Architect-review remediation: enforce conventions, prod-safe tooling, one form idiom, resilience seams
Acts on the showcase review. Four workstreams; all tests green (npm run lint, 70 FE tests, ng build, 33 backend tests). Enforcement + CI: - eslint.config.mjs bans `any` and enforces layer/context boundaries (domain ≠ Angular; herregistratie → registratie → shared, auth → shared); `npm run lint` added; ajv 6 scoped to ESLint via nested override. - .github/workflows/ci.yml: FE lint+check:tokens+test+build, backend dotnet test, and an API-client drift check. One form idiom (the headline finding): - change-request-form converged onto the wizard pattern — change-request.machine.ts (Model/Msg/reduce + value objects) + submit-change-request.ts (Result) + a real POST /api/v1/change-requests (server re-validates). Spec + story added; the detail page no longer holds an ad-hoc success signal. Resilience/observability seam: - api-client.provider.ts: request timeout, X-Correlation-Id, Idempotency-Key for writes; comments naming the retry/auth seams. - Backend logs correlation id + a no-PII submit-audit line; /api/v1 prefix + backward-compat note; client regenerated. Quick wins: - Dev tooling excluded from prod: scenario.interceptor wired only under isDevMode() (?scenario= inert in prod); debug panel @if(isDev) (tree-shaken out). - src/environments + apiBaseUrl into provideApiClient (angular.json fileReplacements). - Backend /health + /health/ready. - Debug view PII-minimised (redactProfile: name/address/DOB redacted, BIG masked). - IntakePolicyAdapter (removes inline resource in the intake wizard). - README de-staled; CLAUDE.md gains EN/NL + forms-one-idiom + lint/CI notes. - Stories: text-input, link, data-row, site-header, site-footer, change-request-form. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This commit is contained in:
@@ -51,7 +51,17 @@ cd backend && dotnet test # rule unit tests + endpoint integration tests
|
||||
| POST | `/api/herregistraties` | submit re-registration → reference, or 422 (0 hours) |
|
||||
| POST | `/api/intakes` | submit intake → reference, or 422 (0 hours) |
|
||||
|
||||
Rejections use **ProblemDetails (RFC 7807)** with status **422**.
|
||||
Rejections use **ProblemDetails (RFC 7807)** with status **422**. Every request
|
||||
carries an `X-Correlation-Id` (set by the FE fetch adapter); the backend echoes it
|
||||
into a no-PII submit-audit log line (`kind`, `outcome`, `reference`, correlation id)
|
||||
— the seam for real structured logging / an audit store.
|
||||
|
||||
### Versioning
|
||||
|
||||
Endpoints live under **`/api/v1`**. Additive changes (a new optional field) stay on
|
||||
v1: the NSwag-generated client and the FE `parse*` boundary ignore unknown fields,
|
||||
so old clients keep working. A breaking change (renamed/removed field, changed
|
||||
semantics) is introduced as **`/api/v2`** served alongside v1 until clients migrate.
|
||||
|
||||
## Where the rules live (`src/BigRegister.Api/Domain/`)
|
||||
|
||||
|
||||
@@ -51,5 +51,6 @@ public sealed record IntakePolicyDto(int ScholingThreshold);
|
||||
public sealed record RegistratieRequest(string DiplomaHerkomst);
|
||||
public sealed record IntakeRequest(int Uren);
|
||||
public sealed record HerregistratieRequest(int Uren);
|
||||
public sealed record ChangeRequestRequest(string Straat, string Postcode, string Woonplaats);
|
||||
|
||||
public sealed record ReferentieResponse(string Referentie);
|
||||
|
||||
@@ -1,3 +1,5 @@
|
||||
using System.Text.RegularExpressions;
|
||||
|
||||
namespace BigRegister.Domain.Submissions;
|
||||
|
||||
/// <summary>
|
||||
@@ -17,6 +19,18 @@ public static class SubmissionRules
|
||||
public static string? RejectZeroUren(int uren) =>
|
||||
uren == 0 ? "Aanvraag afgewezen: geen gewerkte uren geregistreerd." : null;
|
||||
|
||||
private static readonly Regex PostcodePattern =
|
||||
new(@"^[1-9]\d{3}\s?[A-Z]{2}$", RegexOptions.IgnoreCase | RegexOptions.Compiled);
|
||||
|
||||
// RULE: a change request needs a street and a well-formed Dutch postcode. The
|
||||
// server re-validates format authoritatively (the FE check is UX-only).
|
||||
public static string? RejectChangeRequest(string straat, string postcode)
|
||||
{
|
||||
if (string.IsNullOrWhiteSpace(straat)) return "Vul straat en huisnummer in.";
|
||||
if (!PostcodePattern.IsMatch(postcode?.Trim() ?? "")) return "Voer een geldige postcode in, bijv. 1234 AB.";
|
||||
return null;
|
||||
}
|
||||
|
||||
public static string NewReference() =>
|
||||
// ponytail: random reference is fine for a demo; a real system reserves it transactionally.
|
||||
"BIG-2026-" + Random.Shared.Next(100_000, 1_000_000);
|
||||
|
||||
@@ -29,7 +29,13 @@ app.UseSwagger();
|
||||
app.UseSwaggerUI();
|
||||
app.UseCors(SpaCors);
|
||||
|
||||
var api = app.MapGroup("/api");
|
||||
// Liveness/readiness for orchestrators (k8s probes, load balancers). No data, no PII.
|
||||
app.MapGet("/health", () => Results.Ok(new { status = "ok" }));
|
||||
app.MapGet("/health/ready", () => Results.Ok(new { status = "ready" }));
|
||||
|
||||
// Versioned prefix: additive changes (new fields) stay on v1 — the generated client
|
||||
// + FE parse* boundary absorb them; a breaking change introduces /api/v2 alongside.
|
||||
var api = app.MapGroup("/api/v1");
|
||||
|
||||
// --- GET: screen-shaped reads. Decisions are computed here, never on the client. ---
|
||||
|
||||
@@ -58,37 +64,49 @@ api.MapGet("/intake/policy", () => new IntakePolicyDto(IntakePolicy.ScholingThre
|
||||
|
||||
// --- POST: submits. The server is the authority; it re-validates and decides. ---
|
||||
|
||||
api.MapPost("/registrations", (RegistratieRequest req) =>
|
||||
{
|
||||
var reject = SubmissionRules.RejectRegistratie(req.DiplomaHerkomst);
|
||||
return reject is null
|
||||
? Results.Ok(new ReferentieResponse(SubmissionRules.NewReference()))
|
||||
: Results.Problem(detail: reject, statusCode: StatusCodes.Status422UnprocessableEntity);
|
||||
})
|
||||
api.MapPost("/registrations", (RegistratieRequest req, HttpContext ctx) =>
|
||||
Submit(ctx, "registratie", SubmissionRules.RejectRegistratie(req.DiplomaHerkomst)))
|
||||
.Produces<ReferentieResponse>()
|
||||
.ProducesProblem(StatusCodes.Status422UnprocessableEntity);
|
||||
|
||||
api.MapPost("/herregistraties", (HerregistratieRequest req) =>
|
||||
{
|
||||
var reject = SubmissionRules.RejectZeroUren(req.Uren);
|
||||
return reject is null
|
||||
? Results.Ok(new ReferentieResponse(SubmissionRules.NewReference()))
|
||||
: Results.Problem(detail: reject, statusCode: StatusCodes.Status422UnprocessableEntity);
|
||||
})
|
||||
api.MapPost("/herregistraties", (HerregistratieRequest req, HttpContext ctx) =>
|
||||
Submit(ctx, "herregistratie", SubmissionRules.RejectZeroUren(req.Uren)))
|
||||
.Produces<ReferentieResponse>()
|
||||
.ProducesProblem(StatusCodes.Status422UnprocessableEntity);
|
||||
|
||||
api.MapPost("/intakes", (IntakeRequest req) =>
|
||||
{
|
||||
var reject = SubmissionRules.RejectZeroUren(req.Uren);
|
||||
return reject is null
|
||||
? Results.Ok(new ReferentieResponse(SubmissionRules.NewReference()))
|
||||
: Results.Problem(detail: reject, statusCode: StatusCodes.Status422UnprocessableEntity);
|
||||
})
|
||||
api.MapPost("/intakes", (IntakeRequest req, HttpContext ctx) =>
|
||||
Submit(ctx, "intake", SubmissionRules.RejectZeroUren(req.Uren)))
|
||||
.Produces<ReferentieResponse>()
|
||||
.ProducesProblem(StatusCodes.Status422UnprocessableEntity);
|
||||
|
||||
api.MapPost("/change-requests", (ChangeRequestRequest req, HttpContext ctx) =>
|
||||
Submit(ctx, "adreswijziging", SubmissionRules.RejectChangeRequest(req.Straat, req.Postcode)))
|
||||
.Produces<ReferentieResponse>()
|
||||
.ProducesProblem(StatusCodes.Status422UnprocessableEntity);
|
||||
|
||||
app.Run();
|
||||
|
||||
// Audit + outcome for a submit, with NO personal data: only kind, outcome,
|
||||
// generated reference and the caller's correlation id (the observability seam — a
|
||||
// real system ships this to structured logging / an audit store).
|
||||
IResult Submit(HttpContext ctx, string kind, string? reject)
|
||||
{
|
||||
var cid = ctx.Request.Headers.TryGetValue("X-Correlation-Id", out var v) && !string.IsNullOrEmpty(v)
|
||||
? v.ToString()
|
||||
: "none";
|
||||
|
||||
if (reject is not null)
|
||||
{
|
||||
app.Logger.LogInformation("submit kind={Kind} outcome=rejected correlationId={Cid}", kind, cid);
|
||||
return Results.Problem(detail: reject, statusCode: StatusCodes.Status422UnprocessableEntity);
|
||||
}
|
||||
|
||||
var reference = SubmissionRules.NewReference();
|
||||
app.Logger.LogInformation(
|
||||
"submit kind={Kind} outcome=accepted reference={Reference} correlationId={Cid} at={At:o}",
|
||||
kind, reference, cid, DateTimeOffset.UtcNow);
|
||||
return Results.Ok(new ReferentieResponse(reference));
|
||||
}
|
||||
|
||||
// Exposed so the integration tests can spin up the app with WebApplicationFactory.
|
||||
public partial class Program { }
|
||||
|
||||
@@ -5,7 +5,31 @@
|
||||
"version": "v1"
|
||||
},
|
||||
"paths": {
|
||||
"/api/dashboard-view": {
|
||||
"/health": {
|
||||
"get": {
|
||||
"tags": [
|
||||
"BigRegister.Api, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null"
|
||||
],
|
||||
"responses": {
|
||||
"200": {
|
||||
"description": "OK"
|
||||
}
|
||||
}
|
||||
}
|
||||
},
|
||||
"/health/ready": {
|
||||
"get": {
|
||||
"tags": [
|
||||
"BigRegister.Api, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null"
|
||||
],
|
||||
"responses": {
|
||||
"200": {
|
||||
"description": "OK"
|
||||
}
|
||||
}
|
||||
}
|
||||
},
|
||||
"/api/v1/dashboard-view": {
|
||||
"get": {
|
||||
"tags": [
|
||||
"BigRegister.Api, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null"
|
||||
@@ -24,7 +48,7 @@
|
||||
}
|
||||
}
|
||||
},
|
||||
"/api/notes": {
|
||||
"/api/v1/notes": {
|
||||
"get": {
|
||||
"tags": [
|
||||
"BigRegister.Api, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null"
|
||||
@@ -46,7 +70,7 @@
|
||||
}
|
||||
}
|
||||
},
|
||||
"/api/brp/address": {
|
||||
"/api/v1/brp/address": {
|
||||
"get": {
|
||||
"tags": [
|
||||
"BigRegister.Api, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null"
|
||||
@@ -65,7 +89,7 @@
|
||||
}
|
||||
}
|
||||
},
|
||||
"/api/duo/diplomas": {
|
||||
"/api/v1/duo/diplomas": {
|
||||
"get": {
|
||||
"tags": [
|
||||
"BigRegister.Api, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null"
|
||||
@@ -84,7 +108,7 @@
|
||||
}
|
||||
}
|
||||
},
|
||||
"/api/intake/policy": {
|
||||
"/api/v1/intake/policy": {
|
||||
"get": {
|
||||
"tags": [
|
||||
"BigRegister.Api, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null"
|
||||
@@ -103,7 +127,7 @@
|
||||
}
|
||||
}
|
||||
},
|
||||
"/api/registrations": {
|
||||
"/api/v1/registrations": {
|
||||
"post": {
|
||||
"tags": [
|
||||
"BigRegister.Api, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null"
|
||||
@@ -142,7 +166,7 @@
|
||||
}
|
||||
}
|
||||
},
|
||||
"/api/herregistraties": {
|
||||
"/api/v1/herregistraties": {
|
||||
"post": {
|
||||
"tags": [
|
||||
"BigRegister.Api, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null"
|
||||
@@ -181,7 +205,7 @@
|
||||
}
|
||||
}
|
||||
},
|
||||
"/api/intakes": {
|
||||
"/api/v1/intakes": {
|
||||
"post": {
|
||||
"tags": [
|
||||
"BigRegister.Api, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null"
|
||||
@@ -219,6 +243,45 @@
|
||||
}
|
||||
}
|
||||
}
|
||||
},
|
||||
"/api/v1/change-requests": {
|
||||
"post": {
|
||||
"tags": [
|
||||
"BigRegister.Api, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null"
|
||||
],
|
||||
"requestBody": {
|
||||
"content": {
|
||||
"application/json": {
|
||||
"schema": {
|
||||
"$ref": "#/components/schemas/ChangeRequestRequest"
|
||||
}
|
||||
}
|
||||
},
|
||||
"required": true
|
||||
},
|
||||
"responses": {
|
||||
"200": {
|
||||
"description": "OK",
|
||||
"content": {
|
||||
"application/json": {
|
||||
"schema": {
|
||||
"$ref": "#/components/schemas/ReferentieResponse"
|
||||
}
|
||||
}
|
||||
}
|
||||
},
|
||||
"422": {
|
||||
"description": "Unprocessable Content",
|
||||
"content": {
|
||||
"application/problem+json": {
|
||||
"schema": {
|
||||
"$ref": "#/components/schemas/ProblemDetails"
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
},
|
||||
"components": {
|
||||
@@ -271,6 +334,24 @@
|
||||
},
|
||||
"additionalProperties": false
|
||||
},
|
||||
"ChangeRequestRequest": {
|
||||
"type": "object",
|
||||
"properties": {
|
||||
"straat": {
|
||||
"type": "string",
|
||||
"nullable": true
|
||||
},
|
||||
"postcode": {
|
||||
"type": "string",
|
||||
"nullable": true
|
||||
},
|
||||
"woonplaats": {
|
||||
"type": "string",
|
||||
"nullable": true
|
||||
}
|
||||
},
|
||||
"additionalProperties": false
|
||||
},
|
||||
"DashboardViewDto": {
|
||||
"type": "object",
|
||||
"properties": {
|
||||
|
||||
@@ -12,7 +12,7 @@ public class EndpointTests(WebApplicationFactory<Program> factory) : IClassFixtu
|
||||
[Fact]
|
||||
public async Task DashboardView_computes_eligibility_decision()
|
||||
{
|
||||
var dto = await _client.GetFromJsonAsync<DashboardViewDto>("/api/dashboard-view");
|
||||
var dto = await _client.GetFromJsonAsync<DashboardViewDto>("/api/v1/dashboard-view");
|
||||
Assert.NotNull(dto);
|
||||
Assert.Equal("19012345601", dto.Registration.BigNummer);
|
||||
Assert.Equal("Geregistreerd", dto.Registration.Status.Tag);
|
||||
@@ -24,14 +24,14 @@ public class EndpointTests(WebApplicationFactory<Program> factory) : IClassFixtu
|
||||
[Fact]
|
||||
public async Task Notes_returns_seeded_aantekeningen()
|
||||
{
|
||||
var notes = await _client.GetFromJsonAsync<List<AantekeningDto>>("/api/notes");
|
||||
var notes = await _client.GetFromJsonAsync<List<AantekeningDto>>("/api/v1/notes");
|
||||
Assert.Equal(3, notes!.Count);
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public async Task Brp_returns_address()
|
||||
{
|
||||
var dto = await _client.GetFromJsonAsync<BrpAddressDto>("/api/brp/address");
|
||||
var dto = await _client.GetFromJsonAsync<BrpAddressDto>("/api/v1/brp/address");
|
||||
Assert.True(dto!.Gevonden);
|
||||
Assert.Equal("2514 EA", dto.Adres!.Postcode);
|
||||
}
|
||||
@@ -39,7 +39,7 @@ public class EndpointTests(WebApplicationFactory<Program> factory) : IClassFixtu
|
||||
[Fact]
|
||||
public async Task Duo_lookup_carries_server_decided_questions_and_professions()
|
||||
{
|
||||
var dto = await _client.GetFromJsonAsync<DuoLookupDto>("/api/duo/diplomas");
|
||||
var dto = await _client.GetFromJsonAsync<DuoLookupDto>("/api/v1/duo/diplomas");
|
||||
Assert.NotNull(dto);
|
||||
|
||||
var english = dto.Diplomas.Single(d => d.Id == "d2");
|
||||
@@ -59,14 +59,14 @@ public class EndpointTests(WebApplicationFactory<Program> factory) : IClassFixtu
|
||||
[Fact]
|
||||
public async Task IntakePolicy_returns_scholing_threshold()
|
||||
{
|
||||
var dto = await _client.GetFromJsonAsync<IntakePolicyDto>("/api/intake/policy");
|
||||
var dto = await _client.GetFromJsonAsync<IntakePolicyDto>("/api/v1/intake/policy");
|
||||
Assert.Equal(1000, dto!.ScholingThreshold);
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public async Task Registration_with_duo_diploma_succeeds()
|
||||
{
|
||||
var res = await _client.PostAsJsonAsync("/api/registrations", new RegistratieRequest("duo"));
|
||||
var res = await _client.PostAsJsonAsync("/api/v1/registrations", new RegistratieRequest("duo"));
|
||||
res.EnsureSuccessStatusCode();
|
||||
var body = await res.Content.ReadFromJsonAsync<ReferentieResponse>();
|
||||
Assert.StartsWith("BIG-2026-", body!.Referentie);
|
||||
@@ -75,14 +75,14 @@ public class EndpointTests(WebApplicationFactory<Program> factory) : IClassFixtu
|
||||
[Fact]
|
||||
public async Task Registration_with_manual_diploma_is_rejected_with_problem_details()
|
||||
{
|
||||
var res = await _client.PostAsJsonAsync("/api/registrations", new RegistratieRequest("handmatig"));
|
||||
var res = await _client.PostAsJsonAsync("/api/v1/registrations", new RegistratieRequest("handmatig"));
|
||||
Assert.Equal(HttpStatusCode.UnprocessableEntity, res.StatusCode);
|
||||
Assert.Contains("application/problem+json", res.Content.Headers.ContentType!.ToString());
|
||||
}
|
||||
|
||||
[Theory]
|
||||
[InlineData("/api/intakes")]
|
||||
[InlineData("/api/herregistraties")]
|
||||
[InlineData("/api/v1/intakes")]
|
||||
[InlineData("/api/v1/herregistraties")]
|
||||
public async Task Zero_hours_submission_is_rejected(string route)
|
||||
{
|
||||
var res = await _client.PostAsJsonAsync(route, new { uren = 0 });
|
||||
@@ -90,11 +90,36 @@ public class EndpointTests(WebApplicationFactory<Program> factory) : IClassFixtu
|
||||
}
|
||||
|
||||
[Theory]
|
||||
[InlineData("/api/intakes")]
|
||||
[InlineData("/api/herregistraties")]
|
||||
[InlineData("/api/v1/intakes")]
|
||||
[InlineData("/api/v1/herregistraties")]
|
||||
public async Task Worked_hours_submission_succeeds(string route)
|
||||
{
|
||||
var res = await _client.PostAsJsonAsync(route, new { uren = 40 });
|
||||
res.EnsureSuccessStatusCode();
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public async Task Change_request_with_valid_address_succeeds()
|
||||
{
|
||||
var res = await _client.PostAsJsonAsync("/api/v1/change-requests",
|
||||
new { straat = "Lange Voorhout 9", postcode = "2514 EA", woonplaats = "Den Haag" });
|
||||
res.EnsureSuccessStatusCode();
|
||||
var body = await res.Content.ReadFromJsonAsync<ReferentieResponse>();
|
||||
Assert.StartsWith("BIG-2026-", body!.Referentie);
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public async Task Change_request_with_bad_postcode_is_rejected()
|
||||
{
|
||||
var res = await _client.PostAsJsonAsync("/api/v1/change-requests",
|
||||
new { straat = "Straat 1", postcode = "nope", woonplaats = "Den Haag" });
|
||||
Assert.Equal(HttpStatusCode.UnprocessableEntity, res.StatusCode);
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public async Task Health_endpoint_is_ok()
|
||||
{
|
||||
var res = await _client.GetAsync("/health");
|
||||
res.EnsureSuccessStatusCode();
|
||||
}
|
||||
}
|
||||
|
||||
@@ -114,4 +114,11 @@ public class SubmissionRuleTests
|
||||
[Fact]
|
||||
public void Worked_hours_are_accepted() =>
|
||||
Assert.Null(SubmissionRules.RejectZeroUren(40));
|
||||
|
||||
[Theory]
|
||||
[InlineData("Lange Voorhout 9", "2514 EA", null)] // valid
|
||||
[InlineData("", "2514 EA", "Vul straat en huisnummer in.")]
|
||||
[InlineData("Straat 1", "nope", "Voer een geldige postcode in, bijv. 1234 AB.")]
|
||||
public void Change_request_is_validated(string straat, string postcode, string? expected) =>
|
||||
Assert.Equal(expected, SubmissionRules.RejectChangeRequest(straat, postcode));
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user