Merge branch 'main' into fix/91-local-compose-parity

docker-compose.local.yml lacked the domain service and all three portals, and never wired

host-browser OIDC. Add them, give the BFF its Keycloak/downstream env, and pin Keycloak's issuer

to http://localhost:8180 with a dynamic backchannel so a host browser logs in on localhost:8180

while the BFF still validates in-network via keycloak:8080. Portals bind-mount a localhost:8180

config.json over the baked keycloak:8080 one.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

apps/behandel/Dockerfile

@@ -19,9 +19,5 @@ COPY --from=build /src/dist/apps/behandel/browser /usr/share/nginx/html
 # Compose-time OIDC config: the browser (Playwright, on the compose network) reaches Keycloak by
 # service name, so the token issuer matches the BFF's medewerker authority (host-consistent, ADR-0013).
 RUN printf '{ "authority": "http://keycloak:8080/realms/medewerker" }\n' > /usr/share/nginx/html/config.json
-# Make the reverse-proxy resolver engine-portable (Docker 127.0.0.11 vs podman aardvark); runs from
-# the nginx image's /docker-entrypoint.d before nginx starts.
-COPY apps/portal-nginx-resolver.sh /docker-entrypoint.d/40-resolver.sh
-RUN chmod +x /docker-entrypoint.d/40-resolver.sh
 
 EXPOSE 80

apps/openbaar/Dockerfile

@@ -17,9 +17,5 @@ FROM nginx:1.27-alpine AS runtime
 COPY apps/openbaar/nginx.conf /etc/nginx/conf.d/default.conf
 COPY --from=build /src/dist/apps/openbaar/browser /usr/share/nginx/html
 # No runtime config: the openbaar register is anonymous (no OIDC authority to inject).
-# Make the reverse-proxy resolver engine-portable (Docker 127.0.0.11 vs podman aardvark); runs from
-# the nginx image's /docker-entrypoint.d before nginx starts.
-COPY apps/portal-nginx-resolver.sh /docker-entrypoint.d/40-resolver.sh
-RUN chmod +x /docker-entrypoint.d/40-resolver.sh
 
 EXPOSE 80

apps/portal-nginx-resolver.sh

@@ -1,17 +0,0 @@
-#!/bin/sh
-# Point nginx's reverse-proxy `resolver` at THIS container's real DNS server.
-#
-# The portal nginx configs use a variable proxy_pass, which needs a `resolver` so the BFF hostname is
-# resolved at request time (nginx can start before the BFF is up). The config hardcodes Docker's
-# embedded DNS (127.0.0.11) — correct on Docker/Docker Desktop, but rootless podman uses a
-# network-specific address (aardvark, e.g. 10.89.0.1), so proxied calls 502 there. Read the actual
-# nameserver from /etc/resolv.conf and substitute it, so the reverse proxy works on any engine.
-#
-# Runs from the nginx image's /docker-entrypoint.d/ before nginx starts. On Docker the nameserver IS
-# 127.0.0.11, so the substitution is a no-op. Guarded (no `set -e`) so it's safe whether the nginx
-# entrypoint executes or sources it.
-ns="$(awk '/^nameserver/{print $2; exit}' /etc/resolv.conf 2>/dev/null)"
-if [ -n "$ns" ] && [ "$ns" != "127.0.0.11" ]; then
-  sed -i "s/resolver 127\.0\.0\.11/resolver $ns/" /etc/nginx/conf.d/default.conf 2>/dev/null || true
-  echo "portal-nginx-resolver: set resolver to $ns"
-fi

apps/self-service/Dockerfile

@@ -19,9 +19,5 @@ COPY --from=build /src/dist/apps/self-service/browser /usr/share/nginx/html
 # Compose-time OIDC config: the browser (Playwright, on the compose network) reaches Keycloak by
 # service name, so the token issuer matches the BFF's authority (host-consistent, ADR-0010).
 RUN printf '{ "authority": "http://keycloak:8080/realms/digid" }\n' > /usr/share/nginx/html/config.json
-# Make the reverse-proxy resolver engine-portable (Docker 127.0.0.11 vs podman aardvark); runs from
-# the nginx image's /docker-entrypoint.d before nginx starts.
-COPY apps/portal-nginx-resolver.sh /docker-entrypoint.d/40-resolver.sh
-RUN chmod +x /docker-entrypoint.d/40-resolver.sh
 
 EXPOSE 80

apps/self-service/src/app/registration/registration-page.html

@@ -3,29 +3,9 @@
     <utrecht-heading-1>Zelfservice — BIG-registratie</utrecht-heading-1>
 
     @if (submitted()) {
-      @if (withdrawn()) {
-        <p utrecht-paragraph role="status">
-          Uw registratie met referentie {{ reference() }} is ingetrokken.
-        </p>
-      } @else {
       <p utrecht-paragraph role="status">
         Uw registratie is ontvangen. Referentie: {{ reference() }}.
       </p>
-        @if (withdrawFailed()) {
-          <p utrecht-paragraph role="alert">
-            Het intrekken van uw registratie is niet gelukt. Probeer het opnieuw.
-          </p>
-        }
-        <button
-          utrecht-button
-          appearance="secondary-action-button"
-          type="button"
-          [disabled]="withdrawing()"
-          (click)="withdraw()"
-        >
-          Trek aanvraag in
-        </button>
-      }
     } @else {
       <p utrecht-paragraph>U bent ingelogd met BSN {{ bsn() }}.</p>
       @if (failed()) {

apps/self-service/src/app/registration/registration-page.spec.ts

@@ -17,22 +17,12 @@ class FakeAuth extends AuthService {
   }
 }
 
-function providers(
+function providers(post = vi.fn().mockReturnValue(of({ registrationId: 'reg-9', status: 'Ingediend' }))) {
-  post = vi.fn().mockReturnValue(of({ registrationId: 'reg-9', status: 'Ingediend' })),
-  withdraw = vi.fn().mockReturnValue(of(undefined)),
-) {
   return {
     post,
-    withdraw,
     providers: [
       { provide: AuthService, useClass: FakeAuth },
-      {
+      { provide: BffApiV1Service, useValue: { postSelfServiceRegistrations: post } },
-        provide: BffApiV1Service,
-        useValue: {
-          postSelfServiceRegistrations: post,
-          postSelfServiceRegistrationsIdWithdraw: withdraw,
-        },
-      },
     ],
   };
 }
@@ -66,36 +56,6 @@ describe('RegistrationPage', () => {
     expect(screen.getByRole('button', { name: /indienen/i })).toBeTruthy();
   });
 
-  it('offers to withdraw after submitting, and withdrawing confirms', async () => {
-    const { withdraw, providers: p } = providers();
-    await render(RegistrationPage, { providers: p });
-
-    fireEvent.click(screen.getByRole('button', { name: /indienen/i }));
-    await screen.findByText(/ontvangen/i);
-
-    fireEvent.click(await screen.findByRole('button', { name: /trek aanvraag in/i }));
-
-    // The withdrawal is keyed by the reference the submit returned, and the page confirms it.
-    expect(withdraw).toHaveBeenCalledWith('reg-9');
-    expect(await screen.findByText(/ingetrokken/i)).toBeTruthy();
-  });
-
-  it('surfaces a withdraw failure and keeps the action available', async () => {
-    const { providers: p } = providers(
-      vi.fn().mockReturnValue(of({ registrationId: 'reg-9', status: 'Ingediend' })),
-      vi.fn().mockReturnValue(throwError(() => new Error('withdraw rejected'))),
-    );
-    await render(RegistrationPage, { providers: p });
-
-    fireEvent.click(screen.getByRole('button', { name: /indienen/i }));
-    await screen.findByText(/ontvangen/i);
-    fireEvent.click(await screen.findByRole('button', { name: /trek aanvraag in/i }));
-
-    expect(await screen.findByRole('alert')).toBeTruthy();
-    expect(screen.queryByText(/is ingetrokken/i)).toBeNull();
-    expect(screen.getByRole('button', { name: /trek aanvraag in/i })).toBeTruthy();
-  });
-
   it('has no WCAG 2.1 AA violations on the submit page', async () => {
     // The portal is Dutch; the real index.html sets lang. Set it here so the document-level
     // html-has-lang rule reflects the app, not the bare jsdom document.

apps/self-service/src/app/registration/registration-page.ts

@@ -6,8 +6,7 @@ import { UtrechtComponentsModule } from 'ui';
 /**
  * The self-service submit page: a signed-in zorgprofessional confirms and submits their BIG
  * registration. The bsn comes from the DigiD token (not a form field), so this is a confirm-and-
- * submit flow that posts to the BFF and shows the returned reference (ADR-0010; S-08c). After
+ * submit flow that posts to the BFF and shows the returned reference (ADR-0010; S-08c).
- * submitting they can withdraw it — "trek aanvraag in" — keyed by that reference (S-11c).
  */
 @Component({
   selector: 'app-registration-page',
@@ -23,9 +22,6 @@ export class RegistrationPage {
   protected readonly reference = signal<string | undefined>(undefined);
   protected readonly submitted = signal(false);
   protected readonly failed = signal(false);
-  protected readonly withdrawing = signal(false);
-  protected readonly withdrawn = signal(false);
-  protected readonly withdrawFailed = signal(false);
 
   submit(): void {
     this.submitting.set(true);
@@ -43,24 +39,4 @@ export class RegistrationPage {
       },
     });
   }
-
-  withdraw(): void {
-    const reference = this.reference();
-    if (!reference) {
-      return;
-    }
-    this.withdrawing.set(true);
-    this.withdrawFailed.set(false);
-    this.bff.postSelfServiceRegistrationsIdWithdraw(reference).subscribe({
-      next: () => {
-        this.withdrawn.set(true);
-        this.withdrawing.set(false);
-      },
-      // Surface the failure instead of swallowing it: keep the action so the user can retry.
-      error: () => {
-        this.withdrawFailed.set(true);
-        this.withdrawing.set(false);
-      },
-    });
-  }
 }

docs/demo-script.md

@@ -275,26 +275,3 @@ ACL → NRC → event-subscriber → projection → openbaar register shows INGE
 > The full round-trip — DigiD submit → public INGEDIEND → behandelaar goedkeurt in the werkbak →
 > public INGESCHREVEN — is the Playwright happy path (`tests/e2e/registration.spec.ts`), which now
 > drives the behandel portal in place of the old admin endpoint.
-
-## S-11 — Withdrawal: "trek aanvraag in" (#12, ADR-0014)
-
-A zorgprofessional can withdraw their own still-open registration from the self-service portal. The
-withdrawal is owner-scoped (the BFF forwards the DigiD token's bsn; the domain only lets the owner
-withdraw) and cancels the running workflow via a BPMN message event, so the case leaves the
-behandelaar's werkbak.
-
-```text
-# 1. Log in and submit at the self-service portal (http://localhost:8140/, jan-burger / test123),
-#    note the "Referentie" on the confirmation.
-# 2. Click "Trek aanvraag in" → the page confirms the registration is ingetrokken.
-# 3. In the behandel werkbak (http://localhost:8142/, merel-behandelaar) the registration no longer
-#    appears — its Beoordelen task was cancelled.
-```
-
-**The path:** self-service → BFF `POST /self-service/registrations/{id}/withdraw` (DigiD, owner-scoped)
-→ domain sets INGETROKKEN + correlates the `RegistratieIngetrokken` message to the process → the
-interrupting boundary event ends it → the werkbak drops the case.
-
-> DigiD submit → trek aanvraag in → ingetrokken is the Playwright happy path
-> (`tests/e2e/withdrawal.spec.ts`); the owner-scoping + workflow cancellation are covered by the
-> `Een registratie intrekken` acceptance scenarios and the domain live check.

docs/frontend-decisions.md

@@ -151,19 +151,3 @@ frontend work is the medewerker realm auth and the werkbak/decide page. Wiring r
   to assert the medewerker token attaches to `/behandel/*` (and not to the anonymous openbaar call).
   The full DigiD-submit → behandel-decide → public INGESCHREVEN round-trip is the Playwright happy
   path.
-
-## Self-service withdrawal: "trek aanvraag in" (S-11c, #12)
-
-The submit confirmation grows a **"Trek aanvraag in"** action so a zorgprofessional can withdraw the
-registration they just submitted (`apps/self-service`, on the existing `RegistrationPage`).
-
-- **Keyed by the reference, owner-scoped at the BFF.** The button calls the generated
-  `postSelfServiceRegistrationsIdWithdraw(reference)` with the reference the submit returned. The
-  DigiD token (attached by the interceptor) carries the bsn the BFF forwards; the domain only lets
-  the owner withdraw (a mismatch is 404). No extra identity is entered in the UI.
-- **Same confirm-and-surface pattern as submit.** A secondary-action button; on success the page
-  switches to an ingetrokken confirmation; a failure is surfaced (`role="alert"`) and the action
-  stays available to retry — mirroring how submit handles its failure rather than swallowing it.
-- **Testing.** Component tests (`@testing-library/angular`, mocked BFF) cover the button appearing
-  after submit, the reference being passed, the ingetrokken confirmation, and the failure path; the
-  browser round-trip is `tests/e2e/withdrawal.spec.ts`.

infra/docker-compose.local.yml

@@ -380,10 +380,6 @@ services:
     image: register-referentie/event-subscriber:dev
     environment:
       ConnectionStrings__Projection: Host=projection-db;Database=projection;Username=projection;Password=projection
-      # The subscriber enriches the projection with each zaak's reference by asking the ACL — the only
-      # code allowed to read ZGW (§8.1, #78). Required: startup throws without it (parity with the
-      # canonical compose).
-      Acl__BaseUrl: http://acl:8080/
       EventSubscriber__Webhook__AuthToken: ${NOTIFICATION_WEBHOOK_TOKEN:-Bearer big-reference-notifications}
     ports:
       - "8110:8080"
@@ -396,8 +392,6 @@ services:
     depends_on:
       projection-db:
         condition: service_healthy
-      acl:
-        condition: service_healthy
     networks: [cg]
 
   projection-api:

tests/acceptance/Features/EenRegistratieIntrekken.feature

@@ -1,22 +0,0 @@
-# language: en
-# Drives S-11 (#12). A zorgprofessional withdraws their own submitted registration ("trek aanvraag
-# in"): it advances to INGETROKKEN and its running workflow is cancelled (ADR-0014). Only the owner
-# may withdraw — another bsn is told not-found. Exercised against in-memory stand-ins for the store
-# and the Workflow Client; the live Flowable message correlation is verified by the domain check.
-Feature: Een registratie intrekken
-  Als zorgprofessional wil ik mijn ingediende registratie kunnen intrekken
-  zodat een aanvraag die ik niet meer wil niet in behandeling blijft.
-
-  Scenario: De zorgprofessional trekt zijn eigen registratie in
-    Given a submitted registration with a running process
-    When the zorgprofessional withdraws it
-    Then the withdrawal succeeds
-    And the registration has status "INGETROKKEN"
-    And the running process is cancelled
-
-  Scenario: Een andere zorgprofessional kan de registratie niet intrekken
-    Given a submitted registration with a running process
-    When a different zorgprofessional tries to withdraw it
-    Then the withdrawal is reported not found
-    And the registration has status "INGEDIEND"
-    And the running process is not cancelled

tests/acceptance/Steps/EenRegistratieIntrekkenSteps.cs

@@ -1,59 +0,0 @@
-using Acceptance.Support;
-using Big.Application;
-using Big.Domain;
-using Reqnroll;
-using Xunit;
-
-namespace Acceptance.Steps;
-
-/// <summary>Bindings for <c>EenRegistratieIntrekken.feature</c> (S-11). Submits a registration (which
-/// records its process) and then applies the WithdrawRegistration use case against in-memory ports;
-/// one instance per scenario. Scoped to this feature so its "the registration has status" step does
-/// not clash with the identically phrased steps in the other features.</summary>
-[Binding]
-[Scope(Feature = "Een registratie intrekken")]
-public sealed class EenRegistratieIntrekkenSteps
-{
-    private const string OwnerBsn = "123456782";
-
-    private readonly InMemoryRegistrationStore _store = new();
-    private readonly InMemoryWorkflowClient _workflow = new();
-    private RegistrationId _id;
-    private WithdrawOutcome _outcome;
-
-    [Given("a submitted registration with a running process")]
-    public async Task GivenASubmittedRegistrationWithARunningProcess()
-        => _id = await new SubmitRegistration(_store, _workflow).HandleAsync(new SubmitRegistrationCommand(OwnerBsn));
-
-    [When("the zorgprofessional withdraws it")]
-    public async Task WhenTheZorgprofessionalWithdrawsIt()
-        => _outcome = await new WithdrawRegistration(_store, _workflow).HandleAsync(
-            new WithdrawRegistrationCommand(_id, OwnerBsn));
-
-    [When("a different zorgprofessional tries to withdraw it")]
-    public async Task WhenADifferentZorgprofessionalTriesToWithdrawIt()
-        => _outcome = await new WithdrawRegistration(_store, _workflow).HandleAsync(
-            new WithdrawRegistrationCommand(_id, "999999990"));
-
-    [Then("the withdrawal succeeds")]
-    public void ThenTheWithdrawalSucceeds() => Assert.Equal(WithdrawOutcome.Withdrawn, _outcome);
-
-    [Then("the withdrawal is reported not found")]
-    public void ThenTheWithdrawalIsReportedNotFound() => Assert.Equal(WithdrawOutcome.NotFound, _outcome);
-
-    [Then("the registration has status \"(.*)\"")]
-    public async Task ThenTheRegistrationHasStatus(string expected)
-    {
-        var registration = await _store.GetAsync(_id);
-        Assert.NotNull(registration);
-        Assert.Equal(expected, registration.Status.ToString().ToUpperInvariant());
-    }
-
-    [Then("the running process is cancelled")]
-    public void ThenTheRunningProcessIsCancelled()
-        => Assert.Equal(InMemoryWorkflowClient.StartedProcessInstanceId, _workflow.WithdrawnProcessInstanceId);
-
-    [Then("the running process is not cancelled")]
-    public void ThenTheRunningProcessIsNotCancelled()
-        => Assert.Null(_workflow.WithdrawnProcessInstanceId);
-}

tests/e2e/withdrawal.spec.ts

@@ -1,27 +0,0 @@
-import { expect, test } from '@playwright/test';
-
-// S-11 (Flow 3): a zorgprofessional logs in via mock DigiD, submits a registration, then withdraws
-// it ("trek aanvraag in") from the self-service portal. The withdrawal goes portal → BFF (owner-
-// scoped by the DigiD token's bsn) → domain, which cancels the running workflow (ADR-0014); the page
-// then confirms the registration is ingetrokken.
-test('DigiD submit → trek aanvraag in → self-service confirms ingetrokken', async ({ page }) => {
-  // Visiting the guarded page redirects to the Keycloak (mock DigiD) login.
-  await page.goto('/');
-
-  await page.locator('#username').fill('jan-burger');
-  await page.locator('#password').fill('test123');
-  await page.locator('#kc-login').click();
-
-  await expect(page.getByRole('heading', { name: /Zelfservice/i })).toBeVisible();
-
-  await page.getByRole('button', { name: /indienen/i }).click();
-
-  // The BFF accepted it and the page shows the confirmation with the reference.
-  await expect(page.getByText(/ontvangen/i)).toBeVisible();
-
-  // Withdraw it. The confirmation of withdrawal appears only after the decide POST completes (204),
-  // so awaiting the "ingetrokken" text also proves the request landed — no premature navigation.
-  await page.getByRole('button', { name: /trek aanvraag in/i }).click();
-
-  await expect(page.getByText(/is ingetrokken/i)).toBeVisible();
-});