fix(backend): reject foreign documentIds on submit and draft-sync (WP-68 F1)

submit and draft-sync took document ids straight from the request body with no
ownership check: a caller who knew a foreign document's id could attach another
citizen's upload to their own aanvraag (surfacing on the behandelaar's beoordeling
screen, POSTed to OpenZaak as their zaakinformatieobject) and permanently block the
victim's own delete by flipping Linked=true. ADR-0001 holds the FE has no authority;
this trusted it anyway.

Adds DocumentStore.ForeignIds(ids, owner) and calls it from both write paths before
any write, 400 ProblemDetails on a mismatch.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

backend/src/BigRegister.Api/Data/DocumentStore.cs

@@ -96,6 +96,22 @@ public static class DocumentStore
     }
   }
 
+  /// <summary>Which of the given ids do NOT resolve to a document owned by <paramref name="owner"/>
+  /// (unknown id or owned by someone else) — named for what it returns (the offending ids), so a
+  /// caller can 400 with the specific ids rather than a bare boolean. Guards submit/draft-sync
+  /// against a citizen attaching another citizen's upload to their own aanvraag.</summary>
+  public static IReadOnlyList<string> ForeignIds(IEnumerable<string> documentIds, string owner)
+  {
+    var ids = documentIds.ToList();
+    lock (_gate)
+    {
+      using var db = Db.Create();
+      var owned = db.Documents.Where(d => ids.Contains(d.DocumentId) && d.Owner == owner)
+          .Select(d => d.DocumentId).ToHashSet();
+      return ids.Where(id => !owned.Contains(id)).ToList();
+    }
+  }
+
   /// <summary>Persist the DRC url an OpenZaak upload (WP-51) registered for a document.</summary>
   public static void SetDrcUrl(string documentId, string drcUrl)
   {

backend/src/BigRegister.Api/Program.cs

@@ -314,9 +314,19 @@ api.MapPost("/applications", (CreateApplicationRequest req, HttpContext ctx) =>
 
 // Draft sync per step — idempotent; keep it debounced on the client (it is chatty).
 api.MapPut("/applications/{id}", (string id, DraftSyncRequest req, HttpContext ctx) =>
-    ApplicationStore.SyncDraft(id, ctx.Zorgverlener().Bsn, req.Draft, req.StepIndex, req.StepCount, req.DocumentIds)
-        ? Results.NoContent() : Results.NotFound())
+{
+  var owner = ctx.Zorgverlener().Bsn;
+  // A citizen may only reference their own uploads in a draft — reject before the sync
+  // writes a foreign document id into the aanvraag (ADR-0001: the FE holds no authority).
+  if (req.DocumentIds is { } ids && DocumentStore.ForeignIds(ids, owner) is { Count: > 0 } foreign)
+    return Results.Problem(
+        detail: $"Onbekend of niet-eigen document(en): {string.Join(", ", foreign)}.",
+        statusCode: StatusCodes.Status400BadRequest);
+  return ApplicationStore.SyncDraft(id, owner, req.Draft, req.StepIndex, req.StepCount, req.DocumentIds)
+      ? Results.NoContent() : Results.NotFound();
+})
 .Produces(StatusCodes.Status204NoContent)
+.ProducesProblem(StatusCodes.Status400BadRequest)
 .Produces(StatusCodes.Status404NotFound);
 
 // Cancel a Concept (cascades to its unlinked documents). Submitted aanvragen cannot
@@ -353,6 +363,13 @@ api.MapPost("/applications/{id}/submit", (string id, SubmitApplicationRequest re
   var docs = req.Documents;
   var documentIds = docs?.Where(d => d.Channel == "digital" && d.DocumentId is not null).Select(d => d.DocumentId!).ToList();
 
+  // A citizen may only submit their own uploads — reject before the submit writes a
+  // foreign document id onto the aanvraag (ADR-0001: the FE holds no authority).
+  if (documentIds is { Count: > 0 } && DocumentStore.ForeignIds(documentIds, ctx.Zorgverlener().Bsn) is { Count: > 0 } foreignIds)
+    return Results.Problem(
+        detail: $"Onbekend of niet-eigen document(en): {string.Join(", ", foreignIds)}.",
+        statusCode: StatusCodes.Status400BadRequest);
+
   var submitted = ApplicationStore.Submit(id, ctx.Zorgverlener().Bsn, reject, autoApprovable, documentIds);
   if (submitted is null) return Results.Conflict();
 
@@ -401,6 +418,7 @@ api.MapPost("/applications/{id}/submit", (string id, SubmitApplicationRequest re
   return Results.Ok(new SubmitApplicationResponse(referentie, status));
 })
 .Produces<SubmitApplicationResponse>()
+.ProducesProblem(StatusCodes.Status400BadRequest)
 .ProducesProblem(StatusCodes.Status409Conflict)
 .Produces(StatusCodes.Status404NotFound);