eho and Claude Opus 4.8
5cae44f163
feat(security): ABAC P2/P3-lite — BIG-nummer redaction, authz audit, guard; clear dev audit
...
- fix(deps): pin @babel/core ^7.29.7 via overrides → npm audit 0 (dev+prod),
no --force / no Angular downgrade; README corrected
- feat(brief): field-level PII reveal (PRD-0002 §5c) — CaseContext BIG-nummer
ships masked; step-up-stubbed (X-Step-Up), audited POST /brief/reveal-bignummer
unmasks it; drafter-only capability, deny-by-default. Realized on the BIG-nummer
(no BSN on the wire)
- feat(authz): no-PII AuditAuthz log for reveal attempts + org-admin denials (§8)
- feat(routes): wire capabilityGuard('orgtemplate:edit') onto brief/huisstijl (§6)
- test: backend +5 (Authz + reveal endpoint), FE +3 (adapter boundary, store swap)
- docs: PRD-0002 §5c/§9, WP-18 follow-up, README
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com >
2026-07-20 19:59:20 +02:00
eho and Claude Opus 4.8
e82309786d
style: format frontend, docs and skills with prettier; add .prettierignore
...
One-time prettier --write so the new format:check CI gate starts green.
.prettierignore excludes generated (api-client.ts, documentation.json),
vendored (public/cibg-huisstijl), and backend (dotnet format owns it).
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com >
2026-07-03 13:39:31 +02:00
eho and Claude Opus 4.8
7887355ca3
docs(prd): add PRD-0002 — attribute-based access control (ABAC)
...
Specifies fine-grained, app-owned access control layered on the AD roles: capability
gating, data-scoping, field/PII-level, and step-up/SoD. Backend-authoritative (per
ADR-0001), UI mirrors decisions; extends ADR-0002. Privacy-by-design: data-minimized
decision DTOs, server-side PII redaction, audit, deny-by-default.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com >
2026-07-02 12:33:12 +02:00
ehoandClaude Opus 4.8