fix(uploads): delete the dead POST /registrations (RB-06)

POST /registrations passed its Documents list straight to Submit, which calls DocumentStore.Link on every digital documentId in it — and linking a document blocks its owner from ever deleting it (DeleteOwned returns 409 Linked). That path had no ForeignIds ownership check, so any authenticated citizen could post another citizen's document id and permanently block them from deleting their own diploma scan. POST /applications/{id}/submit, the endpoint actually in use, has had that guard since it was written. Deleted rather than guarded: the endpoint is dead. No frontend caller, and the whole registratie flow goes through /applications/{id}/submit. RegistratieRequest went with it, and so did SubmissionRules.RejectRegistratie — reachable only from here, and contradicted by the live path, which treats a handmatig diploma as "does not auto-approve" rather than a 422 rejection. Its own message said as much while being returned as a rejection. That last part is a judgement call beyond the ticket's wording; reverting the two SubmissionRules hunks restores it in isolation. Coverage moved rather than vanished: the problem+json shape assertion is now on /change-requests (the other endpoint on the same Submit helper), and the linked-delete 409 test goes through the real submit path. swagger.json, the generated client and the behaviour spec regenerated. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-08-27 11:04:03 +02:00
parent 5187bfa19a
commit 0298ecc506
14 changed files with 123 additions and 185 deletions
@@ -0,0 +1,69 @@
+# RB-06 — delete the dead `POST /registrations`
+
+Status: **implemented** · 2026-08-27 · Source findings: `07-bio2-compliance.md` BIO-010 · `99-backlog.md` RB-06
+
+## What was wrong
+
+`POST /registrations` took a `Documents` list and passed it straight to `Submit`, which
+calls `DocumentStore.Link(...)` on every digital `documentId` in it. Linking a document
+**blocks its owner from deleting it** (`DeleteOwned` → 409 `Linked`).
+
+There was no `ForeignIds` ownership check on that path. The real submit endpoint,
+`POST /applications/{id}/submit`, has had one since it was written:
+
+```csharp
+if (documentIds is { Count: > 0 } && DocumentStore.ForeignIds(documentIds, ctx.Zorgverlener().Bsn) is { Count: > 0 } foreignIds)
+    return Results.Problem(detail: $"Onbekend of niet-eigen document(en): …", statusCode: 400);
+```
+
+So any authenticated citizen could post another citizen's document id and permanently
+block them from deleting their own diploma scan.
+
+## Deleted rather than guarded
+
+The ticket allowed either. Deleted, because the endpoint is dead: no frontend caller (the
+generated client's `registrations` method was unreferenced), and the whole registratie flow
+goes through `POST /applications/{id}/submit`.
+
+| File                                         | Change                                            |
+| -------------------------------------------- | ------------------------------------------------- |
+| `Program.cs`                                 | endpoint deleted                                  |
+| `Contracts/Dtos.cs`                          | `RegistratieRequest` deleted (no other reference) |
+| `Domain/Submissions/SubmissionRules.cs`      | `RejectRegistratie` deleted — see below           |
+| `backend/swagger.json`, `api-client.ts`      | regenerated (`npm run gen:api`)                   |
+| `EndpointTests.cs`, `SubmissionRuleTests.cs` | retargeted, see below                             |
+
+### Why `RejectRegistratie` went with it
+
+It was reachable only from this endpoint, and the live path deliberately **contradicts**
+it. `RejectRegistratie("handmatig")` returned a 422 rejection; the modern submit does
+
+```csharp
+"registratie" => (null, req.DiplomaHerkomst == "duo"),
+```
+
+— a manual diploma is not rejected, it simply does not auto-approve and goes to a
+behandelaar. Its own message even said so ("doorgestuurd voor handmatige beoordeling")
+while being returned as a rejection. Leaving it behind would have left an obsolete rule
+with a passing spec, which is exactly how it gets reintroduced.
+
+**This is the one judgement call in this ticket** — the backlog row says "delete the dead
+endpoint", not "delete the rule". Reverting just the `SubmissionRules`/`SubmissionRuleTests`
+hunks restores it without touching anything else.
+
+### Test coverage that moved rather than vanished
+
+- `Registration_with_manual_diploma_is_rejected_with_problem_details` was the only test
+  asserting the `Submit` helper's `application/problem+json` rejection shape. That assertion
+  moved into `Change_request_with_bad_phone_is_rejected_with_problem_details` —
+  `/change-requests` is the other endpoint on the same helper.
+- `User_delete_blocked_with_409_once_linked_to_submission` covered `DocumentStore.Link`
+  blocking a delete. Retargeted to `POST /applications/{id}/submit`, i.e. the path that is
+  actually in use. `POST /registrations` was the only other caller of `Link`.
+- `Registration_with_duo_diploma_succeeds` was deleted outright — `Change_request_with_valid_phone_succeeds`
+  is the same assertion on the same helper.
+
+## Verification
+
+`npm run ci`. `dotnet test`: **249 passed, 1 failed** — the pre-existing
+`OpenZaakIntegrationTests.Admin_cases_…`, which needs a live container.