feat(bff): GET/PUT /beheer/default-fill proxying the ACL for beheerders (refs #131)

services/bff/Bff.Api/Program.cs

@@ -228,6 +228,25 @@ app.MapGet("/beheer/catalogi/zaaktypen", async (IAclClient acl, CancellationToke
     .Produces(StatusCodes.Status401Unauthorized)
     .Produces(StatusCodes.Status403Forbidden);
 
+// Beheer default-fill config (S-15b): read + edit the ACL's default-fill values. Behind medewerker-
+// realm + beheerder authorization; the BFF proxies the ACL (ADR-0025). The ACL validates the values.
+app.MapGet("/beheer/default-fill", async (IAclClient acl, CancellationToken ct) =>
+    Results.Ok(await acl.GetDefaultFillAsync(ct)))
+    .RequireAuthorization(BeheerAuth.Policy)
+    .Produces<BeheerDefaultFill>(StatusCodes.Status200OK)
+    .Produces(StatusCodes.Status401Unauthorized)
+    .Produces(StatusCodes.Status403Forbidden);
+
+app.MapPut("/beheer/default-fill", async (BeheerDefaultFill body, IAclClient acl, CancellationToken ct) =>
+{
+    await acl.UpdateDefaultFillAsync(body, ct);
+    return Results.NoContent();
+})
+    .RequireAuthorization(BeheerAuth.Policy)
+    .Produces(StatusCodes.Status204NoContent)
+    .Produces(StatusCodes.Status401Unauthorized)
+    .Produces(StatusCodes.Status403Forbidden);
+
 app.Run();
 
 /// <summary>The behandelaar's decision on a registration.</summary>

services/bff/openapi.json

@@ -255,10 +255,80 @@
           }
         }
       }
+    },
+    "/beheer/default-fill": {
+      "get": {
+        "tags": [
+          "Bff.Api"
+        ],
+        "responses": {
+          "200": {
+            "description": "OK",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/BeheerDefaultFill"
+                }
+              }
+            }
+          },
+          "401": {
+            "description": "Unauthorized"
+          },
+          "403": {
+            "description": "Forbidden"
+          }
+        }
+      },
+      "put": {
+        "tags": [
+          "Bff.Api"
+        ],
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/BeheerDefaultFill"
+              }
+            }
+          },
+          "required": true
+        },
+        "responses": {
+          "204": {
+            "description": "No Content"
+          },
+          "401": {
+            "description": "Unauthorized"
+          },
+          "403": {
+            "description": "Forbidden"
+          }
+        }
+      }
     }
   },
   "components": {
     "schemas": {
+      "BeheerDefaultFill": {
+        "required": [
+          "bronorganisatie",
+          "verantwoordelijkeOrganisatie",
+          "vertrouwelijkheidaanduiding"
+        ],
+        "type": "object",
+        "properties": {
+          "bronorganisatie": {
+            "type": "string"
+          },
+          "verantwoordelijkeOrganisatie": {
+            "type": "string"
+          },
+          "vertrouwelijkheidaanduiding": {
+            "type": "string"
+          }
+        }
+      },
       "BeheerZaaktype": {
         "required": [
           "identificatie",