ehoandClaude Sonnet 5
4133b30e5d
CI / changes (pull_request) Successful in 17s
CI / lint (pull_request) Failing after 54s
CI / frontend (pull_request) Successful in 2m38s
CI / storybook-a11y (pull_request) Failing after 3m28s
CI / backend (pull_request) Successful in 2m1s
CI / semgrep (pull_request) Successful in 1m9s
CI / e2e (pull_request) Successful in 2m55s
CI / api-client-drift (pull_request) Successful in 2m1s
New GET /beoordeling/{id} shows one aanvraag's status, linked documents, and a
canBesluiten decision flag, gated by the same CanBeoordelen capability as the
werkvoorraad list. Reads through IZaakSource.ListCases rather than a new seam
method (WP-66 needs one anyway for the real write); owner BSN is masked.
Fixes a real gap found while wiring this up: the behandelportal's login was still
WP-61's copied citizen/BSN DigiD flow, so nothing ever sent X-Medewerker and the
werkvoorraad screen (WP-64) always denied in a real browser. A dev-only
medewerkerInterceptor (mirrors the existing ?role= stand-in as ?rollen=) fixes that.
WP-65's own Risks note authorized splitting read from write across sessions given
its size; this is the read half. The decision-recording mutation is next (65b).
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
55 lines
2.3 KiB
TypeScript
55 lines
2.3 KiB
TypeScript
import { Routes } from '@angular/router';
|
|
import { ShellComponent } from '@shared/layout/shell/shell.component';
|
|
import { authGuard, capabilityGuard } from '@auth/auth.guard';
|
|
|
|
export const routes: Routes = [
|
|
{
|
|
path: '',
|
|
component: ShellComponent, // persistent header/footer; only children swap
|
|
children: [
|
|
{ path: '', pathMatch: 'full', redirectTo: 'login' },
|
|
{
|
|
path: 'login',
|
|
loadComponent: () => import('@auth/ui/login.page').then((m) => m.LoginPage),
|
|
},
|
|
{
|
|
path: 'dashboard',
|
|
canActivate: [authGuard],
|
|
loadComponent: () =>
|
|
import('@behandeling/ui/werkvoorraad.page').then((m) => m.WerkvoorraadPage),
|
|
},
|
|
{
|
|
path: 'aanvraag/:id',
|
|
// Same capability the werkvoorraad list itself is gated by (WP-64/65) — the
|
|
// detail page is reachable only from a row already filtered to that capability.
|
|
canActivate: [capabilityGuard('aanvraag:beoordelen')],
|
|
loadComponent: () =>
|
|
import('@behandeling/ui/beoordeling.page').then((m) => m.BeoordelingPage),
|
|
},
|
|
{
|
|
path: 'beheer/stamdata',
|
|
// Admin-only stamdata maintenance editor (ADR-0004): capabilityGuard denies-by-default
|
|
// unless GET /me resolved `stamdata:edit` (Admin role). Backend re-enforces via the
|
|
// StamdataAdmin gate — the guard just avoids loading a page that would 403.
|
|
canActivate: [capabilityGuard('stamdata:edit')],
|
|
loadComponent: () => import('@beheer/ui/stamdata.page').then((m) => m.StamdataPage),
|
|
},
|
|
{
|
|
path: 'beheer/audit',
|
|
// Admin-only authz/PII-reveal audit trail (WP-41/42). capabilityGuard denies-by-default
|
|
// unless GET /me resolved `cases:manage` (reused for audit read). Backend re-enforces.
|
|
canActivate: [capabilityGuard('cases:manage')],
|
|
loadComponent: () => import('@beheer/ui/audit.page').then((m) => m.AuditPage),
|
|
},
|
|
{
|
|
path: 'beheer/functies',
|
|
// Admin-only feature-flag toggles (WP-47), gated by `flags:manage`.
|
|
canActivate: [capabilityGuard('flags:manage')],
|
|
loadComponent: () =>
|
|
import('@beheer/ui/feature-flags.page').then((m) => m.FeatureFlagsPage),
|
|
},
|
|
{ path: '**', redirectTo: 'login' },
|
|
],
|
|
},
|
|
];
|