3 Commits

Include renames

Author	SHA1	Message	Date
eho	67abc58052	feat(openzaak): per-document-type confidentialiteit config (WP-59) ... Drives the DRC upload's vertrouwelijkheidaanduiding from a new stamdata table instead of the hardcoded "openbaar", following the existing config-as-code pattern (ADR-0004). Adds the referential-integrity check StamdataValidationTests was missing for the new table.	2026-07-30 17:30:25 +02:00
ehoandClaude Sonnet 5	73172510ea	feat(zgw): real per-request identity seam + citizen-scoping (WP-53) ... Replaces the hardcoded DocumentStore.DemoOwner and the static ZgwOptions UserId/UserRepresentation with one per-request CallerIdentity, resolved by a pluggable IIdentityProvider (StubIdentityProvider reads X-Role/X-Subject today; a real OIDC/DigiD provider swaps in without touching any consumer). - Domain/Authorization/{CallerIdentity,IIdentityProvider,StubIdentityProvider}.cs + a resolution middleware in Program.cs, right after correlation-id. - Authz.ResolvePrincipal(ctx) keeps its signature (now reads ctx.Caller().Role), so its ~15 call sites needed no changes. - Every endpoint that passed DocumentStore.DemoOwner to a store now passes ctx.Caller().Bsn. - ZgwTokenProvider gains Mint(CallerIdentity) alongside the original Mint() (kept for calls not tied to one citizen); ZgwHttpClient threads an optional caller through to pick the right overload. - IZaakSource gains ListMyCases(caller, now) — the citizen-scoped read OpenZaakZaakSource backs with ZGW's rol__...__inpBsn filter. GET /applications now routes through it instead of ApplicationStore directly, closing the last "reads a static store" gap for a citizen-facing endpoint. Backend 159/159 tests (+8, incl. an HTTP-level two-identity scoping proof), npm run ci green, no api-client drift. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>	2026-07-30 08:27:53 +02:00
ehoandClaude Sonnet 5	5807937229	feat(zgw): OpenZaak Documenten (DRC) upload + zaak link (WP-51) ... Extends the OpenZaak seam with IDocumentSource, sibling of IZaakSource (WP-49/50): an upload always lands locally first (DocumentStore stays the record of truth for preview/download/audit) and, when Zgw:Enabled=true, is also registered as a DRC enkelvoudiginformatie- object; once a zaak exists (IZaakSource.CreateZaak now also returns its ZaakUrl), submit links each document to it via zaakinformatie- object. FE upload/list DTOs are unchanged. - ZgwOptions gains DrcBaseUrl + a category->informatieobjecttype URL map (the document analogue of ZaaktypeUrls). - LocalDocumentSource is the same DocumentStore.Add/Link calls the endpoints used to make inline — zero behaviour change offline. - OpenZaakDocumentSource POSTs the eio then the zaak link, persisting the DRC url (DocumentStore.SetDrcUrl) so linking doesn't re-upload. - Factored the GET/POST-with-bearer-JWT plumbing shared with OpenZaakZaakSource into ZgwHttpClient; shared the stub handler between the two source test classes as ZgwStubHandler. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>	2026-07-29 20:54:31 +02:00