eho/atomic-design-poc
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat(behandelportal): WP-62 medewerker caller identity + authz seam

Browse Source 
Splits backend CallerIdentity into the two ADR-0002 §3 actor kinds
(ZorgverlenerCaller/MedewerkerCaller), a stub X-Medewerker/X-Rollen header
path mirroring WP-53's citizen stub, and Authz.CanBeoordelen as the first
medewerker capability — backend-only, no consumer until WP-64. Also fixes
the backlog README's stale WP-61 status (done, but table said todo).

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
This commit is contained in:
eho
2026-07-31 23:47:43 +02:00
co-authored by Claude Sonnet 5
parent e4ea75414b
commit a09c4ed87b
21 changed files with 289 additions and 72 deletions
Download Patch File Download Diff File Expand all files Collapse all files
backend/tests/BigRegister.Tests/StubIdentityProviderTests.cs
+59 -6
View File
@@ -4,23 +4,30 @@ using Microsoft.AspNetCore.Http;
namespace BigRegister.Tests;
/// WP-53: the dev stub identity provider — role from X-Role (unchanged behaviour), subject BSN
/// from the new X-Subject header, defaulting to the single seeded citizen so every existing
/// request (none of which send X-Subject) resolves exactly as before this WP.
/// WP-53 (extended WP-62): the dev stub identity provider — role from X-Role (unchanged
/// behaviour, applies to either actor kind), subject BSN from X-Subject defaulting to the
/// single seeded citizen so every existing request (none of which send X-Subject) resolves
/// exactly as before this WP. X-Medewerker (+ X-Rollen) selects the medewerker actor kind.
public class StubIdentityProviderTests
{
private static CallerIdentity Resolve(string? role, string? subject)
private static CallerIdentity Resolve(
string? role = null, string? subject = null, string? medewerker = null, string? rollen = null)
{
var ctx = new DefaultHttpContext();
if (role is not null) ctx.Request.Headers["X-Role"] = role;
if (subject is not null) ctx.Request.Headers["X-Subject"] = subject;
if (medewerker is not null) ctx.Request.Headers["X-Medewerker"] = medewerker;
if (rollen is not null) ctx.Request.Headers["X-Rollen"] = rollen;
return new StubIdentityProvider().Resolve(ctx);
}
private static ZorgverlenerCaller ResolveZorgverlener(string? role = null, string? subject = null) =>
Assert.IsType<ZorgverlenerCaller>(Resolve(role, subject));
[Fact]
public void No_headers_resolves_to_the_seeded_citizen_as_a_drafter()
{
var caller = Resolve(role: null, subject: null);
var caller = ResolveZorgverlener(role: null, subject: null);
Assert.Equal(DocumentStore.DemoOwner, caller.Bsn);
Assert.Equal(PrincipalRole.Drafter, caller.Role);
}
@@ -37,7 +44,53 @@ public class StubIdentityProviderTests
[Fact]
public void X_subject_overrides_the_default_bsn()
{
var caller = Resolve(role: null, subject: "999888777");
var caller = ResolveZorgverlener(role: null, subject: "999888777");
Assert.Equal("999888777", caller.Bsn);
}
[Fact]
public void No_headers_resolves_a_zorgverlener_kind()
{
Assert.IsType<ZorgverlenerCaller>(Resolve());
}
[Fact]
public void X_medewerker_resolves_a_medewerker_with_the_default_behandelaar_rol()
{
var caller = Assert.IsType<MedewerkerCaller>(Resolve(medewerker: "m.jansen"));
Assert.Equal("m.jansen", caller.MedewerkerId);
Assert.Equal("m.jansen", caller.SubjectId);
Assert.Contains(MedewerkerRol.Behandelaar, caller.Rollen);
}
[Fact]
public void X_medewerker_takes_precedence_over_x_subject()
{
var caller = Resolve(subject: "999888777", medewerker: "m.jansen");
Assert.IsType<MedewerkerCaller>(caller);
}
[Fact]
public void Empty_x_medewerker_falls_through_to_the_zorgverlener_default()
{
var caller = Assert.IsType<ZorgverlenerCaller>(Resolve(medewerker: ""));
Assert.Equal(DocumentStore.DemoOwner, caller.Bsn);
}
[Theory]
[InlineData("behandelaar", new[] { MedewerkerRol.Behandelaar })]
[InlineData("Behandelaar, behandelaar", new[] { MedewerkerRol.Behandelaar })]
[InlineData("geen", new MedewerkerRol[0])]
public void X_rollen_parses_known_tokens_and_drops_unknown_ones(string rollen, MedewerkerRol[] expected)
{
var caller = Assert.IsType<MedewerkerCaller>(Resolve(medewerker: "m.jansen", rollen: rollen));
Assert.Equal(expected, caller.Rollen);
}
[Fact]
public void X_role_still_applies_to_a_medewerker()
{
var caller = Resolve(role: "admin", medewerker: "m.jansen");
Assert.Equal(PrincipalRole.Admin, caller.Role);
}
}