refactor: strip WP-/RB- ticket refs from backend (RD-19)

The backend half of the sweep RD-18 did for the front end. git blame
holds the provenance and stays correct when the code moves; the
comment names a closed ticket and tells the reader nothing the
sentence around it does not.

public/letter.css and LetterHtml.golden.html change together, because
the renderer inlines the CSS and the golden file snapshots the
result.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
This commit is contained in:
eho
2026-09-04 21:48:08 +02:00
co-authored by Claude Sonnet 5
parent dd11eafe50
commit 8560746d15
89 changed files with 530 additions and 380 deletions
@@ -14,7 +14,7 @@ public class AanvraagTests(TestWebApplicationFactory factory) : IClassFixture<Te
private async Task<AanvraagDetailDto> Create(string type = "registratie")
{
// WP-35: one Concept per type is now server-enforced, and these tests share one DB
// One Concept per type is now server-enforced, and these tests share one DB
// (IClassFixture). Clear any leftover Concept so each test starts from a clean slate.
var existing = await List();
Assert.NotNull(existing);
@@ -103,7 +103,7 @@ public class AanvraagTests(TestWebApplicationFactory factory) : IClassFixture<Te
Assert.Equal(HttpStatusCode.Conflict, again.StatusCode);
}
// --- WP-35: one Concept per case type (server-enforced) ---
// --- One Concept per case type (server-enforced) ---
[Fact]
public async Task Creating_a_second_concept_of_the_same_type_conflicts()
@@ -146,7 +146,7 @@ public class AanvraagTests(TestWebApplicationFactory factory) : IClassFixture<Te
Assert.Equal(HttpStatusCode.Conflict, (await _client.DeleteAsync($"/api/v1/aanvragen/{a.Id}")).StatusCode);
}
// --- WP-53: citizen-scoping — GET /aanvragen must never leak across identities. ---
// --- Citizen-scoping — GET /aanvragen must never leak across identities. ---
[Fact]
public async Task Applications_are_scoped_to_the_caller_bsn()
@@ -181,7 +181,7 @@ public class AanvraagTests(TestWebApplicationFactory factory) : IClassFixture<Te
}
}
// --- WP-68 (F1): a citizen may only reference their own uploads — submit/draft-sync must
// --- A citizen may only reference their own uploads — submit/draft-sync must
// reject a foreign documentId rather than silently attaching it. ---
private static async Task<UploadResponse> UploadAs(HttpClient client, string owner, string localId)