test(bff): /beheer/default-fill read + update behind beheerder authorization (refs #131)

services/bff/Bff.Api/DownstreamClients.cs

@@ -59,12 +59,26 @@ public interface IProjectionClient
 /// internal reference, not shown in the portal.</summary>
 public sealed record BeheerZaaktype(string Identificatie, string Omschrijving);
 
-/// <summary>Port to the ACL for read-only catalogus queries (beheer portal, S-15a). The BFF reaches the
-/// ACL directly for this read: the catalogus isn't a domain concern, and the ACL is the only code
-/// allowed to read the ZGW Catalogi API (§8.1, ADR-0025).</summary>
+/// <summary>The ACL default-fill settings the beheer portal reads + edits (S-15b): the three ZGW-mandatory
+/// fields the ACL stamps on every zaak (ADR-0003).</summary>
+public sealed record BeheerDefaultFill(
+    string Bronorganisatie,
+    string VerantwoordelijkeOrganisatie,
+    string Vertrouwelijkheidaanduiding);
+
+/// <summary>Port to the ACL for beheer queries (beheer portal). The BFF reaches the ACL directly: these
+/// aren't a domain concern, and the ACL is the only code allowed to read/own the ZGW-facing config
+/// (§8.1, ADR-0025).</summary>
 public interface IAclClient
 {
+    /// <summary>The published catalogus zaaktypen, read-only (S-15a).</summary>
     Task<IReadOnlyList<BeheerZaaktype>> GetZaaktypenAsync(CancellationToken ct = default);
+
+    /// <summary>The current default-fill settings (S-15b).</summary>
+    Task<BeheerDefaultFill> GetDefaultFillAsync(CancellationToken ct = default);
+
+    /// <summary>Replace the default-fill settings (S-15b).</summary>
+    Task UpdateDefaultFillAsync(BeheerDefaultFill settings, CancellationToken ct = default);
 }
 
 /// <summary>Calls the Domain Service's <c>POST /registrations</c>.</summary>
@@ -141,4 +155,14 @@ public sealed class AclClient(HttpClient http) : IAclClient
 {
     public async Task<IReadOnlyList<BeheerZaaktype>> GetZaaktypenAsync(CancellationToken ct = default)
         => await http.GetFromJsonAsync<List<BeheerZaaktype>>("catalogi/zaaktypen", ct) ?? [];
+
+    public async Task<BeheerDefaultFill> GetDefaultFillAsync(CancellationToken ct = default)
+        => await http.GetFromJsonAsync<BeheerDefaultFill>("default-fill", ct)
+           ?? throw new InvalidOperationException("The ACL returned an empty default-fill response.");
+
+    public async Task UpdateDefaultFillAsync(BeheerDefaultFill settings, CancellationToken ct = default)
+    {
+        using var response = await http.PutAsJsonAsync("default-fill", settings, ct);
+        response.EnsureSuccessStatusCode();
+    }
 }