feat(zgw): OpenZaak Documenten (DRC) upload + zaak link (WP-51)

Extends the OpenZaak seam with IDocumentSource, sibling of IZaakSource
(WP-49/50): an upload always lands locally first (DocumentStore stays
the record of truth for preview/download/audit) and, when
Zgw:Enabled=true, is also registered as a DRC enkelvoudiginformatie-
object; once a zaak exists (IZaakSource.CreateZaak now also returns
its ZaakUrl), submit links each document to it via zaakinformatie-
object. FE upload/list DTOs are unchanged.

- ZgwOptions gains DrcBaseUrl + a category->informatieobjecttype URL
  map (the document analogue of ZaaktypeUrls).
- LocalDocumentSource is the same DocumentStore.Add/Link calls the
  endpoints used to make inline — zero behaviour change offline.
- OpenZaakDocumentSource POSTs the eio then the zaak link, persisting
  the DRC url (DocumentStore.SetDrcUrl) so linking doesn't re-upload.
- Factored the GET/POST-with-bearer-JWT plumbing shared with
  OpenZaakZaakSource into ZgwHttpClient; shared the stub handler
  between the two source test classes as ZgwStubHandler.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

backend/tests/BigRegister.Tests/OpenZaakDocumentSourceTests.cs

@@ -0,0 +1,108 @@
+using BigRegister.Api.Data;
+using BigRegister.Api.Zgw;
+
+namespace BigRegister.Tests;
+
+/// <summary>
+/// Exercises the OpenZaak document source against a stub HttpMessageHandler (WP-51): an
+/// upload registers a DRC enkelvoudiginformatieobject, and linking to a zaak POSTs a
+/// zaakinformatieobject per document once a zaak URL is known.
+/// </summary>
+public class OpenZaakDocumentSourceTests
+{
+  private const string DrcBase = "https://oz.example/documenten/api/v1";
+  private const string ZrcBase = "https://oz.example/zaken/api/v1";
+  private const string ZaaktypeUrl = "https://oz.example/catalogi/api/v1/zaaktypen/zt-registratie";
+  private const string InformatieobjecttypeUrl = "https://oz.example/catalogi/api/v1/informatieobjecttypen/iot-identiteit";
+
+  private static ZgwOptions Options() => new()
+  {
+    DrcBaseUrl = DrcBase,
+    ZrcBaseUrl = ZrcBase,
+    ClientId = "c",
+    Secret = "s",
+    Bronorganisatie = "123443210",
+    UserRepresentation = "BIG-register BFF",
+    InformatieobjecttypeUrls = new() { ["identiteit"] = InformatieobjecttypeUrl },
+  };
+
+  [Fact]
+  public void Upload_registers_an_eio_in_drc_and_persists_its_url_locally()
+  {
+    var options = Options();
+    var handler = new ZgwStubHandler(url => url switch
+    {
+      _ when url == $"{DrcBase}/enkelvoudiginformatieobjecten" =>
+        """{ "url": "https://oz.example/documenten/api/v1/enkelvoudiginformatieobjecten/eio-1" }""",
+      _ => throw new InvalidOperationException($"unexpected ZGW call {url}"),
+    });
+    var source = new OpenZaakDocumentSource(new HttpClient(handler), new ZgwTokenProvider(options), options);
+
+    var response = source.Upload("local-1", "identiteit", "registratie", "paspoort.pdf", "application/pdf",
+        "%PDF-1.4 fake"u8.ToArray(), "111222333");
+
+    Assert.Equal("local-1", response.LocalId);
+    Assert.NotEmpty(response.DocumentId);
+
+    // Registered locally too (dual-write, same reasoning as CreateZaak/WP-50) — content
+    // preview/download keeps working regardless of Zgw:Enabled.
+    var stored = DocumentStore.Get(response.DocumentId);
+    Assert.NotNull(stored);
+    Assert.Equal("https://oz.example/documenten/api/v1/enkelvoudiginformatieobjecten/eio-1", stored!.DrcUrl);
+
+    var body = handler.BodyOf($"{DrcBase}/enkelvoudiginformatieobjecten");
+    Assert.Contains(InformatieobjecttypeUrl, body);
+    Assert.Contains("123443210", body);       // bronorganisatie
+    Assert.Contains("paspoort.pdf", body);
+    Assert.Contains(Convert.ToBase64String("%PDF-1.4 fake"u8.ToArray()), body); // inhoud
+  }
+
+  [Fact]
+  public void Upload_throws_when_the_category_has_no_configured_informatieobjecttype()
+  {
+    var options = Options();
+    var handler = new ZgwStubHandler(url => throw new InvalidOperationException($"no HTTP call expected, got {url}"));
+    var source = new OpenZaakDocumentSource(new HttpClient(handler), new ZgwTokenProvider(options), options);
+
+    Assert.Throws<InvalidOperationException>(() =>
+        source.Upload("local-1", "unknown-category", "registratie", "f.pdf", "application/pdf", [1, 2, 3], "111222333"));
+  }
+
+  [Fact]
+  public void LinkToZaak_posts_a_zaakinformatieobject_per_document_once_a_zaak_exists()
+  {
+    var options = Options();
+    var uploadHandler = new ZgwStubHandler(url =>
+        """{ "url": "https://oz.example/documenten/api/v1/enkelvoudiginformatieobjecten/eio-1" }""");
+    var uploader = new OpenZaakDocumentSource(new HttpClient(uploadHandler), new ZgwTokenProvider(options), options);
+    var doc = uploader.Upload("local-1", "identiteit", "registratie", "paspoort.pdf", "application/pdf", [1, 2, 3], "111222333");
+
+    var linkHandler = new ZgwStubHandler(url => url switch
+    {
+      _ when url == $"{ZrcBase}/zaakinformatieobjecten" => "{}",
+      _ => throw new InvalidOperationException($"unexpected ZGW call {url}"),
+    });
+    var linker = new OpenZaakDocumentSource(new HttpClient(linkHandler), new ZgwTokenProvider(options), options);
+
+    linker.LinkToZaak([doc.DocumentId], $"{ZrcBase}/zaken/uuid-1");
+
+    var body = linkHandler.BodyOf($"{ZrcBase}/zaakinformatieobjecten");
+    Assert.Contains($"{ZrcBase}/zaken/uuid-1", body);
+    Assert.Contains("eio-1", body);
+
+    // Local link also happened (dual-write) — the document is now Linked (delete blocked).
+    Assert.Equal(DocumentStore.DeleteResult.Linked, DocumentStore.DeleteOwned(doc.DocumentId, "111222333"));
+  }
+
+  [Fact]
+  public void LinkToZaak_makes_no_zgw_call_when_the_local_source_created_no_zaak()
+  {
+    var options = Options();
+    var handler = new ZgwStubHandler(url => throw new InvalidOperationException($"no HTTP call expected, got {url}"));
+    var source = new OpenZaakDocumentSource(new HttpClient(handler), new ZgwTokenProvider(options), options);
+
+    source.LinkToZaak(["some-document-id"], zaakUrl: null);
+
+    Assert.Empty(handler.Requests);
+  }
+}

backend/tests/BigRegister.Tests/OpenZaakZaakSourceTests.cs

@@ -1,5 +1,3 @@
-using System.Net;
-using System.Text;
 using BigRegister.Api.Data;
 using BigRegister.Api.Zgw;
 
@@ -34,7 +32,7 @@ public class OpenZaakZaakSourceTests
   [Fact]
   public void Follows_pagination_caches_zaaktype_and_sends_bearer_token()
   {
-    var handler = new StubHandler(url => url switch
+    var handler = new ZgwStubHandler(url => url switch
     {
       _ when url == $"{ZrcBase}/zaken" => Page1,
       _ when url == $"{ZrcBase}/zaken?page=2" => Page2,
@@ -64,7 +62,7 @@ public class OpenZaakZaakSourceTests
   public void CreateZaak_posts_zaak_status_and_rol_and_maps_the_result_back()
   {
     const string zaaktypeUrl = $"{ZtBase}/zaaktypen/zt-registratie";
-    var handler = new StubHandler(url => url switch
+    var handler = new ZgwStubHandler(url => url switch
     {
       _ when url == $"{ZrcBase}/zaken" => $$"""
         { "url": "{{ZrcBase}}/zaken/uuid-new", "identificatie": "BIG-2026-000123",
@@ -103,27 +101,26 @@ public class OpenZaakZaakSourceTests
       Referentie = "BIG-2026-000123",
     };
 
-    var (referentie, status) = source.CreateZaak(aanvraag, new DateTimeOffset(2026, 7, 28, 12, 0, 0, TimeSpan.Zero));
+    var (referentie, status, zaakUrl) = source.CreateZaak(aanvraag, new DateTimeOffset(2026, 7, 28, 12, 0, 0, TimeSpan.Zero));
 
     Assert.Equal("BIG-2026-000123", referentie);
     Assert.Equal("InBehandeling", status.Tag);
     Assert.Equal("BIG-2026-000123", status.Referentie);
-
-    string BodyOf(string url) => handler.Bodies[handler.Requests.LastIndexOf(url)];
+    Assert.Equal($"{ZrcBase}/zaken/uuid-new", zaakUrl);
 
     // Zaak: mapped zaaktype + configured RSINs + the local reference as identificatie.
-    var zaakBody = BodyOf($"{ZrcBase}/zaken");
+    var zaakBody = handler.BodyOf($"{ZrcBase}/zaken");
     Assert.Contains(zaaktypeUrl, zaakBody);
     Assert.Contains("123443210", zaakBody);
     Assert.Contains("BIG-2026-000123", zaakBody);
 
     // Status: points at the created zaak's URL and the resolved statustype.
-    var statusBody = BodyOf($"{ZrcBase}/statussen");
+    var statusBody = handler.BodyOf($"{ZrcBase}/statussen");
     Assert.Contains($"{ZrcBase}/zaken/uuid-new", statusBody);
     Assert.Contains("statustypen/st-1", statusBody);
 
     // Rol: points at the created zaak, the resolved initiator roltype, and the BSN.
-    var rolBody = BodyOf($"{ZrcBase}/rollen");
+    var rolBody = handler.BodyOf($"{ZrcBase}/rollen");
     Assert.Contains($"{ZrcBase}/zaken/uuid-new", rolBody);
     Assert.Contains("roltypen/rt-initiator", rolBody);
     Assert.Contains("111222333", rolBody);
@@ -133,29 +130,10 @@ public class OpenZaakZaakSourceTests
   public void CreateZaak_throws_when_the_aanvraag_type_has_no_configured_zaaktype()
   {
     var options = new ZgwOptions { ZrcBaseUrl = ZrcBase, ZtcBaseUrl = ZtBase, ClientId = "c", Secret = "s" };
-    var handler = new StubHandler(url => throw new InvalidOperationException($"no HTTP call expected, got {url}"));
+    var handler = new ZgwStubHandler(url => throw new InvalidOperationException($"no HTTP call expected, got {url}"));
     var source = new OpenZaakZaakSource(new HttpClient(handler), new ZgwTokenProvider(options), options);
     var aanvraag = new Aanvraag { Id = "a1", Type = "unknown-type", Owner = "111222333", Referentie = "BIG-2026-000123" };
 
     Assert.Throws<InvalidOperationException>(() => source.CreateZaak(aanvraag, DateTimeOffset.UtcNow));
   }
-
-  private sealed class StubHandler(Func<string, string> respond) : HttpMessageHandler
-  {
-    public List<string> Requests { get; } = new();
-    public List<string?> AuthSchemes { get; } = new();
-    public List<string> Bodies { get; } = new();
-
-    protected override Task<HttpResponseMessage> SendAsync(HttpRequestMessage request, CancellationToken cancellationToken)
-    {
-      var url = request.RequestUri!.ToString();
-      Requests.Add(url);
-      AuthSchemes.Add(request.Headers.Authorization?.Scheme);
-      Bodies.Add(request.Content?.ReadAsStringAsync(cancellationToken).GetAwaiter().GetResult() ?? "");
-      return Task.FromResult(new HttpResponseMessage(HttpStatusCode.OK)
-      {
-        Content = new StringContent(respond(url), Encoding.UTF8, "application/json"),
-      });
-    }
-  }
 }

backend/tests/BigRegister.Tests/ZgwStubHandler.cs

@@ -0,0 +1,32 @@
+using System.Net;
+using System.Text;
+
+namespace BigRegister.Tests;
+
+/// <summary>
+/// Stub HttpMessageHandler shared by the ZGW source tests (no live server, no mocking
+/// library) — keyed purely by request URL (method-agnostic, since no test scenario reuses a
+/// URL across GET/POST). Records every request's url/body/auth-scheme for assertion.
+/// Factored out of OpenZaakZaakSourceTests once OpenZaakDocumentSourceTests needed the
+/// identical stub.
+/// </summary>
+internal sealed class ZgwStubHandler(Func<string, string> respond) : HttpMessageHandler
+{
+  public List<string> Requests { get; } = new();
+  public List<string?> AuthSchemes { get; } = new();
+  public List<string> Bodies { get; } = new();
+
+  public string BodyOf(string url) => Bodies[Requests.LastIndexOf(url)];
+
+  protected override Task<HttpResponseMessage> SendAsync(HttpRequestMessage request, CancellationToken cancellationToken)
+  {
+    var url = request.RequestUri!.ToString();
+    Requests.Add(url);
+    AuthSchemes.Add(request.Headers.Authorization?.Scheme);
+    Bodies.Add(request.Content?.ReadAsStringAsync(cancellationToken).GetAwaiter().GetResult() ?? "");
+    return Task.FromResult(new HttpResponseMessage(HttpStatusCode.OK)
+    {
+      Content = new StringContent(respond(url), Encoding.UTF8, "application/json"),
+    });
+  }
+}