test(bff): self-service documents endpoint forwards id + bsn to the domain (refs #102)

RED: POST /self-service/registrations/{id}/documents requires a digid token, takes
the bsn from the token, forwards to the domain, and relays the domain's 404 for an
unknown/not-owned registration. Adds the IDomainClient.ProvideDocumentsAsync port +
client + fake; the endpoint itself follows.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

services/bff/Bff.Tests/BffFactory.cs

@@ -94,6 +94,18 @@ internal sealed class FakeDomainClient : IDomainClient
         return Task.FromResult(WithdrawSucceeds);
     }
 
+    public (string RegistrationId, string Bsn)? DocumentsProvidedFor { get; private set; }
+
+    /// <summary>Whether the fake domain reports the provide-documents as done (true → 204) or
+    /// not-found/not-owned (false → 404). Tests set this to exercise the relay.</summary>
+    public bool ProvideDocumentsSucceeds { get; set; } = true;
+
+    public Task<bool> ProvideDocumentsAsync(string registrationId, string bsn, CancellationToken ct = default)
+    {
+        DocumentsProvidedFor = (registrationId, bsn);
+        return Task.FromResult(ProvideDocumentsSucceeds);
+    }
+
     public (string RegistrationId, string Besluit)? Decided { get; private set; }
 
     public Task<IReadOnlyList<WerkbakItem>> GetWerkbakAsync(CancellationToken ct = default)

services/bff/Bff.Tests/SelfServiceEndpointTests.cs

@@ -112,5 +112,46 @@ public class SelfServiceEndpointTests
         Assert.Equal(HttpStatusCode.NotFound, response.StatusCode);
     }
 
+    private static HttpRequestMessage ProvideDocuments(string? bearer, string id = "reg-123")
+    {
+        var request = new HttpRequestMessage(HttpMethod.Post, $"/self-service/registrations/{id}/documents");
+        if (bearer is not null)
+            request.Headers.Authorization = new AuthenticationHeaderValue("Bearer", bearer);
+        return request;
+    }
+
+    [Fact]
+    public async Task Rejects_providing_documents_without_a_token()
+    {
+        using var factory = new BffFactory();
+
+        var response = await factory.CreateClient().SendAsync(ProvideDocuments(bearer: null));
+
+        Assert.Equal(HttpStatusCode.Unauthorized, response.StatusCode);
+        Assert.Null(factory.Domain.DocumentsProvidedFor);
+    }
+
+    [Fact]
+    public async Task Provides_documents_for_the_callers_registration_forwarding_the_id_and_bsn()
+    {
+        using var factory = new BffFactory();
+
+        var response = await factory.CreateClient().SendAsync(ProvideDocuments(TestTokens.Valid("123456782"), "reg-9"));
+
+        Assert.Equal(HttpStatusCode.NoContent, response.StatusCode);
+        Assert.Equal(("reg-9", "123456782"), factory.Domain.DocumentsProvidedFor);
+    }
+
+    [Fact]
+    public async Task Relays_not_found_providing_documents_for_an_unknown_or_not_owned_registration()
+    {
+        using var factory = new BffFactory();
+        factory.Domain.ProvideDocumentsSucceeds = false;
+
+        var response = await factory.CreateClient().SendAsync(ProvideDocuments(TestTokens.Valid("123456782")));
+
+        Assert.Equal(HttpStatusCode.NotFound, response.StatusCode);
+    }
+
     private sealed record SubmitAcceptedDto(string RegistrationId, string Status);
 }