3 Commits

Include renames

Author	SHA1	Message	Date
ehoandClaude Opus 5	8b8b522052	fix(auth): make no-identity representable; stub dev-only (RB-09) ... IIdentityProvider.Resolve returned a non-nullable CallerIdentity, so the interface could not express "no identity" - StubIdentityProvider was forced to invent one for any request carrying no credential at all. Consequence: a production behandelportal build sends no X-Medewerker header (medewerkerInterceptor is dev-only), so it used to authenticate as the seeded citizen, role drafter - failing closed on backoffice capabilities but open on every citizen-scoped endpoint, including CanRevealBigNummer. Resolve now returns CallerIdentity?. StubIdentityProvider keeps a non-nullable return type (a valid narrower override) since it never itself has "no identity" to report - it is registered only under IsDevelopment() now. Production registers nothing and throws an InvalidOperationException immediately during startup instead: there is no real DigiD/employee-SSO provider in this POC yet, so a misconfigured Production deploy must fail before serving a single request, not resolve one per request. The identity-resolution middleware turns a null resolution into a 401 rather than passing it downstream. Added StubIdentityProviderTests.Never_returns_null_even_with_no_headers_at_all and ProductionIdentityProviderTests, which builds its own WebApplicationFactory<Program> with UseEnvironment("Production") and asserts startup throws. Verified both new tests fail red against the pre-fix code. RB-01's residual (GET /uploads/{id}/content reached via plain browser navigation, no identity header) is confirmed unchanged in Development and its Production consequence is written up in implementation/rb-09.md for whoever lands the real identity provider - no signed-URL/cookie scheme was designed here, per scope. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>	2026-08-27 14:06:49 +02:00
ehoandClaude Sonnet 5	a09c4ed87b	feat(behandelportal): WP-62 medewerker caller identity + authz seam ... Splits backend CallerIdentity into the two ADR-0002 §3 actor kinds (ZorgverlenerCaller/MedewerkerCaller), a stub X-Medewerker/X-Rollen header path mirroring WP-53's citizen stub, and Authz.CanBeoordelen as the first medewerker capability — backend-only, no consumer until WP-64. Also fixes the backlog README's stale WP-61 status (done, but table said todo). Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>	2026-07-31 23:47:43 +02:00
ehoandClaude Sonnet 5	73172510ea	feat(zgw): real per-request identity seam + citizen-scoping (WP-53) ... Replaces the hardcoded DocumentStore.DemoOwner and the static ZgwOptions UserId/UserRepresentation with one per-request CallerIdentity, resolved by a pluggable IIdentityProvider (StubIdentityProvider reads X-Role/X-Subject today; a real OIDC/DigiD provider swaps in without touching any consumer). - Domain/Authorization/{CallerIdentity,IIdentityProvider,StubIdentityProvider}.cs + a resolution middleware in Program.cs, right after correlation-id. - Authz.ResolvePrincipal(ctx) keeps its signature (now reads ctx.Caller().Role), so its ~15 call sites needed no changes. - Every endpoint that passed DocumentStore.DemoOwner to a store now passes ctx.Caller().Bsn. - ZgwTokenProvider gains Mint(CallerIdentity) alongside the original Mint() (kept for calls not tied to one citizen); ZgwHttpClient threads an optional caller through to pick the right overload. - IZaakSource gains ListMyCases(caller, now) — the citizen-scoped read OpenZaakZaakSource backs with ZGW's rol__...__inpBsn filter. GET /applications now routes through it instead of ApplicationStore directly, closing the last "reads a static store" gap for a citizen-facing endpoint. Backend 159/159 tests (+8, incl. an HTTP-level two-identity scoping proof), npm run ci green, no api-client drift. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>	2026-07-30 08:27:53 +02:00