feat(openzaak): bounded retry + flagged write divergence (WP-60)

Local aanvraag/document writes and their paired ZGW writes aren't transactional; a ZGW failure after the local write succeeds used to diverge silently. ZgwHttpClient now retries transport-shaped failures (not 500, which can follow a partial commit on the non-idempotent statussen/rollen POSTs), and a ZGW failure that survives retry sets Aanvraag.ZgwError plus a zgw:divergence audit row instead of failing or diverging quietly. No outbox/reconcile job: three request-triggered write paths don't justify a persisted queue that would also need to carry citizen PII for the JWT audit claims. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
2026-07-30 18:11:55 +02:00
parent 67abc58052
commit 3ff80c124f
18 changed files with 855 additions and 82 deletions
@@ -1,3 +1,4 @@
+using System.Net;
 using BigRegister.Api.Data;
 using BigRegister.Api.Zgw;
 using BigRegister.Domain.Authorization;
@@ -159,4 +160,95 @@ public class OpenZaakZaakSourceTests

    Assert.Throws<InvalidOperationException>(() => source.CreateZaak(aanvraag, DateTimeOffset.UtcNow, caller));
  }
+
+  // --- WP-60: bounded retry in ZgwHttpClient, exercised through the create-zaak write path ---
+
+  private static (ZgwOptions options, Aanvraag aanvraag, CallerIdentity caller) CreateZaakFixture()
+  {
+    const string zaaktypeUrl = $"{ZtBase}/zaaktypen/zt-registratie";
+    var options = new ZgwOptions
+    {
+      ZrcBaseUrl = ZrcBase,
+      ZtcBaseUrl = ZtBase,
+      ClientId = "c",
+      Secret = "s",
+      Bronorganisatie = "123443210",
+      VerantwoordelijkeOrganisatie = "123443210",
+      ZaaktypeUrls = new() { ["registratie"] = zaaktypeUrl },
+    };
+    var aanvraag = new Aanvraag { Id = "a1", Type = "registratie", Owner = "111222333", Referentie = "BIG-2026-000123" };
+    var caller = new CallerIdentity(aanvraag.Owner, "Dr. Test", PrincipalRole.Drafter);
+    return (options, aanvraag, caller);
+  }
+
+  private static string RespondFor(string zaaktypeUrl, string url) => url switch
+  {
+    _ when url == $"{ZrcBase}/zaken" => $$"""
+      { "url": "{{ZrcBase}}/zaken/uuid-new", "identificatie": "BIG-2026-000123",
+        "zaaktype": "{{zaaktypeUrl}}", "startdatum": "2026-07-28",
+        "einddatum": null, "registratiedatum": "2026-07-28" }
+      """,
+    _ when url.StartsWith($"{ZtBase}/statustypen") => """
+      { "count": 1, "next": null,
+        "results": [ { "url": "https://oz.example/catalogi/api/v1/statustypen/st-1", "volgnummer": 1 } ] }
+      """,
+    _ when url.StartsWith($"{ZtBase}/roltypen") => """
+      { "count": 1, "next": null,
+        "results": [ { "url": "https://oz.example/catalogi/api/v1/roltypen/rt-initiator" } ] }
+      """,
+    _ when url == $"{ZrcBase}/statussen" => "{}",
+    _ when url == $"{ZrcBase}/rollen" => "{}",
+    _ => throw new InvalidOperationException($"unexpected ZGW call {url}"),
+  };
+
+  [Fact]
+  public void CreateZaak_retries_a_transient_failure_and_then_succeeds()
+  {
+    var (options, aanvraag, caller) = CreateZaakFixture();
+    var zaaktypeUrl = options.ZaaktypeUrls["registratie"];
+    var handler = new ZgwStubHandler(
+        url => RespondFor(zaaktypeUrl, url),
+        (url, attempt) => url == $"{ZrcBase}/zaken" && attempt == 0 ? HttpStatusCode.ServiceUnavailable : HttpStatusCode.OK);
+    var source = new OpenZaakZaakSource(new HttpClient(handler), new ZgwTokenProvider(options), options);
+
+    var (referentie, _, zaakUrl) = source.CreateZaak(aanvraag, new DateTimeOffset(2026, 7, 28, 12, 0, 0, TimeSpan.Zero), caller);
+
+    Assert.Equal("BIG-2026-000123", referentie);
+    Assert.Equal($"{ZrcBase}/zaken/uuid-new", zaakUrl);
+    Assert.Equal(2, handler.Requests.Count(r => r == $"{ZrcBase}/zaken"));
+  }
+
+  [Fact]
+  public void CreateZaak_gives_up_after_three_attempts_on_a_persistent_transient_failure()
+  {
+    var (options, aanvraag, caller) = CreateZaakFixture();
+    var zaaktypeUrl = options.ZaaktypeUrls["registratie"];
+    var handler = new ZgwStubHandler(
+        url => RespondFor(zaaktypeUrl, url),
+        (url, _) => url == $"{ZrcBase}/zaken" ? HttpStatusCode.ServiceUnavailable : HttpStatusCode.OK);
+    var source = new OpenZaakZaakSource(new HttpClient(handler), new ZgwTokenProvider(options), options);
+
+    var ex = Assert.Throws<HttpRequestException>(() => source.CreateZaak(aanvraag, DateTimeOffset.UtcNow, caller));
+
+    Assert.Contains("503", ex.Message);
+    Assert.Equal(3, handler.Requests.Count(r => r == $"{ZrcBase}/zaken"));
+  }
+
+  [Fact]
+  public void CreateZaak_does_not_retry_a_permanent_rejection()
+  {
+    var (options, aanvraag, caller) = CreateZaakFixture();
+    var zaaktypeUrl = options.ZaaktypeUrls["registratie"];
+    var handler = new ZgwStubHandler(
+        url => RespondFor(zaaktypeUrl, url),
+        (url, _) => url == $"{ZrcBase}/statussen" ? HttpStatusCode.BadRequest : HttpStatusCode.OK);
+    var source = new OpenZaakZaakSource(new HttpClient(handler), new ZgwTokenProvider(options), options);
+
+    Assert.Throws<HttpRequestException>(() => source.CreateZaak(aanvraag, DateTimeOffset.UtcNow, caller));
+
+    // No retry on 400, and — the property that makes the whole design safe — no duplicate
+    // zaak was created by a retry that never should have happened.
+    Assert.Equal(1, handler.Requests.Count(r => r == $"{ZrcBase}/statussen"));
+    Assert.Equal(1, handler.Requests.Count(r => r == $"{ZrcBase}/zaken"));
+  }
 }