feat(brief): WP-18 — ABAC capability spine (PRD-0002 phase P1)

Replace the FE-computed authorization anti-pattern in BriefStore.editable
(derived from the unverified X-Role header) with server-computed decision
flags, mirroring the existing HerregistratieDecisionsDto pattern:

- Backend: Authz.cs is the single authorization helper — the SAME check
  (Authz.CanActOn) both gates BriefStore.Review's mutations and computes
  the BriefDecisionsDto flags shipped on every brief response, so emit
  and enforce can never drift. New GET /me returns coarse, role-derived
  capabilities (PRD-0002 SS6).
- Every brief endpoint (including send, previously ungated on HttpContext)
  now returns a fresh BriefViewDto so decisions never go stale after a
  mutation.
- FE: brief.store.ts reads canEdit/canApprove/canReject/canSend off the
  loaded decisions instead of computing them from currentRole(); the
  brief.machine carries decisions through every status transition.
- New shared/domain/capability.ts + shared/application/access.store.ts +
  shared/infrastructure/me.adapter.ts: the general capability-spine
  infrastructure (AccessStore.can(), capabilityGuard) for future routes.

Deviates from the original WP-18 draft by NOT renaming auth/domain's
Session to a Principal union — ADR-0002 explicitly defers that refactor
until a second actor exists, and the brief workflow's drafter/approver
identity turned out to be a separate axis from the SSP login session
entirely. See docs/backlog/WP-18-abac-capability-spine.md for the full
as-built record.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

backend/tests/BigRegister.Tests/AuthzTests.cs

@@ -0,0 +1,68 @@
+using BigRegister.Domain.Authorization;
+using Xunit;
+
+namespace BigRegister.Tests;
+
+/// <summary>
+/// Unit tests for the single authorization helper (PRD-0002 phase P1) that both
+/// computes the brief screen's decision flags and gates the mutation endpoints.
+/// </summary>
+public class AuthzTests
+{
+  private static readonly Principal Drafter = new(PrincipalRole.Drafter);
+  private static readonly Principal Approver = new(PrincipalRole.Approver);
+  private const string DrafterId = "demo-drafter";
+
+  [Fact]
+  public void Drafter_may_not_approve_or_reject_even_when_submitted()
+  {
+    Assert.False(Authz.CanActOn(BriefAction.Approve, Drafter, DrafterId));
+    Assert.False(Authz.CanActOn(BriefAction.Reject, Drafter, DrafterId));
+  }
+
+  [Fact]
+  public void Approver_may_approve_and_reject_a_different_drafters_letter()
+  {
+    Assert.True(Authz.CanActOn(BriefAction.Approve, Approver, DrafterId));
+    Assert.True(Authz.CanActOn(BriefAction.Reject, Approver, DrafterId));
+  }
+
+  [Fact]
+  public void Send_is_not_role_gated()
+  {
+    Assert.True(Authz.CanActOn(BriefAction.Send, Drafter, DrafterId));
+    Assert.True(Authz.CanActOn(BriefAction.Send, Approver, DrafterId));
+  }
+
+  [Theory]
+  [InlineData("draft")]
+  [InlineData("rejected")]
+  public void Decisions_CanEdit_true_for_drafter_in_editable_statuses(string status)
+  {
+    Assert.True(Authz.Decisions(Drafter, status, DrafterId).CanEdit);
+    Assert.False(Authz.Decisions(Approver, status, DrafterId).CanEdit);
+  }
+
+  [Fact]
+  public void Decisions_CanApprove_requires_submitted_status_and_approver_role()
+  {
+    Assert.True(Authz.Decisions(Approver, "submitted", DrafterId).CanApprove);
+    Assert.False(Authz.Decisions(Approver, "draft", DrafterId).CanApprove);
+    Assert.False(Authz.Decisions(Drafter, "submitted", DrafterId).CanApprove);
+  }
+
+  [Fact]
+  public void Decisions_CanSend_requires_approved_status_only()
+  {
+    Assert.True(Authz.Decisions(Drafter, "approved", DrafterId).CanSend);
+    Assert.True(Authz.Decisions(Approver, "approved", DrafterId).CanSend);
+    Assert.False(Authz.Decisions(Approver, "submitted", DrafterId).CanSend);
+  }
+
+  [Fact]
+  public void RoleCapabilities_are_empty_for_drafter_and_the_three_brief_capabilities_for_approver()
+  {
+    Assert.Empty(Authz.RoleCapabilities(Drafter));
+    Assert.Equal(new[] { "brief:approve", "brief:reject", "brief:send" }, Authz.RoleCapabilities(Approver));
+  }
+}

backend/tests/BigRegister.Tests/BriefEndpointTests.cs

@@ -90,8 +90,8 @@ public class BriefEndpointTests(WebApplicationFactory<Program> factory) : IClass
 
     var res = await _client.SendAsync(Post("/api/v1/brief/submit"));
     res.EnsureSuccessStatusCode();
-    var submitted = await res.Content.ReadFromJsonAsync<BriefDto>();
-    Assert.Equal("submitted", submitted!.Status.Tag);
+    var submitted = await res.Content.ReadFromJsonAsync<BriefViewDto>();
+    Assert.Equal("submitted", submitted!.Brief.Status.Tag);
   }
 
   [Fact]
@@ -106,7 +106,7 @@ public class BriefEndpointTests(WebApplicationFactory<Program> factory) : IClass
 
     var res = await _client.SendAsync(Post("/api/v1/brief/approve", role: "approver"));
     res.EnsureSuccessStatusCode();
-    Assert.Equal("approved", (await res.Content.ReadFromJsonAsync<BriefDto>())!.Status.Tag);
+    Assert.Equal("approved", (await res.Content.ReadFromJsonAsync<BriefViewDto>())!.Brief.Status.Tag);
   }
 
   [Fact]
@@ -117,13 +117,13 @@ public class BriefEndpointTests(WebApplicationFactory<Program> factory) : IClass
     await _client.SendAsync(Post("/api/v1/brief/submit"));
 
     var rejected = await (await _client.SendAsync(
-        Post("/api/v1/brief/reject", role: "approver", body: new RejectBriefRequest("Graag aanvullen.")))).Content.ReadFromJsonAsync<BriefDto>();
-    Assert.Equal("rejected", rejected!.Status.Tag);
-    Assert.Equal("Graag aanvullen.", rejected.Status.Comments);
+        Post("/api/v1/brief/reject", role: "approver", body: new RejectBriefRequest("Graag aanvullen.")))).Content.ReadFromJsonAsync<BriefViewDto>();
+    Assert.Equal("rejected", rejected!.Brief.Status.Tag);
+    Assert.Equal("Graag aanvullen.", rejected.Brief.Status.Comments);
 
     // A drafter save on a rejected letter reopens it to draft.
-    var reopened = await (await _client.PutAsJsonAsync("/api/v1/brief", FilledFrom(brief))).Content.ReadFromJsonAsync<BriefDto>();
-    Assert.Equal("draft", reopened!.Status.Tag);
+    var reopened = await (await _client.PutAsJsonAsync("/api/v1/brief", FilledFrom(brief))).Content.ReadFromJsonAsync<BriefViewDto>();
+    Assert.Equal("draft", reopened!.Brief.Status.Tag);
   }
 
   [Fact]
@@ -139,7 +139,36 @@ public class BriefEndpointTests(WebApplicationFactory<Program> factory) : IClass
     await _client.SendAsync(Post("/api/v1/brief/approve", role: "approver"));
     var res = await _client.SendAsync(Post("/api/v1/brief/send"));
     res.EnsureSuccessStatusCode();
-    Assert.Equal("sent", (await res.Content.ReadFromJsonAsync<BriefDto>())!.Status.Tag);
+    Assert.Equal("sent", (await res.Content.ReadFromJsonAsync<BriefViewDto>())!.Brief.Status.Tag);
+  }
+
+  [Fact]
+  public async Task Decisions_on_the_view_mirror_the_acting_principal_and_live_status()
+  {
+    var brief = await Get();
+    var view = await _client.GetFromJsonAsync<BriefViewDto>("/api/v1/brief");
+    Assert.True(view!.Decisions.CanEdit); // default (no X-Role) = drafter, draft status
+    Assert.False(view.Decisions.CanApprove);
+
+    await _client.PutAsJsonAsync("/api/v1/brief", FilledFrom(brief));
+    await _client.SendAsync(Post("/api/v1/brief/submit"));
+
+    var asApprover = await _client.SendAsync(
+        new HttpRequestMessage(HttpMethod.Get, "/api/v1/brief") { Headers = { { "X-Role", "approver" } } });
+    var approverView = await asApprover.Content.ReadFromJsonAsync<BriefViewDto>();
+    Assert.True(approverView!.Decisions.CanApprove);
+    Assert.False(approverView.Decisions.CanEdit); // approver never edits
+  }
+
+  [Fact]
+  public async Task Me_returns_no_capabilities_for_drafter_and_the_brief_set_for_approver()
+  {
+    var asDrafter = await _client.GetFromJsonAsync<MeDto>("/api/v1/me");
+    Assert.Empty(asDrafter!.Capabilities);
+
+    var res = await _client.SendAsync(new HttpRequestMessage(HttpMethod.Get, "/api/v1/me") { Headers = { { "X-Role", "approver" } } });
+    var asApprover = await res.Content.ReadFromJsonAsync<MeDto>();
+    Assert.Equal(new[] { "brief:approve", "brief:reject", "brief:send" }, asApprover!.Capabilities);
   }
 
   [Fact]