feat(acl): read default-fill from the store + GET/PUT /default-fill (refs #131)

services/acl/Acl.Api/Program.cs

@@ -33,6 +33,15 @@ builder.Services.AddSingleton(sp => sp.GetRequiredService<IConfiguration>()
 builder.Services.AddSingleton(sp => sp.GetRequiredService<IConfiguration>()
     .GetSection("Acl:OpenZaak").Get<OpenZaakOptions>()
     ?? throw new InvalidOperationException("Missing configuration section 'Acl:OpenZaak'"));
+// The default-fill values are held in a runtime-mutable store (S-15b, ADR-0026), seeded from the
+// configured Acl:Defaults. The beheer portal edits it; the worker reads it per zaak. The S-27
+// resolution keys stay on AclDefaults (static) — see DefaultFillSettings.
+builder.Services.AddSingleton<IDefaultFillStore>(sp =>
+{
+    var d = sp.GetRequiredService<AclDefaults>();
+    return new InMemoryDefaultFillStore(
+        new DefaultFillSettings(d.Bronorganisatie, d.VerantwoordelijkeOrganisatie, d.Vertrouwelijkheidaanduiding));
+});
 builder.Services.AddHttpClient<IZaakGateway, OpenZaakGateway>();
 // Singleton so the resolved zaaktype/informatieobjecttype URLs are cached across requests (S-27).
 builder.Services.AddSingleton<IZaaktypeCatalog, CachedZaaktypeCatalog>();
@@ -91,6 +100,22 @@ app.MapPost("/documenten", async (StoreDocumentRequest body, AclService acl, Can
 app.MapGet("/catalogi/zaaktypen", async (AclService acl, CancellationToken ct) =>
     Results.Ok(await acl.ListZaaktypenAsync(ct)));
 
+// Read the current default-fill settings (beheer config viewer, S-15b).
+app.MapGet("/default-fill", (AclService acl) => Results.Ok(acl.GetDefaultFill()));
+
+// Update the default-fill settings from the beheer portal (S-15b). Behind beheerder authorization at
+// the BFF; the ACL validates the values are present (the three ZGW-mandatory fields).
+app.MapPut("/default-fill", (DefaultFillSettings body, AclService acl) =>
+{
+    if (string.IsNullOrWhiteSpace(body.Bronorganisatie) ||
+        string.IsNullOrWhiteSpace(body.VerantwoordelijkeOrganisatie) ||
+        string.IsNullOrWhiteSpace(body.Vertrouwelijkheidaanduiding))
+        return Results.BadRequest(new { error = "bronorganisatie, verantwoordelijkeOrganisatie and vertrouwelijkheidaanduiding are all required." });
+
+    acl.UpdateDefaultFill(body);
+    return Results.NoContent();
+});
+
 app.Run();
 
 public sealed record OpenZaakRequest(string Bsn, string Reference);