feat(security): ABAC P2/P3-lite — BIG-nummer redaction, authz audit, guard; clear dev audit

- fix(deps): pin @babel/core ^7.29.7 via overrides → npm audit 0 (dev+prod),
  no --force / no Angular downgrade; README corrected
- feat(brief): field-level PII reveal (PRD-0002 §5c) — CaseContext BIG-nummer
  ships masked; step-up-stubbed (X-Step-Up), audited POST /brief/reveal-bignummer
  unmasks it; drafter-only capability, deny-by-default. Realized on the BIG-nummer
  (no BSN on the wire)
- feat(authz): no-PII AuditAuthz log for reveal attempts + org-admin denials (§8)
- feat(routes): wire capabilityGuard('orgtemplate:edit') onto brief/huisstijl (§6)
- test: backend +5 (Authz + reveal endpoint), FE +3 (adapter boundary, store swap)
- docs: PRD-0002 §5c/§9, WP-18 follow-up, README

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

backend/src/BigRegister.Api/Contracts/Dtos.cs

@@ -153,7 +153,9 @@ public sealed record BriefDto(
 
 // Decision flags for the CURRENT acting principal + this brief's live status
 // (PRD-0002 phase P1) — the FE renders these, it never recomputes them.
-public sealed record BriefDecisionsDto(bool CanEdit, bool CanApprove, bool CanReject, bool CanSend);
+// CanRevealBigNummer (PRD-0002 §5c): whether the acting principal may unmask the
+// BIG-nummer the case screen ships masked. Status-independent, unlike the action gates.
+public sealed record BriefDecisionsDto(bool CanEdit, bool CanApprove, bool CanReject, bool CanSend, bool CanRevealBigNummer);
 
 // The brief's screen DTO also carries the org template it renders with (WP-23):
 // the sub-org's current PUBLISHED version — or, once sent, the version pinned at
@@ -169,6 +171,9 @@ public sealed record BriefViewDto(
 
 public sealed record SaveBriefRequest(IReadOnlyList<LetterSectionDto> Sections);
 public sealed record RejectBriefRequest(string Comments);
+// The unmasked BIG-nummer, returned only from the audited + step-up-gated reveal
+// endpoint (PRD-0002 §5c). Never logged.
+public sealed record RevealBigNummerResponse(string BigNummer);
 
 // PRD-0002 §6: coarse, role-derived capabilities for nav/menu-level checks.
 public sealed record MeDto(IReadOnlyList<string> Capabilities);

backend/src/BigRegister.Api/Domain/Authorization/Authz.cs

@@ -64,6 +64,14 @@ public static class Authz
   /// have no per-resource state to weigh, so role IS the whole decision here.
   public static bool CanManageOrgTemplates(Principal principal) => principal.Role == PrincipalRole.Admin;
 
+  /// Field-level PII (PRD-0002 §5c, phase P2): the case screen's BIG-nummer ships
+  /// masked by default; only the behandelaar (Drafter) composing the case — the actor
+  /// whose behandel-scherm shows the field — may reveal it. Role-based in the POC; a
+  /// real system resolves it from the app overlay independent of role. The reveal itself
+  /// is additionally step-up-gated + audited at the endpoint. (Illustrated on the
+  /// BIG-nummer because no BSN travels the wire — see PRD note.)
+  public static bool CanRevealBigNummer(Principal principal) => principal.Role == PrincipalRole.Drafter;
+
   /// Resource-aware decision for the screen DTO: "would this action succeed right
   /// now" — role/SoD AND the brief's current status. This is what the UI renders;
   /// it never re-derives these booleans itself.
@@ -71,5 +79,7 @@ public static class Authz
       CanEdit: principal.Role == PrincipalRole.Drafter && status is "draft" or "rejected",
       CanApprove: CanActOn(BriefAction.Approve, principal, drafterId) && status == "submitted",
       CanReject: CanActOn(BriefAction.Reject, principal, drafterId) && status == "submitted",
-      CanSend: CanActOn(BriefAction.Send, principal, drafterId) && status == "approved");
+      CanSend: CanActOn(BriefAction.Send, principal, drafterId) && status == "approved",
+      // PII reveal is status-independent (§5c) — unlike the action gates above.
+      CanRevealBigNummer: CanRevealBigNummer(principal));
 }

backend/src/BigRegister.Api/Program.cs

@@ -346,6 +346,30 @@ api.MapPost("/brief/send", (HttpContext ctx) =>
 .Produces<BriefViewDto>()
 .ProducesProblem(StatusCodes.Status409Conflict);
 
+// Field-level PII reveal (PRD-0002 §5c/§5d, phase P2): the case screen ships the
+// BIG-nummer masked (see ToView). Unmasking requires the reveal capability AND a
+// step-up (stubbed here as the X-Step-Up header); every attempt — allow or deny — is
+// audited with NO PII (AuditAuthz). The unmasked value is returned only on allow,
+// and never written to a log line.
+api.MapPost("/brief/reveal-bignummer", (HttpContext ctx) =>
+{
+  var principal = Authz.ResolvePrincipal(ctx);
+  var canReveal = Authz.CanRevealBigNummer(principal);
+  var steppedUp = ctx.Request.Headers["X-Step-Up"] == "true";
+  var allowed = canReveal && steppedUp;
+  AuditAuthz(ctx, "brief:reveal-bignummer", "brief/" + DocumentStore.DemoOwner, allowed, principal);
+  if (!allowed)
+    return Results.Problem(
+        detail: canReveal
+            ? "Aanvullende verificatie vereist om het BIG-nummer te tonen."
+            : "U mag het BIG-nummer niet inzien.",
+        statusCode: StatusCodes.Status403Forbidden);
+  return Results.Ok(new RevealBigNummerResponse(SeedData.Registration.BigNummer));
+})
+// Hand-written fetch on the FE (needs a per-call X-Step-Up header) — excluded from the
+// OpenAPI doc, same seam as /brief/preview and uploads.
+.ExcludeFromDescription();
+
 // Server-rendered HTML preview (WP-25): "what you compose is what is sent" — the
 // same LetterHtml.Render a sent brief archived. Hand-written on the FE (fetch →
 // blob → new tab), so excluded from the OpenAPI doc, same seam as uploads. Sent
@@ -435,12 +459,34 @@ app.Run();
 static bool IsAdmin(HttpContext ctx) => ctx.Request.Headers["X-Admin"] == "true";
 
 // One gate for every org-template endpoint — the enforce twin of the
-// `orgtemplate:edit` capability RoleCapabilities emits (single Authz source).
-static IResult OrgAdmin(HttpContext ctx, Func<IResult> action) =>
-    Authz.CanManageOrgTemplates(Authz.ResolvePrincipal(ctx))
-        ? action()
-        : Results.Problem(detail: "Alleen een beheerder mag organisatiesjablonen beheren.",
-            statusCode: StatusCodes.Status403Forbidden);
+// `orgtemplate:edit` capability RoleCapabilities emits (single Authz source). A denial
+// is audited (PRD-0002 §8); the allow path is left un-logged (the endpoints log their
+// own effect, e.g. publish).
+IResult OrgAdmin(HttpContext ctx, Func<IResult> action)
+{
+  var principal = Authz.ResolvePrincipal(ctx);
+  if (Authz.CanManageOrgTemplates(principal)) return action();
+  AuditAuthz(ctx, "orgtemplate:edit", "org-templates", false, principal);
+  return Results.Problem(detail: "Alleen een beheerder mag organisatiesjablonen beheren.",
+      statusCode: StatusCodes.Status403Forbidden);
+}
+
+// Authorization audit (PRD-0002 §8): access-relevant decisions recorded with NO PII —
+// action, resource ref, allow/deny, acting role, correlation id. Never the value that
+// was (or wasn't) revealed. Mirrors the no-PII Submit audit below.
+void AuditAuthz(HttpContext ctx, string action, string resource, bool allowed, Principal principal)
+{
+  var cid = ctx.Items.TryGetValue("CorrelationId", out var v) ? (string)v! : "none";
+  app.Logger.LogInformation(
+      "authz action={Action} resource={Resource} decision={Decision} role={Role} correlationId={Cid}",
+      action, resource, allowed ? "allow" : "deny", principal.Role, cid);
+}
+
+// Keep the last `keep` characters, mask the rest — mirrors the FE maskTail
+// (src/app/shared/ui/debug-state/mask.ts) so wire redaction and the dev panel agree.
+static string MaskTail(string value, int keep) =>
+    value.Length <= keep ? new string('*', value.Length)
+                         : new string('*', value.Length - keep) + value[^keep..];
 
 static string Now() => DateTimeOffset.UtcNow.ToString("o");
 
@@ -453,7 +499,9 @@ BriefViewDto ToView(HttpContext ctx, BriefEntity e) => new(
     OrgTemplateStore.TemplateForBrief(e.SubOrgId, e.Status.Tag == "sent" ? e.SentOrgTemplateVersion : null),
     // The case this letter is about — joined from the seeded zorgverlener so the
     // behandel scherm can show whom/what it concerns without brief/ importing registratie.
-    new CaseContextDto(SeedData.Registration.Naam, SeedData.Registration.BigNummer, e.Beroep, BriefSeed.AanvraagReferentie));
+    // The BIG-nummer ships MASKED by default (PRD-0002 §5c, field-level PII); the reveal
+    // endpoint returns the full value, gated + audited.
+    new CaseContextDto(SeedData.Registration.Naam, MaskTail(SeedData.Registration.BigNummer, 3), e.Beroep, BriefSeed.AanvraagReferentie));
 
 // Emit (decision flags, via ToView) and enforce (Forbidden/Conflict below) both run
 // through Authz — see BriefStore.Review and Authz.CanActOn — so they cannot drift.

backend/swagger.json

@@ -1295,6 +1295,9 @@
           },
           "canSend": {
             "type": "boolean"
+          },
+          "canRevealBigNummer": {
+            "type": "boolean"
           }
         },
         "additionalProperties": false

backend/tests/BigRegister.Tests/AuthzTests.cs

@@ -65,4 +65,20 @@ public class AuthzTests
     Assert.Empty(Authz.RoleCapabilities(Drafter));
     Assert.Equal(new[] { "brief:approve", "brief:reject", "brief:send" }, Authz.RoleCapabilities(Approver));
   }
+
+  [Fact]
+  public void CanRevealBigNummer_only_for_the_case_drafter_behandelaar()
+  {
+    Assert.True(Authz.CanRevealBigNummer(Drafter));
+    Assert.False(Authz.CanRevealBigNummer(Approver));
+  }
+
+  [Fact]
+  public void Decisions_CanRevealBigNummer_is_status_independent()
+  {
+    // Unlike the action gates, PII reveal does not depend on the brief's status.
+    Assert.True(Authz.Decisions(Drafter, "draft", DrafterId).CanRevealBigNummer);
+    Assert.True(Authz.Decisions(Drafter, "sent", DrafterId).CanRevealBigNummer);
+    Assert.False(Authz.Decisions(Approver, "draft", DrafterId).CanRevealBigNummer);
+  }
 }

backend/tests/BigRegister.Tests/BriefEndpointTests.cs

@@ -68,12 +68,48 @@ public class BriefEndpointTests(TestWebApplicationFactory factory) : IClassFixtu
     Assert.Contains(view.AvailablePassages, p => p.Besluit == "negatief" && p.Reason == "onvoldoende_scholing");
 
     // Case context is joined onto the screen DTO for the behandel scherm header.
-    Assert.Equal("19012345601", view.CaseContext.BigNummer);
+    // The BIG-nummer ships MASKED by default (PRD-0002 §5c) — reveal is a separate call.
+    Assert.Equal("********601", view.CaseContext.BigNummer);
     Assert.Equal("arts", view.CaseContext.Beroep);
     Assert.False(string.IsNullOrWhiteSpace(view.CaseContext.ZorgverlenerNaam));
     Assert.False(string.IsNullOrWhiteSpace(view.CaseContext.AanvraagReferentie));
   }
 
+  // --- Field-level PII reveal (PRD-0002 §5c/§5d, phase P2) ---
+
+  [Fact]
+  public async Task Reveal_returns_the_unmasked_BIG_nummer_for_the_drafter_with_step_up()
+  {
+    BriefStore.Reset();
+    var req = new HttpRequestMessage(HttpMethod.Post, "/api/v1/brief/reveal-bignummer");
+    req.Headers.Add("X-Step-Up", "true"); // no X-Role → drafter (the capable role)
+    var res = await _client.SendAsync(req);
+
+    Assert.Equal(HttpStatusCode.OK, res.StatusCode);
+    var body = await res.Content.ReadFromJsonAsync<RevealBigNummerResponse>();
+    Assert.Equal("19012345601", body!.BigNummer);
+  }
+
+  [Fact]
+  public async Task Reveal_is_forbidden_without_the_step_up()
+  {
+    BriefStore.Reset();
+    var req = new HttpRequestMessage(HttpMethod.Post, "/api/v1/brief/reveal-bignummer"); // drafter, no step-up
+    var res = await _client.SendAsync(req);
+    Assert.Equal(HttpStatusCode.Forbidden, res.StatusCode);
+  }
+
+  [Fact]
+  public async Task Reveal_is_forbidden_for_a_role_without_the_capability()
+  {
+    BriefStore.Reset();
+    var req = new HttpRequestMessage(HttpMethod.Post, "/api/v1/brief/reveal-bignummer");
+    req.Headers.Add("X-Role", "approver");
+    req.Headers.Add("X-Step-Up", "true"); // capability missing → still denied
+    var res = await _client.SendAsync(req);
+    Assert.Equal(HttpStatusCode.Forbidden, res.StatusCode);
+  }
+
   [Fact]
   public async Task Save_is_drafter_only()
   {