atomic-design-poc/backend/tests/BigRegister.Tests/WerkvoorraadTests.cs

using System.Net;
using System.Net.Http.Json;
using BigRegister.Api.Contracts;
using Microsoft.AspNetCore.Mvc.Testing;

namespace BigRegister.Tests;

/// The behandelportal's queue of aanvragen needing treatment, gated by the
/// medewerker capability `CanBeoordelen` — not the admin role.
public class WerkvoorraadTests(TestWebApplicationFactory factory) : IClassFixture<TestWebApplicationFactory>
{
  private readonly HttpClient _client = factory.CreateClient();

  private HttpRequestMessage AsBehandelaar(string path)
  {
    var req = new HttpRequestMessage(HttpMethod.Get, path);
    req.Headers.Add("X-Medewerker", "medewerker-1");
    return req;
  }

  private async Task<AanvraagDetailDto> CreateAndSubmitHerregistratie()
  {
    var created = await _client.PostAsJsonAsync("/api/v1/aanvragen", new { type = "herregistratie" });
    var a = (await created.Content.ReadFromJsonAsync<AanvraagDetailDto>())!;
    (await _client.PostAsJsonAsync($"/api/v1/aanvragen/{a.Id}/submit", new { uren = 200 }))
        .EnsureSuccessStatusCode();
    return a;
  }

  [Fact]
  public async Task Behandelaar_sees_submitted_cases_in_the_queue()
  {
    var a = await CreateAndSubmitHerregistratie();
    try
    {
      var res = await _client.SendAsync(AsBehandelaar("/api/v1/werkvoorraad"));
      res.EnsureSuccessStatusCode();
      var queue = (await res.Content.ReadFromJsonAsync<List<AanvraagSummaryDto>>())!;
      var mine = queue.Single(x => x.Id == a.Id);
      Assert.Equal("InBehandeling", mine.Status.Tag);
      // BIO-003: masked, like /admin/cases — both inherit ToAdminSummaryDto.
      Assert.Equal("******782", mine.Owner);
    }
    finally
    {
      await _client.SendAsync(new HttpRequestMessage(HttpMethod.Delete, $"/api/v1/admin/cases/{a.Id}")
      {
        Headers = { { "X-Role", "admin" } },
      });
    }
  }

  [Fact]
  public async Task Queue_excludes_concepts()
  {
    var created = await _client.PostAsJsonAsync("/api/v1/aanvragen", new { type = "herregistratie" });
    var a = (await created.Content.ReadFromJsonAsync<AanvraagDetailDto>())!;
    try
    {
      var res = await _client.SendAsync(AsBehandelaar("/api/v1/werkvoorraad"));
      res.EnsureSuccessStatusCode();
      var queue = (await res.Content.ReadFromJsonAsync<List<AanvraagSummaryDto>>())!;
      Assert.DoesNotContain(queue, x => x.Id == a.Id);
    }
    finally
    {
      await _client.DeleteAsync($"/api/v1/aanvragen/{a.Id}");
    }
  }

  [Fact]
  public async Task Zorgverlener_is_forbidden_even_with_admin_role()
  {
    var req = new HttpRequestMessage(HttpMethod.Get, "/api/v1/werkvoorraad");
    req.Headers.Add("X-Role", "admin"); // admin role, but no X-Medewerker — still a zorgverlener
    Assert.Equal(HttpStatusCode.Forbidden, (await _client.SendAsync(req)).StatusCode);
  }

  [Fact]
  public async Task Medewerker_without_behandelaar_rol_is_forbidden()
  {
    var req = new HttpRequestMessage(HttpMethod.Get, "/api/v1/werkvoorraad");
    req.Headers.Add("X-Medewerker", "medewerker-2");
    req.Headers.Add("X-Rollen", "geen");
    Assert.Equal(HttpStatusCode.Forbidden, (await _client.SendAsync(req)).StatusCode);
  }

  [Fact]
  public async Task Me_reports_the_capability_only_for_a_behandelaar()
  {
    var behandelaar = new HttpRequestMessage(HttpMethod.Get, "/api/v1/me");
    behandelaar.Headers.Add("X-Medewerker", "medewerker-1");
    var caps = (await (await _client.SendAsync(behandelaar)).Content.ReadFromJsonAsync<MeDto>())!;
    Assert.Contains("aanvraag:beoordelen", caps.Capabilities);

    var zorgverlener = (await (await _client.GetAsync("/api/v1/me")).Content.ReadFromJsonAsync<MeDto>())!;
    Assert.DoesNotContain("aanvraag:beoordelen", zorgverlener.Capabilities);
  }
}