ehoandClaude Sonnet 5
73172510ea
Replaces the hardcoded DocumentStore.DemoOwner and the static ZgwOptions
UserId/UserRepresentation with one per-request CallerIdentity, resolved by a
pluggable IIdentityProvider (StubIdentityProvider reads X-Role/X-Subject
today; a real OIDC/DigiD provider swaps in without touching any consumer).
- Domain/Authorization/{CallerIdentity,IIdentityProvider,StubIdentityProvider}.cs
+ a resolution middleware in Program.cs, right after correlation-id.
- Authz.ResolvePrincipal(ctx) keeps its signature (now reads ctx.Caller().Role),
so its ~15 call sites needed no changes.
- Every endpoint that passed DocumentStore.DemoOwner to a store now passes
ctx.Caller().Bsn.
- ZgwTokenProvider gains Mint(CallerIdentity) alongside the original Mint()
(kept for calls not tied to one citizen); ZgwHttpClient threads an optional
caller through to pick the right overload.
- IZaakSource gains ListMyCases(caller, now) — the citizen-scoped read
OpenZaakZaakSource backs with ZGW's rol__...__inpBsn filter. GET /applications
now routes through it instead of ApplicationStore directly, closing the last
"reads a static store" gap for a citizen-facing endpoint.
Backend 159/159 tests (+8, incl. an HTTP-level two-identity scoping proof),
npm run ci green, no api-client drift.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
44 lines
1.5 KiB
C#
44 lines
1.5 KiB
C#
using BigRegister.Api.Data;
|
|
using BigRegister.Domain.Authorization;
|
|
using Microsoft.AspNetCore.Http;
|
|
|
|
namespace BigRegister.Tests;
|
|
|
|
/// WP-53: the dev stub identity provider — role from X-Role (unchanged behaviour), subject BSN
|
|
/// from the new X-Subject header, defaulting to the single seeded citizen so every existing
|
|
/// request (none of which send X-Subject) resolves exactly as before this WP.
|
|
public class StubIdentityProviderTests
|
|
{
|
|
private static CallerIdentity Resolve(string? role, string? subject)
|
|
{
|
|
var ctx = new DefaultHttpContext();
|
|
if (role is not null) ctx.Request.Headers["X-Role"] = role;
|
|
if (subject is not null) ctx.Request.Headers["X-Subject"] = subject;
|
|
return new StubIdentityProvider().Resolve(ctx);
|
|
}
|
|
|
|
[Fact]
|
|
public void No_headers_resolves_to_the_seeded_citizen_as_a_drafter()
|
|
{
|
|
var caller = Resolve(role: null, subject: null);
|
|
Assert.Equal(DocumentStore.DemoOwner, caller.Bsn);
|
|
Assert.Equal(PrincipalRole.Drafter, caller.Role);
|
|
}
|
|
|
|
[Theory]
|
|
[InlineData("approver", PrincipalRole.Approver)]
|
|
[InlineData("admin", PrincipalRole.Admin)]
|
|
[InlineData("something-unknown", PrincipalRole.Drafter)]
|
|
public void X_role_maps_to_the_principal_role(string header, PrincipalRole expected)
|
|
{
|
|
Assert.Equal(expected, Resolve(header, subject: null).Role);
|
|
}
|
|
|
|
[Fact]
|
|
public void X_subject_overrides_the_default_bsn()
|
|
{
|
|
var caller = Resolve(role: null, subject: "999888777");
|
|
Assert.Equal("999888777", caller.Bsn);
|
|
}
|
|
}
|