From 404454d270c5f07a7409b86a9ac7496c249fc753 Mon Sep 17 00:00:00 2001
From: Niek Otten <not@respellion.nl>
Date: Mon, 20 Jul 2026 10:41:11 +0200
Subject: [PATCH] feat(bff): POST /self-service/registrations/{id}/documents
 (S-10a) (refs #102)

Authenticated self-service endpoint that takes the bsn from the DigiD token,
forwards "documenten aanleveren" to the domain, and relays 404 for an unknown or
not-owned registration. Regenerates the committed openapi.json.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 services/bff/Bff.Api/Program.cs | 20 ++++++++++++++++++++
 services/bff/openapi.json       | 31 +++++++++++++++++++++++++++++++
 2 files changed, 51 insertions(+)

diff --git a/services/bff/Bff.Api/Program.cs b/services/bff/Bff.Api/Program.cs
index c4683ce..940d5f2 100644
--- a/services/bff/Bff.Api/Program.cs
+++ b/services/bff/Bff.Api/Program.cs
@@ -104,6 +104,26 @@ app.MapPost("/self-service/registrations/{id}/withdraw", async (string id, Claim
     .Produces(StatusCodes.Status401Unauthorized)
     .Produces(StatusCodes.Status404NotFound);
 
+// Self-service provide-documents (S-10a): the signed-in zorgprofessional supplies the documents their
+// registration is waiting for ("documenten aanleveren"). The bsn comes from the DigiD token and is
+// forwarded to the domain, which owner-scopes the action and completes the WachtOpDocumenten task; a
+// registration that is unknown or not the caller's comes back 404. The real file upload + ZGW storage
+// is S-10b — this is the trigger that unblocks the process.
+app.MapPost("/self-service/registrations/{id}/documents", async (string id, ClaimsPrincipal user, IDomainClient domain, CancellationToken ct) =>
+{
+    var bsn = user.FindFirstValue("bsn");
+    if (string.IsNullOrWhiteSpace(bsn))
+        return Results.BadRequest("The token carries no bsn claim.");
+
+    var provided = await domain.ProvideDocumentsAsync(id, bsn, ct);
+    return provided ? Results.NoContent() : Results.NotFound();
+})
+    .RequireAuthorization()
+    .Produces(StatusCodes.Status204NoContent)
+    .Produces(StatusCodes.Status400BadRequest)
+    .Produces(StatusCodes.Status401Unauthorized)
+    .Produces(StatusCodes.Status404NotFound);
+
 // Openbaar register: an anonymous public lookup that exposes only public-safe fields (S-09).
 app.MapGet("/openbaar/register", async (string? q, IProjectionClient projection, CancellationToken ct) =>
 {
diff --git a/services/bff/openapi.json b/services/bff/openapi.json
index 989a7a1..fd2101a 100644
--- a/services/bff/openapi.json
+++ b/services/bff/openapi.json
@@ -61,6 +61,37 @@
         }
       }
     },
+    "/self-service/registrations/{id}/documents": {
+      "post": {
+        "tags": [
+          "Bff.Api"
+        ],
+        "parameters": [
+          {
+            "name": "id",
+            "in": "path",
+            "required": true,
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "204": {
+            "description": "No Content"
+          },
+          "400": {
+            "description": "Bad Request"
+          },
+          "401": {
+            "description": "Unauthorized"
+          },
+          "404": {
+            "description": "Not Found"
+          }
+        }
+      }
+    },
     "/openbaar/register": {
       "get": {
         "tags": [