Merge RB-11 — keep the dev hatches out of production builds

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

# Conflicts:
#	libs/shared/docs/behaviour-spec.mdx

apps/ssp/src/app/brief/application/brief.store.ts

@@ -233,9 +233,12 @@ export class BriefStore implements PendingSave {
   /** Reveal the masked case BIG-nummer (PRD-0002 §5c). Server re-checks the capability
       + step-up and audits the attempt; on success we swap the masked value in the
       already-loaded caseContext (a field update, not a reload). The step-up gesture
-      itself is the UI's concern — this command just runs the audited server call. */
+      itself is the UI's concern (`behandel-scherm.component.ts`'s `onReveal()` confirm)
+      — this command is only reachable once that gesture has happened, so it is the one
+      that tells the adapter to send `X-Step-Up` (BIO-006a: the adapter itself no longer
+      hardcodes the header). */
   async revealBigNummer() {
-    const r = await this.revealAdapter.reveal();
+    const r = await this.revealAdapter.reveal(true);
     if (!r.ok) {
       this.actionState.set({ tag: 'Failed', error: r.error });
       return;

apps/ssp/src/app/brief/infrastructure/letter-preview.adapter.spec.ts

@@ -0,0 +1,69 @@
+import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest';
+import { errorMessage, PREVIEW_FAILED, LetterPreviewAdapter } from './letter-preview.adapter';
+
+// Minimal Response stand-in — errorMessage only calls `.json()`. Avoids stubbing
+// globalThis.fetch to reach this trust boundary (TE-002).
+const fakeResponse = (body: unknown): Response =>
+  ({ json: () => Promise.resolve(body) }) as unknown as Response;
+
+describe('errorMessage (TE-002 trust boundary)', () => {
+  it('surfaces the ProblemDetails detail when present', async () => {
+    expect(await errorMessage(fakeResponse({ detail: 'Geen toegang.', status: 403 }))).toBe(
+      'Geen toegang.',
+    );
+  });
+
+  it('falls back to PREVIEW_FAILED when the body has no detail', async () => {
+    expect(await errorMessage(fakeResponse({ status: 500 }))).toBe(PREVIEW_FAILED);
+  });
+
+  it('falls back to PREVIEW_FAILED when the body is not JSON', async () => {
+    const res = { json: () => Promise.reject(new Error('not json')) } as unknown as Response;
+    expect(await errorMessage(res)).toBe(PREVIEW_FAILED);
+  });
+});
+
+// isDevMode() reads the `ngDevMode` global the Angular CLI defines away in a
+// production build. There is no ambient type for it in app code, so this is
+// accessed through an untyped bag rather than a `declare const`.
+const globals = globalThis as Record<string, unknown>;
+const originalNgDevMode = globals['ngDevMode'];
+const setDevMode = (on: boolean) => {
+  globals['ngDevMode'] = on;
+};
+
+describe('LetterPreviewAdapter.preview (BIO-012)', () => {
+  const okResponse = () =>
+    ({ ok: true, blob: () => Promise.resolve(new Blob()) }) as unknown as Response;
+
+  afterEach(() => {
+    globals['ngDevMode'] = originalNgDevMode;
+    vi.unstubAllGlobals();
+    history.pushState({}, '', '/');
+    sessionStorage.clear();
+  });
+
+  it('sends no X-Role/X-Subject headers outside isDevMode()', async () => {
+    setDevMode(false);
+    history.pushState({}, '', '/?subject=111222333');
+    const fetchSpy = vi.fn().mockResolvedValue(okResponse());
+    vi.stubGlobal('fetch', fetchSpy);
+
+    await new LetterPreviewAdapter().preview();
+
+    expect(fetchSpy.mock.calls[0][1].headers).toEqual({});
+  });
+
+  it('sends X-Role (and X-Subject when known) under isDevMode()', async () => {
+    setDevMode(true);
+    history.pushState({}, '', '/?subject=111222333');
+    const fetchSpy = vi.fn().mockResolvedValue(okResponse());
+    vi.stubGlobal('fetch', fetchSpy);
+
+    await new LetterPreviewAdapter().preview();
+
+    const headers = fetchSpy.mock.calls[0][1].headers as Record<string, string>;
+    expect(headers['X-Role']).toBeDefined();
+    expect(headers['X-Subject']).toBe('111222333');
+  });
+});

apps/ssp/src/app/brief/infrastructure/letter-preview.adapter.ts

@@ -1,4 +1,4 @@
-import { Injectable } from '@angular/core';
+import { Injectable, isDevMode } from '@angular/core';
 import { Result, ok, err } from '@shared/kernel/fp';
 import { currentRole } from '@shared/infrastructure/role';
 import { currentSubject } from '@shared/infrastructure/subject';
@@ -15,7 +15,10 @@ export const PREVIEW_FAILED = $localize`:@@brief.preview.failed:De voorvertoning
  * hand-written fetch, not the `ApiClient`. That also means it bypasses `HttpClient`'s
  * `roleInterceptor` AND `subjectInterceptor`, so both `X-Role` and `X-Subject` are set
  * here explicitly (WP-74 — without `X-Subject` this always previewed
- * `DocumentStore.DemoOwner`'s letter regardless of who was actually logged in).
+ * `DocumentStore.DemoOwner`'s letter regardless of who was actually logged in). Both are
+ * dev-only identity stand-ins (`role.ts`/`subject.ts`) and are sent only under
+ * `isDevMode()`, mirroring how the interceptors themselves are only registered in dev
+ * (`app.config.ts`) — a production build sends neither header from this call (BIO-012).
  *
  * `cache: 'no-store'` (WP-74): the endpoint has no `Cache-Control`, only a CORS-driven
  * `Vary: Origin`, and its content changes at the SAME URL as the letter moves
@@ -43,7 +46,9 @@ export class LetterPreviewAdapter {
       const subject = currentSubject();
       res = await fetch(`${environment.apiBaseUrl}/api/v1/brief/preview`, {
         cache: 'no-store',
-        headers: { 'X-Role': currentRole(), ...(subject ? { 'X-Subject': subject } : {}) },
+        headers: isDevMode()
+          ? { 'X-Role': currentRole(), ...(subject ? { 'X-Subject': subject } : {}) }
+          : {},
       });
     } catch {
       return err(PREVIEW_FAILED);
@@ -53,7 +58,9 @@ export class LetterPreviewAdapter {
   }
 }
 
-async function errorMessage(res: Response): Promise<string> {
+/** Trust boundary (TE-002): maps a non-OK response to a message. Exported so a spec
+    can call it directly instead of stubbing `globalThis.fetch`. */
+export async function errorMessage(res: Response): Promise<string> {
   try {
     return problemDetail(await res.json(), PREVIEW_FAILED);
   } catch {

apps/ssp/src/app/brief/infrastructure/org-template.adapter.spec.ts

@@ -1,6 +1,10 @@
 import { describe, it, expect } from 'vitest';
 import { OrgTemplateAdminViewDto, OrgTemplateDto } from '@shared/infrastructure/api-client';
-import { parseOrgTemplateAdminView } from './org-template.adapter';
+import {
+  parseOrgTemplateAdminView,
+  proefbriefErrorMessage,
+  PROEFBRIEF_FAILED,
+} from './org-template.adapter';
 
 const draft: OrgTemplateDto = {
   subOrgId: 'cibg-registers',
@@ -54,3 +58,25 @@ describe('parseOrgTemplateAdminView', () => {
     expect(r.ok).toBe(false);
   });
 });
+
+// Minimal Response stand-in — proefbriefErrorMessage only calls `.json()`. Avoids
+// stubbing globalThis.fetch to reach this trust boundary (TE-002).
+const fakeResponse = (body: unknown): Response =>
+  ({ json: () => Promise.resolve(body) }) as unknown as Response;
+
+describe('proefbriefErrorMessage (TE-002 trust boundary)', () => {
+  it('surfaces the ProblemDetails detail when present', async () => {
+    expect(
+      await proefbriefErrorMessage(fakeResponse({ detail: 'Niet gevonden.', status: 404 })),
+    ).toBe('Niet gevonden.');
+  });
+
+  it('falls back to PROEFBRIEF_FAILED when the body has no detail', async () => {
+    expect(await proefbriefErrorMessage(fakeResponse({ status: 500 }))).toBe(PROEFBRIEF_FAILED);
+  });
+
+  it('falls back to PROEFBRIEF_FAILED when the body is not JSON', async () => {
+    const res = { json: () => Promise.reject(new Error('not json')) } as unknown as Response;
+    expect(await proefbriefErrorMessage(res)).toBe(PROEFBRIEF_FAILED);
+  });
+});

apps/ssp/src/app/brief/infrastructure/org-template.adapter.ts

@@ -1,4 +1,4 @@
-import { Injectable, inject } from '@angular/core';
+import { Injectable, inject, isDevMode } from '@angular/core';
 import { Result, ok, err } from '@shared/kernel/fp';
 import { runSubmit } from '@shared/application/submit';
 import { currentRole } from '@shared/infrastructure/role';
@@ -26,10 +26,13 @@ import { parseOrgTemplate } from '@brief/infrastructure/brief.adapter';
  * rollback go through the generated client (X-Role added by `roleInterceptor`);
  * `parse*` narrows the untrusted wire shape. The proefbrief is `text/html` and
  * `ExcludeFromDescription`'d — a hand-written fetch, same seam as `letter-preview.adapter`.
+ * `X-Role` there is a dev-only identity stand-in (`role.ts`) and is sent only under
+ * `isDevMode()`, mirroring `roleInterceptor`'s own dev-only registration — a production
+ * build never sends it from this hand-written call either (BIO-012).
  */
 
 const FAILED = $localize`:@@orgTemplate.action.failed:De actie is niet gelukt. Probeer het later opnieuw.`;
-const PROEFBRIEF_FAILED = $localize`:@@orgTemplate.proefbrief.failed:De proefbrief kon niet worden geopend.`;
+export const PROEFBRIEF_FAILED = $localize`:@@orgTemplate.proefbrief.failed:De proefbrief kon niet worden geopend.`;
 
 @Injectable({ providedIn: 'root' })
 export class OrgTemplateAdapter {
@@ -76,22 +79,26 @@ export class OrgTemplateAdapter {
     try {
       res = await fetch(
         `${environment.apiBaseUrl}/api/v1/admin/org-template/${encodeURIComponent(subOrgId)}/preview`,
-        { headers: { 'X-Role': currentRole() } },
+        { headers: isDevMode() ? { 'X-Role': currentRole() } : {} },
       );
     } catch {
       return err(PROEFBRIEF_FAILED);
     }
-    if (!res.ok) {
-      try {
-        return err(problemDetail(await res.json(), PROEFBRIEF_FAILED));
-      } catch {
-        return err(PROEFBRIEF_FAILED);
-      }
-    }
+    if (!res.ok) return err(await proefbriefErrorMessage(res));
     return ok(await res.blob());
   }
 }
 
+/** Trust boundary (TE-002): maps a non-OK proefbrief response to a message. Exported
+    so a spec can call it directly instead of stubbing `globalThis.fetch`. */
+export async function proefbriefErrorMessage(res: Response): Promise<string> {
+  try {
+    return problemDetail(await res.json(), PROEFBRIEF_FAILED);
+  } catch {
+    return PROEFBRIEF_FAILED;
+  }
+}
+
 // --- parse: wire → domain, validating at the boundary ---
 
 function parseSubOrg(dto: SubOrgSummaryDto): Result<string, SubOrgSummary> {

apps/ssp/src/app/brief/infrastructure/reveal-bignummer.adapter.spec.ts

@@ -0,0 +1,77 @@
+import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest';
+import { parseRevealed, REVEAL_FAILED, RevealBigNummerAdapter } from './reveal-bignummer.adapter';
+
+describe('parseRevealed (TE-002 trust boundary)', () => {
+  it('accepts a well-formed body', () => {
+    const r = parseRevealed({ bigNummer: '12345678' });
+    expect(r.ok).toBe(true);
+    if (r.ok) expect(r.value).toBe('12345678');
+  });
+
+  // The finding's own named case: a numeric bigNummer must be rejected, not
+  // coerced — this is a PII reveal, not a display formatter.
+  it('rejects a bigNummer sent as a number', () => {
+    const r = parseRevealed({ bigNummer: 42 });
+    expect(r).toEqual({ ok: false, error: REVEAL_FAILED });
+  });
+
+  it('rejects a missing bigNummer field', () => {
+    expect(parseRevealed({}).ok).toBe(false);
+  });
+
+  it('rejects null and non-object bodies', () => {
+    expect(parseRevealed(null).ok).toBe(false);
+    expect(parseRevealed(undefined).ok).toBe(false);
+    expect(parseRevealed('12345678').ok).toBe(false);
+    expect(parseRevealed(42).ok).toBe(false);
+  });
+});
+
+// isDevMode() reads the `ngDevMode` global the Angular CLI defines away in a
+// production build. There is no ambient type for it in app code, so this is
+// accessed through an untyped bag rather than a `declare const`.
+const globals = globalThis as Record<string, unknown>;
+const originalNgDevMode = globals['ngDevMode'];
+const setDevMode = (on: boolean) => {
+  globals['ngDevMode'] = on;
+};
+
+describe('RevealBigNummerAdapter.reveal (BIO-006a + BIO-012)', () => {
+  const okResponse = () =>
+    ({ ok: true, json: () => Promise.resolve({ bigNummer: '12345678' }) }) as unknown as Response;
+
+  beforeEach(() => setDevMode(true));
+  afterEach(() => {
+    globals['ngDevMode'] = originalNgDevMode;
+    vi.unstubAllGlobals();
+  });
+
+  it('sends X-Step-Up only when the caller passes stepUp: true', async () => {
+    const fetchSpy = vi.fn().mockResolvedValue(okResponse());
+    vi.stubGlobal('fetch', fetchSpy);
+
+    await new RevealBigNummerAdapter().reveal(false);
+    const headersWithoutStepUp = fetchSpy.mock.calls[0][1].headers as Record<string, string>;
+    expect(headersWithoutStepUp['X-Step-Up']).toBeUndefined();
+
+    await new RevealBigNummerAdapter().reveal(true);
+    const headersWithStepUp = fetchSpy.mock.calls[1][1].headers as Record<string, string>;
+    expect(headersWithStepUp['X-Step-Up']).toBe('true');
+  });
+
+  it('sends X-Role only under isDevMode()', async () => {
+    const fetchSpy = vi.fn().mockResolvedValue(okResponse());
+    vi.stubGlobal('fetch', fetchSpy);
+
+    setDevMode(false);
+    await new RevealBigNummerAdapter().reveal(true);
+    const prodHeaders = fetchSpy.mock.calls[0][1].headers as Record<string, string>;
+    expect(prodHeaders['X-Role']).toBeUndefined();
+    expect(prodHeaders['X-Step-Up']).toBe('true'); // step-up is not a dev-only hatch
+
+    setDevMode(true);
+    await new RevealBigNummerAdapter().reveal(true);
+    const devHeaders = fetchSpy.mock.calls[1][1].headers as Record<string, string>;
+    expect(devHeaders['X-Role']).toBeDefined();
+  });
+});

apps/ssp/src/app/brief/infrastructure/reveal-bignummer.adapter.ts

@@ -1,47 +1,62 @@
-import { Injectable } from '@angular/core';
+import { Injectable, isDevMode } from '@angular/core';
 import { Result, ok, err } from '@shared/kernel/fp';
 import { currentRole } from '@shared/infrastructure/role';
 import { problemDetail } from '@shared/infrastructure/api-error';
 import { environment } from '@shared/environments/environment';
 
-const REVEAL_FAILED = $localize`:@@brief.reveal.failed:Het BIG-nummer kon niet worden getoond.`;
+/** Exported so specs can assert against the same message id instead of retyping the
+    Dutch sentence (matches `letter-preview.adapter.ts`'s `PREVIEW_FAILED`). */
+export const REVEAL_FAILED = $localize`:@@brief.reveal.failed:Het BIG-nummer kon niet worden getoond.`;
 
 /**
  * Field-level PII reveal (PRD-0002 §5c). The case screen ships the BIG-nummer masked;
  * this unmasks it, gated server-side by the reveal capability AND a step-up. The
- * step-up is stubbed as the `X-Step-Up` header — the caller sends it only after the
- * user's confirm gesture, so a plain call (or a role without the capability) 403s.
+ * step-up is stubbed as the `X-Step-Up` header, sent only when the caller passes
+ * `stepUp: true` — `BriefStore.revealBigNummer()` is the only caller and it is only
+ * ever reachable after `behandel-scherm.component.ts`'s `onReveal()` confirm gesture,
+ * so the header now reflects that gesture instead of being a constant baked into this
+ * adapter (BIO-006a — a call that skips confirmation sends no step-up at all).
  *
  * Hand-written fetch (not the `ApiClient`) because the call needs a per-request header;
  * `.ExcludeFromDescription()` on the endpoint keeps the generated client JSON-only, the
- * same seam as `/brief/preview` and uploads — which also means `X-Role` is set here.
+ * same seam as `/brief/preview` and uploads. `X-Role` is a dev-only identity stand-in
+ * (see `role.ts`) and is therefore only sent under `isDevMode()`, mirroring the
+ * `roleInterceptor` registration in `app.config.ts` — a production build never sends it
+ * from this hand-written call either (BIO-012).
  */
 @Injectable({ providedIn: 'root' })
 export class RevealBigNummerAdapter {
-  async reveal(): Promise<Result<string, string>> {
+  async reveal(stepUp: boolean): Promise<Result<string, string>> {
     let res: Response;
     try {
       res = await fetch(`${environment.apiBaseUrl}/api/v1/brief/reveal-bignummer`, {
         method: 'POST',
-        headers: { 'X-Role': currentRole(), 'X-Step-Up': 'true' },
+        headers: {
+          ...(isDevMode() ? { 'X-Role': currentRole() } : {}),
+          ...(stepUp ? { 'X-Step-Up': 'true' } : {}),
+        },
       });
     } catch {
       return err(REVEAL_FAILED);
     }
     if (!res.ok) return err(await errorMessage(res));
-    const body: unknown = await res.json().catch(() => null);
-    // Trust boundary: validate the shape before handing back a plain string.
-    if (
-      typeof body === 'object' &&
-      body !== null &&
-      typeof (body as { bigNummer?: unknown }).bigNummer === 'string'
-    ) {
-      return ok((body as { bigNummer: string }).bigNummer);
-    }
-    return err(REVEAL_FAILED);
+    return parseRevealed(await res.json().catch(() => null));
   }
 }
 
+/** Trust boundary: validate the untrusted response shape before handing back a plain
+    string (TE-002) — exported so a spec can call it without stubbing `globalThis.fetch`. */
+export function parseRevealed(body: unknown): Result<string, string> {
+  if (
+    typeof body === 'object' &&
+    body !== null &&
+    typeof (body as { bigNummer?: unknown }).bigNummer === 'string'
+  ) {
+    return ok((body as { bigNummer: string }).bigNummer);
+  }
+  return err(REVEAL_FAILED);
+}
+
 async function errorMessage(res: Response): Promise<string> {
   try {
     return problemDetail(await res.json(), REVEAL_FAILED);