator('#password').fill('test123');
   await page.locator('#kc-login').click();
 

tests/e2e/resume.spec.ts

@@ -6,7 +6,10 @@ import { expect, test } from '@playwright/test';
 test('DigiD submit → reload → self-service restores the existing registration', async ({ page }) => {
   await page.goto('/');
 
-  await page.locator('#username').fill('jan-burger');
+  // Its own DigiD user (like every self-service spec): on the shared verify stack, resume-on-load
+  // (S-26) restores any open registration for the bsn, so each spec uses a dedicated citizen that no
+  // other spec or verify-* check touches. This one in particular leaves an open registration.
+  await page.locator('#username').fill('sanne-burger');
   await page.locator('#password').fill('test123');
   await page.locator('#kc-login').click();
 

tests/e2e/withdrawal.spec.ts

@@ -8,7 +8,9 @@ test('DigiD submit → trek aanvraag in → self-service confirms ingetrokken',
   // Visiting the guarded page redirects to the Keycloak (mock DigiD) login.
   await page.goto('/');
 
-  await page.locator('#username').fill('jan-burger');
+  // Its own DigiD user — isolated from the verify-* checks (jan-burger/123456782) so resume-on-load
+  // (S-26) can't restore someone else's registration on the shared stack.
+  await page.locator('#username').fill('lars-burger');
   await page.locator('#password').fill('test123');
   await page.locator('#kc-login').click();