4 Commits

Include renames

Author	SHA1	Message	Date
ehoandClaude Opus 4.8	5cae44f163	feat(security): ABAC P2/P3-lite — BIG-nummer redaction, authz audit, guard; clear dev audit ... - fix(deps): pin @babel/core ^7.29.7 via overrides → npm audit 0 (dev+prod), no --force / no Angular downgrade; README corrected - feat(brief): field-level PII reveal (PRD-0002 §5c) — CaseContext BIG-nummer ships masked; step-up-stubbed (X-Step-Up), audited POST /brief/reveal-bignummer unmasks it; drafter-only capability, deny-by-default. Realized on the BIG-nummer (no BSN on the wire) - feat(authz): no-PII AuditAuthz log for reveal attempts + org-admin denials (§8) - feat(routes): wire capabilityGuard('orgtemplate:edit') onto brief/huisstijl (§6) - test: backend +5 (Authz + reveal endpoint), FE +3 (adapter boundary, store swap) - docs: PRD-0002 §5c/§9, WP-18 follow-up, README Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>	2026-07-20 19:59:20 +02:00
ehoandClaude Sonnet 5	5d6a78d4ec	docs(backlog): record WP-18 commit hash ... Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>	2026-07-03 20:32:03 +02:00
ehoandClaude Sonnet 5	7ec13d8b59	feat(brief): WP-18 — ABAC capability spine (PRD-0002 phase P1) ... Replace the FE-computed authorization anti-pattern in BriefStore.editable (derived from the unverified X-Role header) with server-computed decision flags, mirroring the existing HerregistratieDecisionsDto pattern: - Backend: Authz.cs is the single authorization helper — the SAME check (Authz.CanActOn) both gates BriefStore.Review's mutations and computes the BriefDecisionsDto flags shipped on every brief response, so emit and enforce can never drift. New GET /me returns coarse, role-derived capabilities (PRD-0002 SS6). - Every brief endpoint (including send, previously ungated on HttpContext) now returns a fresh BriefViewDto so decisions never go stale after a mutation. - FE: brief.store.ts reads canEdit/canApprove/canReject/canSend off the loaded decisions instead of computing them from currentRole(); the brief.machine carries decisions through every status transition. - New shared/domain/capability.ts + shared/application/access.store.ts + shared/infrastructure/me.adapter.ts: the general capability-spine infrastructure (AccessStore.can(), capabilityGuard) for future routes. Deviates from the original WP-18 draft by NOT renaming auth/domain's Session to a Principal union — ADR-0002 explicitly defers that refactor until a second actor exists, and the brief workflow's drafter/approver identity turned out to be a separate axis from the SSP login session entirely. See docs/backlog/WP-18-abac-capability-spine.md for the full as-built record. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>	2026-07-03 20:31:53 +02:00
ehoandClaude Sonnet 5	cbb8ae548c	docs(backlog): add WP-18..22 (productie-volwassenheid phase) ... Gap analysis found the POC's designed-but-unbuilt strategic gaps: ABAC authorization (ADR-0002/PRD-0002 phase P1), no e2e coverage, unproven i18n second-locale seam, thin resilience seams (correlation-id, idempotency, retry), and in-memory-only persistence. Each WP is grounded in the current code (file paths + line numbers), not just the analysis. Also corrects PRD-0001's stale 'Proposed' status header — the Mijn aanvragen vertical is fully built. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>	2026-07-03 20:07:05 +02:00