Files

T

ehoandClaude Sonnet 5 f21c3c7ca2 docs(backlog): add phase 10 (OpenZaak hardening) and phase 11 (behandelportal)

WP-55..60 harden the OpenZaak integration for production (secrets/TLS,
idempotent provisioning, least-privilege scopes, real notifications,
confidentialiteit config, write-divergence resilience). WP-61..66 stand up
a staff-facing behandelportal per ADR-0002, wired to the same backend via
BFF-lite decision DTOs. Both phases are independent tracks; WP-60's
Decisions block is deliberately left open for a planner-agent kickoff.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

2026-07-30 11:59:11 +02:00

2.0 KiB

Raw Blame History

WP-57 — Least-privilege client scopes

Status: todo Phase: 10 — OpenZaak production hardening

Why

The harness's OpenZaak client is granted heeft_alle_autorisaties: true in setup_configuration/data.yaml — acceptable for a disposable test rig, wrong for anything closer to production, where the BFF's client should hold only the Autorisaties it actually exercises.

Read first

backend/openzaak/setup_configuration/data.yaml
backend/src/BigRegister.Api/Zgw/OpenZaakZaakSource.cs and OpenZaakDocumentSource.cs (the actual ZGW endpoints/verbs called)

Decisions (pre-made, don't relitigate)

Scope precisely to what the BFF calls today: zaken (aanmaken, bijwerken, lezen), statussen (aanmaken), rollen (aanmaken), documenten/zaakinformatieobjecten (aanmaken, lezen) — enumerate exactly at kickoff from the client code, don't guess broader.
No wildcard/all-scope grant in any environment beyond the pre-WP-56 disposable dev rig.

Files

backend/openzaak/setup_configuration/data.yaml (Autorisaties block)
backend/openzaak/README.md

Steps

Grep OpenZaakZaakSource.cs and OpenZaakDocumentSource.cs for every ZGW endpoint/verb called.
Replace heeft_alle_autorisaties: true with an explicit autorisaties list matching exactly that set.
Re-run the full integration suite against the narrowed client; add any scope a 403 surfaces.

Acceptance criteria

Client config has no wildcard/all-scopes grant.
OpenZaakIntegrationTests (WP-54) pass unchanged against the narrowed client.

Verification

cd backend && dotnet test --filter Category=Integration against the harness with the narrowed client.

Out of scope

Rotating/expiring the client credential itself — defer until multi-tenant/production ops actually need it.

Risks

An overlooked scope only surfaces as a runtime 403 against a real instance — mitigated by running the full integration suite, which already exercises every current call path (WP-54).

Depends on: WP-56 (provisioning mechanism this scopes down).

2.0 KiB Raw Blame History