Files

T

ehoandClaude Opus 4.8 62cb34b60f feat(privacy): WP-40 — PII kernel (Bsn value object + masked-value atom)

Branded Bsn value object with the elfproef (11-test) checksum in shared/kernel/bsn.ts,
wired into the DigiD login boundary so login does real BSN validation (hint + e2e BSNs
updated to a valid 123456782). Consolidate the pure maskers into shared/kernel/pii.ts
(maskBsn/maskTail/REDACTED); debug-state keeps redactProfile (needs the registratie
BigProfile — boundary). New <app-masked-value> atom (+story) centralises the masked
`.includes('*')` detection + reveal affordance; behandel-scherm refactored onto it.
Session.bsn stays string (persistence boundary drops it for privacy). +specs for bsn/pii.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

2026-07-23 15:24:59 +02:00

3.0 KiB

Raw Permalink Blame History

WP-40 — PII kernel: branded `Bsn` VO + masked-value atom

Status: done Phase: 8 — platform/DX/showcase Priority: P2

Outcome

shared/kernel/bsn.ts — Bsn branded VO + parseBsn with the elfproef (11-test) checksum (+spec). Wired into the DigiD login boundary (digid.adapter): login now does real BSN validation instead of "any 9 digits" — login hint + e2e BSNs updated to a valid one (123456782).
shared/kernel/pii.ts — pure maskBsn/maskTail/REDACTED (+spec), the functional core. Moved out of debug-state/mask.ts, which keeps only redactProfile (it depends on the registratie BigProfile, so it can't live in shared/kernel — boundary; debug-state is the sanctioned cross-context devtool). mask.spec ported to pii.spec.
<app-masked-value> atom (shared/ui/masked-value) + story — masked-by-default value with an optional reveal affordance; centralises the .includes('*') masked-detection that behandel-scherm used to sniff inline (now refactored to the atom). The atom only emits reveal; the caller keeps the step-up confirm + audited fetch.
Deviation (flagged): Session.bsn stays typed string — the brand guards the login ENTRY, but Session crosses a persistence boundary where the restore path deliberately drops the bsn (privacy) and JSON can't carry a brand, so re-typing it would add a ''/nullable ripple for no real gain. Backend MaskTail twin unchanged (still in sync).

Why

Masking is real but ad-hoc: pure helpers live in debug-state/mask.ts, the BSN is a bare string in session.ts (no branded VO / checksum, unlike BigNummer/Postcode), and masked state is detected by .includes('*') sniffing — no reusable atomic-design component. For a register this is AVG art. 9 (BSN = special category) territory; the pieces should be first-class and reusable.

Decisions

Bsn branded value object + parseBsn with the elfproef (9 digits, weighted mod-11) checksum — parity with the other value objects. Replace the bare string in session.ts.
Consolidate the pure maskers into shared/kernel/pii.ts (functional core): maskBsn, maskTail, redactProfile, … Keep the backend MaskTail twin in sync.
<app-masked-value> atom (shared/ui) — masked by default, optional reveal affordance + a11y; replaces .includes('*') sniffing and composes into the behandel-scherm reveal.

Files

New src/app/shared/kernel/bsn.ts (+spec, elfproef cases) and shared/kernel/pii.ts (+spec).
src/app/auth/domain/session.ts — bsn: Bsn.
New src/app/shared/ui/masked-value/ atom (+ story).
src/app/shared/ui/debug-state/mask.ts — re-export/move to the kernel module.

Acceptance criteria

parseBsn accepts valid elfproef numbers, rejects bad checksum/length/all-zeros (spec).
<app-masked-value> renders masked by default with an optional reveal; behandel-scherm uses it (no more inline sniff).
Pure maskers have specs (no TestBed); backend MaskTail parity noted; npm run ci green.

3.0 KiB Raw Permalink Blame History

WP-40 — PII kernel: branded Bsn VO + masked-value atom