eho/atomic-design-poc
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat(audit): record the allow path, not just the denial (RB-07)

Browse Source 
All five authorization gates audited only their deny branch, so /beheer/audit
could answer "who was turned away" but never "who changed this" — for a
register whose integrity is the product, the wrong half. Nothing recorded the
flag toggle, either org-template write, the admin case or upload delete, the
three brief transitions, or the besluit; the comment claiming endpoints log
their own effect held for two of the eight.

Each gate now computes the decision once, audits it, and then acts. The row
is written by the gate rather than the endpoint, so a new admin endpoint
cannot be added that forgets to audit itself. Same reasoning for the brief:
every transition already funnelled through LogBrief for its log line, so the
audit row goes there too — submit/approve/reject/send in one place, with the
transition's own outcome as the decision, so a 403 or 409 is as visible as a
success.

FlagsAdmin gained a per-call resource, the one deviation from BIO-007's
minimal remediation: the toggle endpoint writes no log line of its own, so a
constant "feature-flags" row would say a flag changed without saying which.
It now records feature-flags/<key>=<value>. OrgAdmin and CasesAdmin keep
coarse refs because those endpoints do log the specific object.

The besluit gets a second row: the gate records that a behandelaar was
allowed to act, aanvraag:besluit records what they decided.

Row volume goes up — StamdataAdmin gates read endpoints, so admin page loads
now write rows. That is what auditing the allow path means; it is also what
would make retention on AuthzAuditStore necessary later.

Closes CQ-004's outstanding half and unblocks signing ADR-C-009.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This commit is contained in:
eho
2026-08-27 13:12:22 +02:00
co-authored by Claude Opus 5
parent d682f91b54
commit e89525eef6
5 changed files with 161 additions and 24 deletions
Download Patch File Download Diff File Expand all files Collapse all files
backend/src/BigRegister.Api/Program.cs
+48 -24
View File
@@ -506,6 +506,10 @@ api.MapPost("/beoordeling/{id}/besluit", (string id, RecordBesluitRequest req, H
statusCode: StatusCodes.Status409Conflict);
app.Logger.LogInformation("aanvraag besluit id={Id} besluit={Besluit}", a.Id, besluit);
// RB-07/BIO-007: the gate above records that a behandelaar was allowed to act; this
// records what they decided. Without it /beheer/audit cannot answer "who rejected this
// aanvraag", which is the question the trail exists for.
AuditAuthz(ctx, "aanvraag:besluit", $"aanvraag/{a.Id}/{besluit}", true, Authz.ResolvePrincipal(ctx));
// WP-60: the local decision above already committed — a ZGW failure here is caught and
// flagged rather than allowed to diverge silently, same handling as submit's create-zaak
@@ -598,8 +602,9 @@ api.MapGet("/flags", () =>
Results.Ok(FeatureFlagStore.All().Select(f => new FeatureFlagDto(f.Key, f.Description, f.Enabled)).ToList()))
.Produces<List<FeatureFlagDto>>();
api.MapPut("/admin/flags/{key}", (string key, SetFeatureFlagRequest req, HttpContext ctx) => FlagsAdmin(ctx, () =>
FeatureFlagStore.Set(key, req.Enabled) ? Results.NoContent() : Results.NotFound()))
api.MapPut("/admin/flags/{key}", (string key, SetFeatureFlagRequest req, HttpContext ctx) =>
FlagsAdmin(ctx, $"feature-flags/{key}={req.Enabled}", () =>
FeatureFlagStore.Set(key, req.Enabled) ? Results.NoContent() : Results.NotFound()))
.Produces(StatusCodes.Status204NoContent)
.Produces(StatusCodes.Status404NotFound)
.ProducesProblem(StatusCodes.Status403Forbidden);
@@ -629,7 +634,7 @@ api.MapPost("/brief/submit", (HttpContext ctx) =>
{
var isDrafter = Authz.ResolvePrincipal(ctx).Role == PrincipalRole.Drafter;
var r = BriefStore.Submit(ctx.Zorgverlener().Bsn, isDrafter, Now());
LogBrief("submit", r);
LogBrief(ctx, "submit", r);
return BriefResult(ctx, r, "Alleen de opsteller mag indienen.");
})
.WithName("briefSubmit") // distinct name so the generated client method isn't `submit2`
@@ -640,7 +645,7 @@ api.MapPost("/brief/submit", (HttpContext ctx) =>
api.MapPost("/brief/approve", (HttpContext ctx) =>
{
var r = BriefStore.Approve(ctx.Zorgverlener().Bsn, Authz.ResolvePrincipal(ctx), Now());
LogBrief("approve", r);
LogBrief(ctx, "approve", r);
return BriefResult(ctx, r, "De beoordelaar mag niet de opsteller zijn.");
})
.Produces<BriefViewDto>()
@@ -650,7 +655,7 @@ api.MapPost("/brief/approve", (HttpContext ctx) =>
api.MapPost("/brief/reject", (RejectBriefRequest req, HttpContext ctx) =>
{
var r = BriefStore.Reject(ctx.Zorgverlener().Bsn, Authz.ResolvePrincipal(ctx), req.Comments, Now());
LogBrief("reject", r);
LogBrief(ctx, "reject", r);
return BriefResult(ctx, r, "De beoordelaar mag niet de opsteller zijn.");
})
.Produces<BriefViewDto>()
@@ -663,7 +668,7 @@ api.MapPost("/brief/send", (HttpContext ctx) =>
// port); the backend only guards the approved→sent transition (not role-gated
// today — see Authz.CanActOn(Send, …), a mechanical dispatch step).
var r = BriefStore.Send(ctx.Zorgverlener().Bsn, Now());
LogBrief("send", r);
LogBrief(ctx, "send", r);
return BriefResult(ctx, r, "Versturen kan niet in deze status.");
})
.Produces<BriefViewDto>()
@@ -785,14 +790,19 @@ app.Run();
static bool IsAdmin(HttpContext ctx) => ctx.Request.Headers["X-Admin"] == "true";
// One gate for every org-template endpoint — the enforce twin of the
// `orgtemplate:edit` capability RoleCapabilities emits (single Authz source). A denial
// is audited (PRD-0002 §8); the allow path is left un-logged (the endpoints log their
// own effect, e.g. publish).
// `orgtemplate:edit` capability RoleCapabilities emits (single Authz source).
//
// RB-07/BIO-007: every gate below audits the real decision, allow *and* deny. Auditing
// only denials left /beheer/audit able to answer "who was turned away" but not "who
// changed this", which for a register whose integrity is the product is the wrong half
// (PRD-0002 §8 lists approvals alongside denials). The allow row is written by the gate,
// not by the endpoint, so a new admin endpoint cannot be added that forgets it.
IResult OrgAdmin(HttpContext ctx, Func<IResult> action)
{
var principal = Authz.ResolvePrincipal(ctx);
if (Authz.CanManageOrgTemplates(principal)) return action();
AuditAuthz(ctx, "orgtemplate:edit", "org-templates", false, principal);
var ok = Authz.CanManageOrgTemplates(principal);
AuditAuthz(ctx, "orgtemplate:edit", "org-templates", ok, principal);
if (ok) return action();
return Results.Problem(detail: "Alleen een beheerder mag organisatiesjablonen beheren.",
statusCode: StatusCodes.Status403Forbidden);
}
@@ -802,8 +812,9 @@ IResult OrgAdmin(HttpContext ctx, Func<IResult> action)
IResult StamdataAdmin(HttpContext ctx, Func<IResult> action)
{
var principal = Authz.ResolvePrincipal(ctx);
if (Authz.CanEditStamdata(principal)) return action();
AuditAuthz(ctx, "stamdata:edit", "stamdata", false, principal);
var ok = Authz.CanEditStamdata(principal);
AuditAuthz(ctx, "stamdata:edit", "stamdata", ok, principal);
if (ok) return action();
return Results.Problem(detail: "Alleen een beheerder mag stamdata onderhouden.",
statusCode: StatusCodes.Status403Forbidden);
}
@@ -813,8 +824,9 @@ IResult StamdataAdmin(HttpContext ctx, Func<IResult> action)
IResult CasesAdmin(HttpContext ctx, Func<IResult> action)
{
var principal = Authz.ResolvePrincipal(ctx);
if (Authz.CanManageCases(principal)) return action();
AuditAuthz(ctx, "cases:manage", "cases", false, principal);
var ok = Authz.CanManageCases(principal);
AuditAuthz(ctx, "cases:manage", "cases", ok, principal);
if (ok) return action();
return Results.Problem(detail: "Alleen een beheerder mag aanvragen beheren.",
statusCode: StatusCodes.Status403Forbidden);
}
@@ -825,18 +837,23 @@ IResult CasesAdmin(HttpContext ctx, Func<IResult> action)
// zorgverlener with X-Role=admin still gets denied. `resource` feeds the denial's audit row.
IResult Beoordelen(HttpContext ctx, string resource, Func<IResult> action)
{
if (Authz.CanBeoordelen(ctx.Caller())) return action();
AuditAuthz(ctx, "aanvraag:beoordelen", resource, false, Authz.ResolvePrincipal(ctx));
var ok = Authz.CanBeoordelen(ctx.Caller());
AuditAuthz(ctx, "aanvraag:beoordelen", resource, ok, Authz.ResolvePrincipal(ctx));
if (ok) return action();
return Results.Problem(detail: "Alleen een behandelaar mag aanvragen beoordelen.",
statusCode: StatusCodes.Status403Forbidden);
}
// One gate for the feature-flag toggle — the enforce twin of `flags:manage` (WP-47).
IResult FlagsAdmin(HttpContext ctx, Func<IResult> action)
// One gate for the feature-flag toggle — the enforce twin of `flags:manage` (WP-47). Takes a
// per-call `resource` like Beoordelen does, because the toggle endpoint writes no log line of
// its own (BIO-007): a bare "feature-flags" row would say a flag changed without saying which,
// and this is the surface CQ-004/ADR-C-009 hinge on.
IResult FlagsAdmin(HttpContext ctx, string resource, Func<IResult> action)
{
var principal = Authz.ResolvePrincipal(ctx);
if (Authz.CanManageFeatureFlags(principal)) return action();
AuditAuthz(ctx, "flags:manage", "feature-flags", false, principal);
var ok = Authz.CanManageFeatureFlags(principal);
AuditAuthz(ctx, "flags:manage", resource, ok, principal);
if (ok) return action();
return Results.Problem(detail: "Alleen een beheerder mag functievlaggen beheren.",
statusCode: StatusCodes.Status403Forbidden);
}
@@ -892,9 +909,16 @@ IResult BriefResult(HttpContext ctx, (BriefStore.Outcome outcome, BriefEntity? e
_ => Results.Problem(detail: "Ongeldige overgang voor de huidige status van de brief.", statusCode: StatusCodes.Status409Conflict),
};
void LogBrief(string action, (BriefStore.Outcome outcome, BriefEntity? entity) r) =>
app.Logger.LogInformation("brief {Action} outcome={Outcome} status={Status}",
action, r.outcome, r.entity?.Status.Tag ?? "-");
// RB-07/BIO-007: every brief transition already funnelled through here for its log line,
// so the audit row goes here too — a fifth transition cannot be added that logs but leaves
// no trail. Resource is the bare "brief" (RB-02: never the owner's BSN); the decision is
// the transition's own outcome, so a 403 or a 409 is as visible as a success.
void LogBrief(HttpContext ctx, string action, (BriefStore.Outcome outcome, BriefEntity? entity) r)
{
app.Logger.LogInformation("brief {Action} outcome={Outcome} status={Status}",
action, r.outcome, r.entity?.Status.Tag ?? "-");
AuditAuthz(ctx, "brief:" + action, "brief", r.outcome == BriefStore.Outcome.Ok, Authz.ResolvePrincipal(ctx));
}
// Audit + outcome for a submit, with NO personal data: only kind, outcome,
// generated reference and the caller's correlation id (the observability seam — a