diff --git a/apps/behandel/Dockerfile b/apps/behandel/Dockerfile new file mode 100644 index 0000000..a25680b --- /dev/null +++ b/apps/behandel/Dockerfile @@ -0,0 +1,23 @@ +# Multi-stage build for the behandel portal (Angular → nginx). +# Build context is the repo root (the app needs the pnpm workspace + libs). See infra/docker-compose.yml. +FROM node:24-slim AS build +WORKDIR /src +RUN corepack enable && corepack prepare pnpm@11.5.2 --activate + +# Restore first (cached unless the manifests change). +COPY package.json pnpm-lock.yaml pnpm-workspace.yaml nx.json tsconfig.base.json eslint.config.mjs ./ +RUN pnpm install --frozen-lockfile + +# Sources (only what the app + its libs need). +COPY apps/behandel apps/behandel +COPY libs libs +RUN pnpm nx build behandel + +FROM nginx:1.27-alpine AS runtime +COPY apps/behandel/nginx.conf /etc/nginx/conf.d/default.conf +COPY --from=build /src/dist/apps/behandel/browser /usr/share/nginx/html +# Compose-time OIDC config: the browser (Playwright, on the compose network) reaches Keycloak by +# service name, so the token issuer matches the BFF's medewerker authority (host-consistent, ADR-0013). +RUN printf '{ "authority": "http://keycloak:8080/realms/medewerker" }\n' > /usr/share/nginx/html/config.json + +EXPOSE 80 diff --git a/apps/behandel/eslint.config.mjs b/apps/behandel/eslint.config.mjs new file mode 100644 index 0000000..af5ff32 --- /dev/null +++ b/apps/behandel/eslint.config.mjs @@ -0,0 +1,34 @@ +import nx from '@nx/eslint-plugin'; +import baseConfig from '../../eslint.config.mjs'; + +export default [ + ...nx.configs['flat/angular'], + ...nx.configs['flat/angular-template'], + ...baseConfig, + { + files: ['**/*.ts'], + rules: { + '@angular-eslint/directive-selector': [ + 'error', + { + type: 'attribute', + prefix: 'app', + style: 'camelCase', + }, + ], + '@angular-eslint/component-selector': [ + 'error', + { + type: 'element', + prefix: 'app', + style: 'kebab-case', + }, + ], + }, + }, + { + files: ['**/*.html'], + // Override or add rules here + rules: {}, + }, +]; diff --git a/apps/behandel/nginx.conf b/apps/behandel/nginx.conf new file mode 100644 index 0000000..3d6a573 --- /dev/null +++ b/apps/behandel/nginx.conf @@ -0,0 +1,24 @@ +server { + listen 80; + server_name _; + root /usr/share/nginx/html; + index index.html; + + # Resolve the BFF via Docker's embedded DNS at request time (variable proxy_pass), so nginx starts + # even before the BFF is up and picks up restarts — instead of failing to load the config. + resolver 127.0.0.11 ipv6=off valid=30s; + + # Same-origin API: proxy the behandel endpoint group to the bff service. The api-client uses + # relative URLs, so the browser calls this origin and nginx forwards to the BFF — no CORS, and the + # medewerker token (same-origin) is attached by the app's interceptor (ADR-0013). + location /behandel/ { + set $bff http://bff:8080; + proxy_pass $bff; + proxy_set_header Host $host; + } + + # SPA fallback — Angular client-side routing. + location / { + try_files $uri $uri/ /index.html; + } +} diff --git a/apps/behandel/project.json b/apps/behandel/project.json new file mode 100644 index 0000000..4c7a5e2 --- /dev/null +++ b/apps/behandel/project.json @@ -0,0 +1,80 @@ +{ + "name": "behandel", + "$schema": "../../node_modules/nx/schemas/project-schema.json", + "projectType": "application", + "prefix": "app", + "sourceRoot": "apps/behandel/src", + "tags": [], + "targets": { + "build": { + "executor": "@angular/build:application", + "outputs": ["{options.outputPath}"], + "defaultConfiguration": "production", + "options": { + "outputPath": "dist/apps/behandel", + "browser": "apps/behandel/src/main.ts", + "tsConfig": "apps/behandel/tsconfig.app.json", + "assets": [ + { + "glob": "**/*", + "input": "apps/behandel/public" + } + ], + "styles": ["apps/behandel/src/styles.css"] + }, + "configurations": { + "production": { + "budgets": [ + { + "type": "initial", + "maximumWarning": "1mb", + "maximumError": "2mb" + }, + { + "type": "anyComponentStyle", + "maximumWarning": "4kb", + "maximumError": "8kb" + } + ], + "outputHashing": "all" + }, + "development": { + "optimization": false, + "extractLicenses": false, + "sourceMap": true + } + } + }, + "serve": { + "continuous": true, + "executor": "@angular/build:dev-server", + "defaultConfiguration": "development", + "configurations": { + "production": { + "buildTarget": "behandel:build:production" + }, + "development": { + "buildTarget": "behandel:build:development" + } + } + }, + "lint": { + "executor": "@nx/eslint:lint" + }, + "test": { + "executor": "@angular/build:unit-test", + "options": { + "watch": false + } + }, + "serve-static": { + "continuous": true, + "executor": "@nx/web:file-server", + "options": { + "buildTarget": "behandel:build", + "staticFilePath": "dist/apps/behandel/browser", + "spa": true + } + } + } +} diff --git a/apps/behandel/public/config.json b/apps/behandel/public/config.json new file mode 100644 index 0000000..71c0f65 --- /dev/null +++ b/apps/behandel/public/config.json @@ -0,0 +1,3 @@ +{ + "authority": "http://localhost:8180/realms/medewerker" +} diff --git a/apps/behandel/public/favicon.ico b/apps/behandel/public/favicon.ico new file mode 100644 index 0000000..317ebcb Binary files /dev/null and b/apps/behandel/public/favicon.ico differ diff --git a/apps/behandel/src/app/app.config.ts b/apps/behandel/src/app/app.config.ts new file mode 100644 index 0000000..e761d4a --- /dev/null +++ b/apps/behandel/src/app/app.config.ts @@ -0,0 +1,39 @@ +import { provideHttpClient, withInterceptors } from '@angular/common/http'; +import { ApplicationConfig, provideBrowserGlobalErrorListeners } from '@angular/core'; +import { provideRouter } from '@angular/router'; +import { authInterceptor, provideMedewerkerAuth } from 'auth'; +import { appRoutes } from './app.routes'; + +/** Environment-specific settings fetched from /config.json at startup (see main.ts). */ +export interface RuntimeConfig { + /** The Keycloak `medewerker` realm issuer as the browser reaches it (dev: localhost; compose: keycloak:8080). */ + authority: string; +} + +/** + * Route prefixes whose requests carry the medewerker token. These MUST match the **relative** URLs + * the api-client actually calls (same-origin via the nginx proxy) — the interceptor matches on + * `req.url`, which stays relative, so an absolute origin would never match and the token would go + * unattached. Only `/behandel/` is secured; the app calls no other endpoint group. + */ +export const SECURE_API_ROUTES = ['/behandel/']; + +/** + * Build the app providers from runtime config. `redirectUrl` is the app's own origin (where Keycloak + * redirects back). `secureRoutes` uses {@link SECURE_API_ROUTES} — relative prefixes, not the origin. + */ +export function appConfig(runtime: RuntimeConfig): ApplicationConfig { + const origin = typeof window !== 'undefined' ? window.location.origin : '/'; + return { + providers: [ + provideBrowserGlobalErrorListeners(), + provideRouter(appRoutes), + provideHttpClient(withInterceptors([authInterceptor()])), + provideMedewerkerAuth({ + authority: runtime.authority, + redirectUrl: origin, + secureRoutes: SECURE_API_ROUTES, + }), + ], + }; +} diff --git a/apps/behandel/src/app/app.css b/apps/behandel/src/app/app.css new file mode 100644 index 0000000..e69de29 diff --git a/apps/behandel/src/app/app.html b/apps/behandel/src/app/app.html new file mode 100644 index 0000000..0680b43 --- /dev/null +++ b/apps/behandel/src/app/app.html @@ -0,0 +1 @@ + diff --git a/apps/behandel/src/app/app.routes.ts b/apps/behandel/src/app/app.routes.ts new file mode 100644 index 0000000..07b02f9 --- /dev/null +++ b/apps/behandel/src/app/app.routes.ts @@ -0,0 +1,7 @@ +import { Route } from '@angular/router'; +import { authenticatedGuard } from 'auth'; +import { WerkbakPage } from './werkbak/werkbak-page'; + +export const appRoutes: Route[] = [ + { path: '', component: WerkbakPage, canActivate: [authenticatedGuard] }, +]; diff --git a/apps/behandel/src/app/app.ts b/apps/behandel/src/app/app.ts new file mode 100644 index 0000000..f16917f --- /dev/null +++ b/apps/behandel/src/app/app.ts @@ -0,0 +1,12 @@ +import { Component } from '@angular/core'; +import { RouterModule } from '@angular/router'; + +@Component({ + imports: [RouterModule], + selector: 'app-root', + templateUrl: './app.html', + styleUrl: './app.css', +}) +export class App { + protected title = 'behandel'; +} diff --git a/apps/behandel/src/app/werkbak/werkbak-page.html b/apps/behandel/src/app/werkbak/werkbak-page.html new file mode 100644 index 0000000..9693dca --- /dev/null +++ b/apps/behandel/src/app/werkbak/werkbak-page.html @@ -0,0 +1,64 @@ +
+ + Werkbak +

+ Registraties die wachten op beoordeling. Keur elke registratie goed of wijs deze af. +

+ + @if (loading()) { +

Bezig met laden…

+ } @else if (failed()) { +

+ Kon de werkbak niet laden. Controleer of je als behandelaar bent ingelogd en probeer het + opnieuw. +

+ } @else if (loaded() && items().length === 0) { +

De werkbak is leeg.

+ } @else if (items().length > 0) { + + + + + + + + + + + + @for (item of items(); track item.registrationId) { + + + + + + + } + +
+ Registraties in behandeling +
ReferentieBSNStatusActie
{{ item.registrationId }}{{ item.bsn }}{{ item.status }} + + +
+ } + +
diff --git a/apps/behandel/src/app/werkbak/werkbak-page.ts b/apps/behandel/src/app/werkbak/werkbak-page.ts new file mode 100644 index 0000000..cc5b8e4 --- /dev/null +++ b/apps/behandel/src/app/werkbak/werkbak-page.ts @@ -0,0 +1,65 @@ +import { Component, inject, signal } from '@angular/core'; +import { BffApiV1Service, type WerkbakItem } from 'api-client'; +import { UtrechtComponentsModule } from 'ui'; + +/** The two decisions a behandelaar can make; the BFF validates these exact values (ADR-0013). */ +type Besluit = 'goedkeuren' | 'afwijzen'; + +/** + * The behandel werkbak: a signed-in behandelaar sees the registrations awaiting beoordeling (the open + * Flowable `Beoordelen` tasks, read through the domain) and decides each — goedkeuren or afwijzen. A + * decision posts to the BFF, which applies the domain transition and completes the workflow task + * (ADR-0013; S-12). After a decision the werkbak refreshes so the handled item drops off the list. + */ +@Component({ + selector: 'app-werkbak-page', + imports: [UtrechtComponentsModule], + templateUrl: './werkbak-page.html', +}) +export class WerkbakPage { + private readonly bff = inject(BffApiV1Service); + + protected readonly items = signal([]); + protected readonly loading = signal(false); + protected readonly loaded = signal(false); + protected readonly failed = signal(false); + protected readonly deciding = signal(undefined); + + constructor() { + this.load(); + } + + load(): void { + this.loading.set(true); + this.failed.set(false); + this.bff.getBehandelWerkbak().subscribe({ + next: (rows: WerkbakItem[]) => { + this.items.set(rows); + this.loading.set(false); + this.loaded.set(true); + }, + // Surface the failure (e.g. 403 for a non-behandelaar) instead of swallowing it. + error: () => { + this.items.set([]); + this.loading.set(false); + this.loaded.set(true); + this.failed.set(true); + }, + }); + } + + decide(registrationId: string, besluit: Besluit): void { + this.deciding.set(registrationId); + this.bff.postBehandelRegistrationsIdDecide(registrationId, { besluit }).subscribe({ + // Refresh so the decided registration drops off the werkbak (its task is now completed). + next: () => { + this.deciding.set(undefined); + this.load(); + }, + error: () => { + this.deciding.set(undefined); + this.failed.set(true); + }, + }); + } +} diff --git a/apps/behandel/src/index.html b/apps/behandel/src/index.html new file mode 100644 index 0000000..c524ad4 --- /dev/null +++ b/apps/behandel/src/index.html @@ -0,0 +1,13 @@ + + + + + Behandelportaal BIG-register + + + + + + + + diff --git a/apps/behandel/src/main.ts b/apps/behandel/src/main.ts new file mode 100644 index 0000000..29b0198 --- /dev/null +++ b/apps/behandel/src/main.ts @@ -0,0 +1,10 @@ +import { bootstrapApplication } from '@angular/platform-browser'; +import { App } from './app/app'; +import { appConfig, type RuntimeConfig } from './app/app.config'; + +// Load environment config before bootstrap so the OIDC authority is set per environment +// (dev: localhost; compose: keycloak:8080) from a single build — 12-factor (S-08d). +fetch('config.json') + .then((response) => response.json() as Promise) + .then((config) => bootstrapApplication(App, appConfig(config))) + .catch((err) => console.error(err)); diff --git a/apps/behandel/src/styles.css b/apps/behandel/src/styles.css new file mode 100644 index 0000000..ade77c5 --- /dev/null +++ b/apps/behandel/src/styles.css @@ -0,0 +1,2 @@ +/* NL Design System theme — Utrecht design tokens (docs/frontend-decisions.md). */ +@import '@utrecht/design-tokens/dist/index.css'; diff --git a/apps/behandel/tsconfig.app.json b/apps/behandel/tsconfig.app.json new file mode 100644 index 0000000..a75ddab --- /dev/null +++ b/apps/behandel/tsconfig.app.json @@ -0,0 +1,9 @@ +{ + "extends": "./tsconfig.json", + "compilerOptions": { + "outDir": "../../dist/out-tsc", + "types": [] + }, + "include": ["src/**/*.ts"], + "exclude": ["src/**/*.spec.ts", "src/**/*.test.ts"] +} diff --git a/apps/behandel/tsconfig.json b/apps/behandel/tsconfig.json new file mode 100644 index 0000000..bb7614f --- /dev/null +++ b/apps/behandel/tsconfig.json @@ -0,0 +1,31 @@ +{ + "extends": "../../tsconfig.base.json", + "compilerOptions": { + "strict": true, + "noImplicitOverride": true, + "noPropertyAccessFromIndexSignature": true, + "noImplicitReturns": true, + "noFallthroughCasesInSwitch": true, + "isolatedModules": true, + "target": "es2022", + "moduleResolution": "bundler", + "emitDecoratorMetadata": false, + "module": "preserve" + }, + "angularCompilerOptions": { + "enableI18nLegacyMessageIdFormat": false, + "strictInjectionParameters": true, + "strictInputAccessModifiers": true, + "strictTemplates": true + }, + "files": [], + "include": [], + "references": [ + { + "path": "./tsconfig.app.json" + }, + { + "path": "./tsconfig.spec.json" + } + ] +} diff --git a/apps/behandel/tsconfig.spec.json b/apps/behandel/tsconfig.spec.json new file mode 100644 index 0000000..2d36c49 --- /dev/null +++ b/apps/behandel/tsconfig.spec.json @@ -0,0 +1,8 @@ +{ + "extends": "./tsconfig.json", + "compilerOptions": { + "outDir": "../../dist/out-tsc", + "types": ["vitest/globals"] + }, + "include": ["src/**/*.ts", "src/**/*.d.ts"] +}