eho/atomic-design-poc
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat(security): ABAC P2/P3-lite — BIG-nummer redaction, authz audit, guard; clear dev audit

Browse Source 
- fix(deps): pin @babel/core ^7.29.7 via overrides → npm audit 0 (dev+prod),
  no --force / no Angular downgrade; README corrected
- feat(brief): field-level PII reveal (PRD-0002 §5c) — CaseContext BIG-nummer
  ships masked; step-up-stubbed (X-Step-Up), audited POST /brief/reveal-bignummer
  unmasks it; drafter-only capability, deny-by-default. Realized on the BIG-nummer
  (no BSN on the wire)
- feat(authz): no-PII AuditAuthz log for reveal attempts + org-admin denials (§8)
- feat(routes): wire capabilityGuard('orgtemplate:edit') onto brief/huisstijl (§6)
- test: backend +5 (Authz + reveal endpoint), FE +3 (adapter boundary, store swap)
- docs: PRD-0002 §5c/§9, WP-18 follow-up, README

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This commit is contained in:
eho
2026-07-20 19:59:20 +02:00
co-authored by Claude Opus 4.8
parent 0edfbba2a9
commit 5cae44f163
24 changed files with 353 additions and 211 deletions
Download Patch File Download Diff File Expand all files Collapse all files
backend/src/BigRegister.Api/Contracts/Dtos.cs
+6 -1
View File
@@ -153,7 +153,9 @@ public sealed record BriefDto(
// Decision flags for the CURRENT acting principal + this brief's live status
// (PRD-0002 phase P1) — the FE renders these, it never recomputes them.
public sealed record BriefDecisionsDto(bool CanEdit, bool CanApprove, bool CanReject, bool CanSend);
// CanRevealBigNummer (PRD-0002 §5c): whether the acting principal may unmask the
// BIG-nummer the case screen ships masked. Status-independent, unlike the action gates.
public sealed record BriefDecisionsDto(bool CanEdit, bool CanApprove, bool CanReject, bool CanSend, bool CanRevealBigNummer);
// The brief's screen DTO also carries the org template it renders with (WP-23):
// the sub-org's current PUBLISHED version — or, once sent, the version pinned at
@@ -169,6 +171,9 @@ public sealed record BriefViewDto(
public sealed record SaveBriefRequest(IReadOnlyList<LetterSectionDto> Sections);
public sealed record RejectBriefRequest(string Comments);
// The unmasked BIG-nummer, returned only from the audited + step-up-gated reveal
// endpoint (PRD-0002 §5c). Never logged.
public sealed record RevealBigNummerResponse(string BigNummer);
// PRD-0002 §6: coarse, role-derived capabilities for nav/menu-level checks.
public sealed record MeDto(IReadOnlyList<string> Capabilities);
backend/src/BigRegister.Api/Domain/Authorization/Authz.cs
+11 -1
View File
@@ -64,6 +64,14 @@ public static class Authz
/// have no per-resource state to weigh, so role IS the whole decision here.
public static bool CanManageOrgTemplates(Principal principal) => principal.Role == PrincipalRole.Admin;
/// Field-level PII (PRD-0002 §5c, phase P2): the case screen's BIG-nummer ships
/// masked by default; only the behandelaar (Drafter) composing the case — the actor
/// whose behandel-scherm shows the field — may reveal it. Role-based in the POC; a
/// real system resolves it from the app overlay independent of role. The reveal itself
/// is additionally step-up-gated + audited at the endpoint. (Illustrated on the
/// BIG-nummer because no BSN travels the wire — see PRD note.)
public static bool CanRevealBigNummer(Principal principal) => principal.Role == PrincipalRole.Drafter;
/// Resource-aware decision for the screen DTO: "would this action succeed right
/// now" — role/SoD AND the brief's current status. This is what the UI renders;
/// it never re-derives these booleans itself.
@@ -71,5 +79,7 @@ public static class Authz
CanEdit: principal.Role == PrincipalRole.Drafter && status is "draft" or "rejected",
CanApprove: CanActOn(BriefAction.Approve, principal, drafterId) && status == "submitted",
CanReject: CanActOn(BriefAction.Reject, principal, drafterId) && status == "submitted",
CanSend: CanActOn(BriefAction.Send, principal, drafterId) && status == "approved");
CanSend: CanActOn(BriefAction.Send, principal, drafterId) && status == "approved",
// PII reveal is status-independent (§5c) — unlike the action gates above.
CanRevealBigNummer: CanRevealBigNummer(principal));
}
backend/src/BigRegister.Api/Program.cs
+55 -7
View File
@@ -346,6 +346,30 @@ api.MapPost("/brief/send", (HttpContext ctx) =>
.Produces<BriefViewDto>()
.ProducesProblem(StatusCodes.Status409Conflict);
// Field-level PII reveal (PRD-0002 §5c/§5d, phase P2): the case screen ships the
// BIG-nummer masked (see ToView). Unmasking requires the reveal capability AND a
// step-up (stubbed here as the X-Step-Up header); every attempt — allow or deny — is
// audited with NO PII (AuditAuthz). The unmasked value is returned only on allow,
// and never written to a log line.
api.MapPost("/brief/reveal-bignummer", (HttpContext ctx) =>
{
var principal = Authz.ResolvePrincipal(ctx);
var canReveal = Authz.CanRevealBigNummer(principal);
var steppedUp = ctx.Request.Headers["X-Step-Up"] == "true";
var allowed = canReveal && steppedUp;
AuditAuthz(ctx, "brief:reveal-bignummer", "brief/" + DocumentStore.DemoOwner, allowed, principal);
if (!allowed)
return Results.Problem(
detail: canReveal
? "Aanvullende verificatie vereist om het BIG-nummer te tonen."
: "U mag het BIG-nummer niet inzien.",
statusCode: StatusCodes.Status403Forbidden);
return Results.Ok(new RevealBigNummerResponse(SeedData.Registration.BigNummer));
})
// Hand-written fetch on the FE (needs a per-call X-Step-Up header) — excluded from the
// OpenAPI doc, same seam as /brief/preview and uploads.
.ExcludeFromDescription();
// Server-rendered HTML preview (WP-25): "what you compose is what is sent" — the
// same LetterHtml.Render a sent brief archived. Hand-written on the FE (fetch →
// blob → new tab), so excluded from the OpenAPI doc, same seam as uploads. Sent
@@ -435,12 +459,34 @@ app.Run();
static bool IsAdmin(HttpContext ctx) => ctx.Request.Headers["X-Admin"] == "true";
// One gate for every org-template endpoint — the enforce twin of the
// `orgtemplate:edit` capability RoleCapabilities emits (single Authz source).
static IResult OrgAdmin(HttpContext ctx, Func<IResult> action) =>
Authz.CanManageOrgTemplates(Authz.ResolvePrincipal(ctx))
? action()
: Results.Problem(detail: "Alleen een beheerder mag organisatiesjablonen beheren.",
statusCode: StatusCodes.Status403Forbidden);
// `orgtemplate:edit` capability RoleCapabilities emits (single Authz source). A denial
// is audited (PRD-0002 §8); the allow path is left un-logged (the endpoints log their
// own effect, e.g. publish).
IResult OrgAdmin(HttpContext ctx, Func<IResult> action)
{
var principal = Authz.ResolvePrincipal(ctx);
if (Authz.CanManageOrgTemplates(principal)) return action();
AuditAuthz(ctx, "orgtemplate:edit", "org-templates", false, principal);
return Results.Problem(detail: "Alleen een beheerder mag organisatiesjablonen beheren.",
statusCode: StatusCodes.Status403Forbidden);
}
// Authorization audit (PRD-0002 §8): access-relevant decisions recorded with NO PII —
// action, resource ref, allow/deny, acting role, correlation id. Never the value that
// was (or wasn't) revealed. Mirrors the no-PII Submit audit below.
void AuditAuthz(HttpContext ctx, string action, string resource, bool allowed, Principal principal)
{
var cid = ctx.Items.TryGetValue("CorrelationId", out var v) ? (string)v! : "none";
app.Logger.LogInformation(
"authz action={Action} resource={Resource} decision={Decision} role={Role} correlationId={Cid}",
action, resource, allowed ? "allow" : "deny", principal.Role, cid);
}
// Keep the last `keep` characters, mask the rest — mirrors the FE maskTail
// (src/app/shared/ui/debug-state/mask.ts) so wire redaction and the dev panel agree.
static string MaskTail(string value, int keep) =>
value.Length <= keep ? new string('*', value.Length)
: new string('*', value.Length - keep) + value[^keep..];
static string Now() => DateTimeOffset.UtcNow.ToString("o");
@@ -453,7 +499,9 @@ BriefViewDto ToView(HttpContext ctx, BriefEntity e) => new(
OrgTemplateStore.TemplateForBrief(e.SubOrgId, e.Status.Tag == "sent" ? e.SentOrgTemplateVersion : null),
// The case this letter is about — joined from the seeded zorgverlener so the
// behandel scherm can show whom/what it concerns without brief/ importing registratie.
new CaseContextDto(SeedData.Registration.Naam, SeedData.Registration.BigNummer, e.Beroep, BriefSeed.AanvraagReferentie));
// The BIG-nummer ships MASKED by default (PRD-0002 §5c, field-level PII); the reveal
// endpoint returns the full value, gated + audited.
new CaseContextDto(SeedData.Registration.Naam, MaskTail(SeedData.Registration.BigNummer, 3), e.Beroep, BriefSeed.AanvraagReferentie));
// Emit (decision flags, via ToView) and enforce (Forbidden/Conflict below) both run
// through Authz — see BriefStore.Review and Authz.CanActOn — so they cannot drift.