Niek Otten
9c3da48d8e
All checks were successful
## What & why First half of **S-12c** (behandel-portal backend), per **ADR-0013** (decisions recorded in #84): - **BFF multi-realm auth.** A second JWT bearer scheme (`medewerker`) alongside the default `digid` scheme. On validation it lifts Keycloak's `realm_access.roles` onto the principal, and a `behandelaar` policy (medewerker scheme + `behandelaar` role) gates `/behandel/*`. Self-service keeps the digid scheme. - **Werkbak = Flowable tasks.** The domain `Werkbak` query reads the open `Beoordelen` tasks (§8.2, S-12b's `IUserTaskClient`) and enriches each with its aggregate's bsn + status; `GET /behandel/werkbak` (domain) is proxied by the BFF `GET /behandel/werkbak` behind the behandelaar policy. The read projection stays the anonymous openbaar model (no premature `IN_BEHANDELING`/personal-data plumbing — deferred in ADR-0008). Behavior: `/behandel/werkbak` is **401** without a token, **403** for a medewerker lacking the role, **200 + werkbak** for a behandelaar. **S-12c-2** (next): `POST /behandel/registrations/{id}/decide` → domain decision + complete the Flowable task. ## Definition of Done - [x] Linked issue: #13 (umbrella, `refs`); closes the adr-proposal #84 - [x] Tests first; red → green per layer - [x] Unit + acceptance green (`make unit`): domain 78, bff 23, acceptance 9 (+ acl/event-subscriber unaffected) - [x] api-client `test` green; openapi.json regenerated (drift guard passes) - [x] Mutation ≥ break(90): **domain 100%, bff 100%** - [x] ADR-0013 added; `Keycloak__MedewerkerAuthority` wired into compose - [ ] CI green (pending) Part of #13. closes #84 Reviewed-on: #85
50 lines
1.8 KiB
C#
50 lines
1.8 KiB
C#
using Big.Application;
|
|
using Big.Domain;
|
|
|
|
namespace Big.Tests;
|
|
|
|
/// <summary>
|
|
/// The werkbak query (S-12c): the behandelaar's list of registrations awaiting beoordeling. It reads
|
|
/// the open Beoordelen tasks from the workflow engine (§8.2) and enriches each with its registration
|
|
/// (bsn + status) from the store. A task whose registration is unknown is skipped defensively.
|
|
/// </summary>
|
|
public class WerkbakTests
|
|
{
|
|
[Fact]
|
|
public async Task Lists_an_item_per_open_beoordeling_enriched_from_the_registration()
|
|
{
|
|
var store = new FakeRegistrationStore();
|
|
var registration = Registration.Submit("123456782");
|
|
registration.AttachZaak(FakeAclClient.DefaultZaakUrl);
|
|
registration.TakeIntoBehandeling();
|
|
store.Seed(registration);
|
|
var tasks = new FakeUserTaskClient([new BeoordelingTask("task-1", registration.Id)]);
|
|
var werkbak = new Werkbak(tasks, store);
|
|
|
|
var items = await werkbak.GetAsync();
|
|
|
|
var item = Assert.Single(items);
|
|
Assert.Equal(registration.Id.ToString(), item.RegistrationId);
|
|
Assert.Equal("123456782", item.Bsn);
|
|
Assert.Equal("InBehandeling", item.Status);
|
|
}
|
|
|
|
[Fact]
|
|
public async Task Is_empty_when_no_beoordelingen_are_open()
|
|
{
|
|
var werkbak = new Werkbak(new FakeUserTaskClient([]), new FakeRegistrationStore());
|
|
|
|
Assert.Empty(await werkbak.GetAsync());
|
|
}
|
|
|
|
[Fact]
|
|
public async Task Skips_a_task_whose_registration_is_unknown()
|
|
{
|
|
// Defensive: the werkbak never invents an item for a task the domain has no aggregate for.
|
|
var tasks = new FakeUserTaskClient([new BeoordelingTask("task-1", RegistrationId.New())]);
|
|
var werkbak = new Werkbak(tasks, new FakeRegistrationStore());
|
|
|
|
Assert.Empty(await werkbak.GetAsync());
|
|
}
|
|
}
|