fix(brief): keep the dev hatches out of production builds (RB-11)

BIO-012: roleInterceptor/subjectInterceptor are correctly registered only under isDevMode(), but three hand-written fetch adapters (reveal-bignummer, letter-preview, org-template's proefbrief) bypass HttpClient and set X-Role/X-Subject themselves with no guard. The readers underneath, role.ts and subject.ts, were ungated too: they read ?role=/?subject= and wrote it into sessionStorage on any navigation, in any build -- for ?subject= that value is a BSN, which is exactly what SessionStore's G1 comment promises never happens. Gate both layers: currentRole()/currentSubject() return their safe default immediately outside isDevMode() (no query-param read, no sessionStorage write), and the three adapters additionally wrap their headers in isDevMode() so a production request carries neither header at all, matching what an HttpClient request already does once the interceptors aren't registered. TE-002: reveal-bignummer's response-shape validation was a "Trust boundary" a spec could only reach by stubbing globalThis.fetch. Exported it as parseRevealed(body), matching the other 30 parse* boundaries in the repo. Same treatment for letter-preview's errorMessage and org-template's proefbrief error mapping (extracted from an inline try/catch into a named, exported function first, since it wasn't already separate). BIO-006(a): reveal-bignummer sent X-Step-Up: 'true' unconditionally, so the backend's step-up precondition constrained nothing. reveal() now takes a stepUp flag; BriefStore.revealBigNummer() -- reachable only after the UI's confirm() gesture -- is the one that supplies it, so the literal no longer lives in the transport adapter. BIO-006(b): documented in roles-and-access.md that drafter is also the backend's fallback identity (StubIdentityProvider's catch-all arm), not just the dev switcher's initial choice -- so the least-privilege consequence of it also being the only role that may reveal a BSN is visible. Doc correction, same diff: roles-and-access.md's "wired only under isDevMode()" claim was false for the three hand-written fetch paths; it now says where the gate lives (interceptor registration and the reader functions) so it doesn't go stale the same way again. CLAUDE.md's dev-only claims needed no correction -- they already noted these three calls bypass the interceptor. Every fix has a test confirmed red by temporarily reverting the source change and rerunning the suite before restoring it. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-08-27 14:20:47 +02:00
parent ae7781efef
commit 772c47ea43
14 changed files with 632 additions and 37 deletions
@@ -0,0 +1,69 @@
+import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest';
+import { errorMessage, PREVIEW_FAILED, LetterPreviewAdapter } from './letter-preview.adapter';
+
+// Minimal Response stand-in — errorMessage only calls `.json()`. Avoids stubbing
+// globalThis.fetch to reach this trust boundary (TE-002).
+const fakeResponse = (body: unknown): Response =>
+  ({ json: () => Promise.resolve(body) }) as unknown as Response;
+
+describe('errorMessage (TE-002 trust boundary)', () => {
+  it('surfaces the ProblemDetails detail when present', async () => {
+    expect(await errorMessage(fakeResponse({ detail: 'Geen toegang.', status: 403 }))).toBe(
+      'Geen toegang.',
+    );
+  });
+
+  it('falls back to PREVIEW_FAILED when the body has no detail', async () => {
+    expect(await errorMessage(fakeResponse({ status: 500 }))).toBe(PREVIEW_FAILED);
+  });
+
+  it('falls back to PREVIEW_FAILED when the body is not JSON', async () => {
+    const res = { json: () => Promise.reject(new Error('not json')) } as unknown as Response;
+    expect(await errorMessage(res)).toBe(PREVIEW_FAILED);
+  });
+});
+
+// isDevMode() reads the `ngDevMode` global the Angular CLI defines away in a
+// production build. There is no ambient type for it in app code, so this is
+// accessed through an untyped bag rather than a `declare const`.
+const globals = globalThis as Record<string, unknown>;
+const originalNgDevMode = globals['ngDevMode'];
+const setDevMode = (on: boolean) => {
+  globals['ngDevMode'] = on;
+};
+
+describe('LetterPreviewAdapter.preview (BIO-012)', () => {
+  const okResponse = () =>
+    ({ ok: true, blob: () => Promise.resolve(new Blob()) }) as unknown as Response;
+
+  afterEach(() => {
+    globals['ngDevMode'] = originalNgDevMode;
+    vi.unstubAllGlobals();
+    history.pushState({}, '', '/');
+    sessionStorage.clear();
+  });
+
+  it('sends no X-Role/X-Subject headers outside isDevMode()', async () => {
+    setDevMode(false);
+    history.pushState({}, '', '/?subject=111222333');
+    const fetchSpy = vi.fn().mockResolvedValue(okResponse());
+    vi.stubGlobal('fetch', fetchSpy);
+
+    await new LetterPreviewAdapter().preview();
+
+    expect(fetchSpy.mock.calls[0][1].headers).toEqual({});
+  });
+
+  it('sends X-Role (and X-Subject when known) under isDevMode()', async () => {
+    setDevMode(true);
+    history.pushState({}, '', '/?subject=111222333');
+    const fetchSpy = vi.fn().mockResolvedValue(okResponse());
+    vi.stubGlobal('fetch', fetchSpy);
+
+    await new LetterPreviewAdapter().preview();
+
+    const headers = fetchSpy.mock.calls[0][1].headers as Record<string, string>;
+    expect(headers['X-Role']).toBeDefined();
+    expect(headers['X-Subject']).toBe('111222333');
+  });
+});