Files
atomic-design-poc/backend/tests/BigRegister.Tests/OpenZaakDocumentSourceTests.cs
T
ehoandClaude Sonnet 5 73172510ea
CI / frontend (push) Failing after 1m19s
CI / backend (push) Successful in 2m0s
CI / e2e (push) Successful in 3m57s
CI / storybook-a11y (push) Successful in 7m45s
CI / semgrep (push) Successful in 1m6s
CI / api-client-drift (push) Successful in 1m55s
feat(zgw): real per-request identity seam + citizen-scoping (WP-53)
Replaces the hardcoded DocumentStore.DemoOwner and the static ZgwOptions
UserId/UserRepresentation with one per-request CallerIdentity, resolved by a
pluggable IIdentityProvider (StubIdentityProvider reads X-Role/X-Subject
today; a real OIDC/DigiD provider swaps in without touching any consumer).

- Domain/Authorization/{CallerIdentity,IIdentityProvider,StubIdentityProvider}.cs
  + a resolution middleware in Program.cs, right after correlation-id.
- Authz.ResolvePrincipal(ctx) keeps its signature (now reads ctx.Caller().Role),
  so its ~15 call sites needed no changes.
- Every endpoint that passed DocumentStore.DemoOwner to a store now passes
  ctx.Caller().Bsn.
- ZgwTokenProvider gains Mint(CallerIdentity) alongside the original Mint()
  (kept for calls not tied to one citizen); ZgwHttpClient threads an optional
  caller through to pick the right overload.
- IZaakSource gains ListMyCases(caller, now) — the citizen-scoped read
  OpenZaakZaakSource backs with ZGW's rol__...__inpBsn filter. GET /applications
  now routes through it instead of ApplicationStore directly, closing the last
  "reads a static store" gap for a citizen-facing endpoint.

Backend 159/159 tests (+8, incl. an HTTP-level two-identity scoping proof),
npm run ci green, no api-client drift.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
2026-07-30 08:27:53 +02:00

112 lines
4.9 KiB
C#

using BigRegister.Api.Data;
using BigRegister.Api.Zgw;
using BigRegister.Domain.Authorization;
namespace BigRegister.Tests;
/// <summary>
/// Exercises the OpenZaak document source against a stub HttpMessageHandler (WP-51): an
/// upload registers a DRC enkelvoudiginformatieobject, and linking to a zaak POSTs a
/// zaakinformatieobject per document once a zaak URL is known.
/// </summary>
public class OpenZaakDocumentSourceTests
{
private const string DrcBase = "https://oz.example/documenten/api/v1";
private const string ZrcBase = "https://oz.example/zaken/api/v1";
private const string ZaaktypeUrl = "https://oz.example/catalogi/api/v1/zaaktypen/zt-registratie";
private const string InformatieobjecttypeUrl = "https://oz.example/catalogi/api/v1/informatieobjecttypen/iot-identiteit";
private static ZgwOptions Options() => new()
{
DrcBaseUrl = DrcBase,
ZrcBaseUrl = ZrcBase,
ClientId = "c",
Secret = "s",
Bronorganisatie = "123443210",
UserRepresentation = "BIG-register BFF",
InformatieobjecttypeUrls = new() { ["identiteit"] = InformatieobjecttypeUrl },
};
private static readonly CallerIdentity Caller = new("111222333", "Dr. Test", PrincipalRole.Drafter);
[Fact]
public void Upload_registers_an_eio_in_drc_and_persists_its_url_locally()
{
var options = Options();
var handler = new ZgwStubHandler(url => url switch
{
_ when url == $"{DrcBase}/enkelvoudiginformatieobjecten" =>
"""{ "url": "https://oz.example/documenten/api/v1/enkelvoudiginformatieobjecten/eio-1" }""",
_ => throw new InvalidOperationException($"unexpected ZGW call {url}"),
});
var source = new OpenZaakDocumentSource(new HttpClient(handler), new ZgwTokenProvider(options), options);
var response = source.Upload("local-1", "identiteit", "registratie", "paspoort.pdf", "application/pdf",
"%PDF-1.4 fake"u8.ToArray(), Caller);
Assert.Equal("local-1", response.LocalId);
Assert.NotEmpty(response.DocumentId);
// Registered locally too (dual-write, same reasoning as CreateZaak/WP-50) — content
// preview/download keeps working regardless of Zgw:Enabled.
var stored = DocumentStore.Get(response.DocumentId);
Assert.NotNull(stored);
Assert.Equal("https://oz.example/documenten/api/v1/enkelvoudiginformatieobjecten/eio-1", stored!.DrcUrl);
var body = handler.BodyOf($"{DrcBase}/enkelvoudiginformatieobjecten");
Assert.Contains(InformatieobjecttypeUrl, body);
Assert.Contains("123443210", body); // bronorganisatie
Assert.Contains("paspoort.pdf", body);
Assert.Contains(Convert.ToBase64String("%PDF-1.4 fake"u8.ToArray()), body); // inhoud
}
[Fact]
public void Upload_throws_when_the_category_has_no_configured_informatieobjecttype()
{
var options = Options();
var handler = new ZgwStubHandler(url => throw new InvalidOperationException($"no HTTP call expected, got {url}"));
var source = new OpenZaakDocumentSource(new HttpClient(handler), new ZgwTokenProvider(options), options);
Assert.Throws<InvalidOperationException>(() =>
source.Upload("local-1", "unknown-category", "registratie", "f.pdf", "application/pdf", [1, 2, 3], Caller));
}
[Fact]
public void LinkToZaak_posts_a_zaakinformatieobject_per_document_once_a_zaak_exists()
{
var options = Options();
var uploadHandler = new ZgwStubHandler(url =>
"""{ "url": "https://oz.example/documenten/api/v1/enkelvoudiginformatieobjecten/eio-1" }""");
var uploader = new OpenZaakDocumentSource(new HttpClient(uploadHandler), new ZgwTokenProvider(options), options);
var doc = uploader.Upload("local-1", "identiteit", "registratie", "paspoort.pdf", "application/pdf", [1, 2, 3], Caller);
var linkHandler = new ZgwStubHandler(url => url switch
{
_ when url == $"{ZrcBase}/zaakinformatieobjecten" => "{}",
_ => throw new InvalidOperationException($"unexpected ZGW call {url}"),
});
var linker = new OpenZaakDocumentSource(new HttpClient(linkHandler), new ZgwTokenProvider(options), options);
linker.LinkToZaak([doc.DocumentId], $"{ZrcBase}/zaken/uuid-1", Caller);
var body = linkHandler.BodyOf($"{ZrcBase}/zaakinformatieobjecten");
Assert.Contains($"{ZrcBase}/zaken/uuid-1", body);
Assert.Contains("eio-1", body);
// Local link also happened (dual-write) — the document is now Linked (delete blocked).
Assert.Equal(DocumentStore.DeleteResult.Linked, DocumentStore.DeleteOwned(doc.DocumentId, Caller.Bsn));
}
[Fact]
public void LinkToZaak_makes_no_zgw_call_when_the_local_source_created_no_zaak()
{
var options = Options();
var handler = new ZgwStubHandler(url => throw new InvalidOperationException($"no HTTP call expected, got {url}"));
var source = new OpenZaakDocumentSource(new HttpClient(handler), new ZgwTokenProvider(options), options);
source.LinkToZaak(["some-document-id"], zaakUrl: null, Caller);
Assert.Empty(handler.Requests);
}
}