ehoandClaude Sonnet 5
73172510ea
Replaces the hardcoded DocumentStore.DemoOwner and the static ZgwOptions
UserId/UserRepresentation with one per-request CallerIdentity, resolved by a
pluggable IIdentityProvider (StubIdentityProvider reads X-Role/X-Subject
today; a real OIDC/DigiD provider swaps in without touching any consumer).
- Domain/Authorization/{CallerIdentity,IIdentityProvider,StubIdentityProvider}.cs
+ a resolution middleware in Program.cs, right after correlation-id.
- Authz.ResolvePrincipal(ctx) keeps its signature (now reads ctx.Caller().Role),
so its ~15 call sites needed no changes.
- Every endpoint that passed DocumentStore.DemoOwner to a store now passes
ctx.Caller().Bsn.
- ZgwTokenProvider gains Mint(CallerIdentity) alongside the original Mint()
(kept for calls not tied to one citizen); ZgwHttpClient threads an optional
caller through to pick the right overload.
- IZaakSource gains ListMyCases(caller, now) — the citizen-scoped read
OpenZaakZaakSource backs with ZGW's rol__...__inpBsn filter. GET /applications
now routes through it instead of ApplicationStore directly, closing the last
"reads a static store" gap for a citizen-facing endpoint.
Backend 159/159 tests (+8, incl. an HTTP-level two-identity scoping proof),
npm run ci green, no api-client drift.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
33 lines
1.5 KiB
C#
33 lines
1.5 KiB
C#
using BigRegister.Api.Data;
|
|
|
|
namespace BigRegister.Domain.Authorization;
|
|
|
|
/// <summary>
|
|
/// Dev stub (WP-53) — NOT a security boundary, same caveat as <see cref="Authz.ResolvePrincipal"/>
|
|
/// (which this provider now backs). Role comes from the existing client-asserted X-Role header
|
|
/// (mirrors the FE's <c>?role=</c> toggle); the subject BSN comes from a new X-Subject header,
|
|
/// defaulting to the single seeded citizen (<see cref="DocumentStore.DemoOwner"/>) so every
|
|
/// existing request — none of which send X-Subject — keeps behaving exactly as before this WP.
|
|
/// A real system builds this from verified AD/OIDC/DigiD claims; every consumer of
|
|
/// <see cref="CallerIdentity"/> carries over unchanged once that swap happens.
|
|
/// </summary>
|
|
public sealed class StubIdentityProvider : IIdentityProvider
|
|
{
|
|
public CallerIdentity Resolve(HttpContext ctx)
|
|
{
|
|
var role = ctx.Request.Headers["X-Role"].ToString() switch
|
|
{
|
|
"approver" => PrincipalRole.Approver,
|
|
"admin" => PrincipalRole.Admin,
|
|
_ => PrincipalRole.Drafter,
|
|
};
|
|
var bsn = ctx.Request.Headers.TryGetValue("X-Subject", out var v) && !string.IsNullOrEmpty(v)
|
|
? v.ToString()
|
|
: DocumentStore.DemoOwner;
|
|
// Only one seeded citizen exists in this POC — a real provider carries the display name in
|
|
// the verified claims themselves, so there's no "look up a name by BSN" step to stand in for.
|
|
var displayName = bsn == DocumentStore.DemoOwner ? SeedData.Registration.Naam : bsn;
|
|
return new CallerIdentity(bsn, displayName, role);
|
|
}
|
|
}
|