test(bff): /behandel/registrations/{id}/decide auth + forwarding + besluit validation (refs #13)

Red — the decide endpoint does not exist yet.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

services/bff/Bff.Tests/BehandelEndpointTests.cs

@@ -54,4 +54,61 @@ public class BehandelEndpointTests
         Assert.Equal("reg-1", item.RegistrationId);
         Assert.Equal("123456782", item.Bsn);
     }
+
+    private static HttpRequestMessage Decide(string? bearer, string id = "reg-1", string besluit = "goedkeuren")
+    {
+        var request = new HttpRequestMessage(HttpMethod.Post, $"/behandel/registrations/{id}/decide")
+        {
+            Content = JsonContent.Create(new { besluit }),
+        };
+        if (bearer is not null)
+            request.Headers.Authorization = new AuthenticationHeaderValue("Bearer", bearer);
+        return request;
+    }
+
+    [Fact]
+    public async Task Rejects_a_decision_without_a_token()
+    {
+        using var factory = new BffFactory();
+
+        var response = await factory.CreateClient().SendAsync(Decide(bearer: null));
+
+        Assert.Equal(HttpStatusCode.Unauthorized, response.StatusCode);
+        Assert.Null(factory.Domain.Decided);
+    }
+
+    [Fact]
+    public async Task Rejects_a_decision_from_a_medewerker_without_the_behandelaar_role()
+    {
+        using var factory = new BffFactory();
+
+        var response = await factory.CreateClient().SendAsync(Decide(TestTokens.Medewerker("teamlead")));
+
+        Assert.Equal(HttpStatusCode.Forbidden, response.StatusCode);
+        Assert.Null(factory.Domain.Decided);
+    }
+
+    [Fact]
+    public async Task Forwards_a_behandelaar_decision_to_the_domain()
+    {
+        using var factory = new BffFactory();
+
+        var response = await factory.CreateClient()
+            .SendAsync(Decide(TestTokens.Medewerker("behandelaar"), id: "reg-42", besluit: "afwijzen"));
+
+        Assert.Equal(HttpStatusCode.NoContent, response.StatusCode);
+        Assert.Equal(("reg-42", "afwijzen"), factory.Domain.Decided);
+    }
+
+    [Fact]
+    public async Task Rejects_an_unknown_besluit_without_calling_the_domain()
+    {
+        using var factory = new BffFactory();
+
+        var response = await factory.CreateClient()
+            .SendAsync(Decide(TestTokens.Medewerker("behandelaar"), besluit: "misschien"));
+
+        Assert.Equal(HttpStatusCode.BadRequest, response.StatusCode);
+        Assert.Null(factory.Domain.Decided);
+    }
 }