register-referentie

eho/register-referentie

Fork 0

Author	SHA1	Message	Date
Niek Otten	9c3da48d8e	feat(#13 ): S-12c-1 — behandel BFF auth + werkbak (ADR-0013) (#85 ) All checks were successful CI / lint (push) Successful in 1m26s Details CI / build (push) Successful in 1m19s Details CI / unit (push) Successful in 1m14s Details CI / frontend (push) Successful in 2m37s Details CI / mutation (push) Successful in 5m54s Details CI / verify-stack (push) Successful in 7m18s Details ## What & why First half of S-12c (behandel-portal backend), per ADR-0013 (decisions recorded in #84): - BFF multi-realm auth. A second JWT bearer scheme (`medewerker`) alongside the default `digid` scheme. On validation it lifts Keycloak's `realm_access.roles` onto the principal, and a `behandelaar` policy (medewerker scheme + `behandelaar` role) gates `/behandel/`. Self-service keeps the digid scheme. - Werkbak = Flowable tasks.* The domain `Werkbak` query reads the open `Beoordelen` tasks (§8.2, S-12b's `IUserTaskClient`) and enriches each with its aggregate's bsn + status; `GET /behandel/werkbak` (domain) is proxied by the BFF `GET /behandel/werkbak` behind the behandelaar policy. The read projection stays the anonymous openbaar model (no premature `IN_BEHANDELING`/personal-data plumbing — deferred in ADR-0008). Behavior: `/behandel/werkbak` is 401 without a token, 403 for a medewerker lacking the role, 200 + werkbak for a behandelaar. S-12c-2 (next): `POST /behandel/registrations/{id}/decide` → domain decision + complete the Flowable task. ## Definition of Done - [x] Linked issue: #13 (umbrella, `refs`); closes the adr-proposal #84 - [x] Tests first; red → green per layer - [x] Unit + acceptance green (`make unit`): domain 78, bff 23, acceptance 9 (+ acl/event-subscriber unaffected) - [x] api-client `test` green; openapi.json regenerated (drift guard passes) - [x] Mutation ≥ break(90): domain 100%, bff 100% - [x] ADR-0013 added; `Keycloak__MedewerkerAuthority` wired into compose - [ ] CI green (pending) Part of #13. closes #84 Reviewed-on: #85	2026-07-15 09:54:01 +00:00

Author

SHA1

Message

Date

Niek Otten

9c3da48d8e

feat(#13 ): S-12c-1 — behandel BFF auth + werkbak (ADR-0013) (#85 )

CI / lint (push) Successful in 1m26s

Details

CI / build (push) Successful in 1m19s

Details

CI / unit (push) Successful in 1m14s

Details

CI / frontend (push) Successful in 2m37s

Details

CI / mutation (push) Successful in 5m54s

Details

CI / verify-stack (push) Successful in 7m18s

Details

## What & why

First half of **S-12c** (behandel-portal backend), per **ADR-0013** (decisions recorded in #84):

- **BFF multi-realm auth.** A second JWT bearer scheme (`medewerker`) alongside the default `digid` scheme. On validation it lifts Keycloak's `realm_access.roles` onto the principal, and a `behandelaar` policy (medewerker scheme + `behandelaar` role) gates `/behandel/*`. Self-service keeps the digid scheme.
- **Werkbak = Flowable tasks.** The domain `Werkbak` query reads the open `Beoordelen` tasks (§8.2, S-12b's `IUserTaskClient`) and enriches each with its aggregate's bsn + status; `GET /behandel/werkbak` (domain) is proxied by the BFF `GET /behandel/werkbak` behind the behandelaar policy. The read projection stays the anonymous openbaar model (no premature `IN_BEHANDELING`/personal-data plumbing — deferred in ADR-0008).

Behavior: `/behandel/werkbak` is **401** without a token, **403** for a medewerker lacking the role, **200 + werkbak** for a behandelaar.

**S-12c-2** (next): `POST /behandel/registrations/{id}/decide` → domain decision + complete the Flowable task.

## Definition of Done

- [x] Linked issue: #13 (umbrella, `refs`); closes the adr-proposal #84
- [x] Tests first; red → green per layer
- [x] Unit + acceptance green (`make unit`): domain 78, bff 23, acceptance 9 (+ acl/event-subscriber unaffected)
- [x] api-client `test` green; openapi.json regenerated (drift guard passes)
- [x] Mutation ≥ break(90): **domain 100%, bff 100%**
- [x] ADR-0013 added; `Keycloak__MedewerkerAuthority` wired into compose
- [ ] CI green (pending)

Part of #13. closes #84

Reviewed-on: #85

2026-07-15 09:54:01 +00:00

Compare commits

1 Commits

feat/13-be ... main

Diff Content Not Available

Compare commits

1 Commits feat/13-be ... main

Diff Content Not Available

1 Commits

feat/13-be ... main