Replaces the hardcoded DocumentStore.DemoOwner and the static ZgwOptions
UserId/UserRepresentation with one per-request CallerIdentity, resolved by a
pluggable IIdentityProvider (StubIdentityProvider reads X-Role/X-Subject
today; a real OIDC/DigiD provider swaps in without touching any consumer).
- Domain/Authorization/{CallerIdentity,IIdentityProvider,StubIdentityProvider}.cs
+ a resolution middleware in Program.cs, right after correlation-id.
- Authz.ResolvePrincipal(ctx) keeps its signature (now reads ctx.Caller().Role),
so its ~15 call sites needed no changes.
- Every endpoint that passed DocumentStore.DemoOwner to a store now passes
ctx.Caller().Bsn.
- ZgwTokenProvider gains Mint(CallerIdentity) alongside the original Mint()
(kept for calls not tied to one citizen); ZgwHttpClient threads an optional
caller through to pick the right overload.
- IZaakSource gains ListMyCases(caller, now) — the citizen-scoped read
OpenZaakZaakSource backs with ZGW's rol__...__inpBsn filter. GET /applications
now routes through it instead of ApplicationStore directly, closing the last
"reads a static store" gap for a citizen-facing endpoint.
Backend 159/159 tests (+8, incl. an HTTP-level two-identity scoping proof),
npm run ci green, no api-client drift.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
163 lines
7.0 KiB
C#
163 lines
7.0 KiB
C#
using BigRegister.Api.Data;
|
|
using BigRegister.Api.Zgw;
|
|
using BigRegister.Domain.Authorization;
|
|
|
|
namespace BigRegister.Tests;
|
|
|
|
/// <summary>
|
|
/// Exercises the OpenZaak read source against a stub HttpMessageHandler (no live server, no
|
|
/// mocking library) — the guarantee that it follows ZGW pagination, resolves + caches
|
|
/// zaaktype labels, and always sends a Bearer token.
|
|
/// </summary>
|
|
public class OpenZaakZaakSourceTests
|
|
{
|
|
private const string ZrcBase = "https://oz.example/zaken/api/v1";
|
|
private const string ZtBase = "https://oz.example/catalogi/api/v1";
|
|
|
|
private static string Page1 => $$"""
|
|
{ "count": 2, "next": "{{ZrcBase}}/zaken?page=2", "results": [
|
|
{ "url": "{{ZrcBase}}/zaken/uuid-1", "identificatie": "ZAAK-1",
|
|
"zaaktype": "{{ZtBase}}/zaaktypen/zt-1", "startdatum": "2026-03-01",
|
|
"einddatum": null, "registratiedatum": "2026-03-01" } ] }
|
|
""";
|
|
|
|
private static string Page2 => $$"""
|
|
{ "count": 2, "next": null, "results": [
|
|
{ "url": "{{ZrcBase}}/zaken/uuid-2", "identificatie": "ZAAK-2",
|
|
"zaaktype": "{{ZtBase}}/zaaktypen/zt-1", "startdatum": "2026-01-01",
|
|
"einddatum": "2026-02-01", "registratiedatum": "2026-01-01" } ] }
|
|
""";
|
|
|
|
private const string Zaaktype = """{ "omschrijving": "Herregistratie arts" }""";
|
|
|
|
[Fact]
|
|
public void Follows_pagination_caches_zaaktype_and_sends_bearer_token()
|
|
{
|
|
var handler = new ZgwStubHandler(url => url switch
|
|
{
|
|
_ when url == $"{ZrcBase}/zaken" => Page1,
|
|
_ when url == $"{ZrcBase}/zaken?page=2" => Page2,
|
|
_ when url == $"{ZtBase}/zaaktypen/zt-1" => Zaaktype,
|
|
_ => throw new InvalidOperationException($"unexpected ZGW GET {url}"),
|
|
});
|
|
|
|
var options = new ZgwOptions { ZrcBaseUrl = ZrcBase, ZtcBaseUrl = ZtBase, ClientId = "c", Secret = "s" };
|
|
var source = new OpenZaakZaakSource(new HttpClient(handler), new ZgwTokenProvider(options), options);
|
|
|
|
var cases = source.ListCases(DateTimeOffset.UtcNow);
|
|
|
|
// Both pages accumulated.
|
|
Assert.Equal(2, cases.Count);
|
|
Assert.Equal(new[] { "uuid-1", "uuid-2" }, cases.Select(c => c.Id));
|
|
Assert.All(cases, c => Assert.Equal("Herregistratie arts", c.Type));
|
|
Assert.Equal("InBehandeling", cases[0].Status.Tag); // open
|
|
Assert.Equal("Goedgekeurd", cases[1].Status.Tag); // closed
|
|
|
|
// Zaaktype resolved once despite two zaken sharing it (cache).
|
|
Assert.Single(handler.Requests, r => r.Contains("zaaktypen"));
|
|
// Every outbound request carried a Bearer token.
|
|
Assert.All(handler.AuthSchemes, s => Assert.Equal("Bearer", s));
|
|
}
|
|
|
|
[Fact]
|
|
public void ListMyCases_filters_by_the_callers_bsn()
|
|
{
|
|
var handler = new ZgwStubHandler(url => url switch
|
|
{
|
|
_ when url.StartsWith($"{ZrcBase}/zaken") => """{ "count": 0, "next": null, "results": [] }""",
|
|
_ => throw new InvalidOperationException($"unexpected ZGW GET {url}"),
|
|
});
|
|
|
|
var options = new ZgwOptions { ZrcBaseUrl = ZrcBase, ZtcBaseUrl = ZtBase, ClientId = "c", Secret = "s" };
|
|
var source = new OpenZaakZaakSource(new HttpClient(handler), new ZgwTokenProvider(options), options);
|
|
var caller = new CallerIdentity("111222333", "Dr. Test", PrincipalRole.Drafter);
|
|
|
|
source.ListMyCases(caller, DateTimeOffset.UtcNow);
|
|
|
|
Assert.Single(handler.Requests, r =>
|
|
r.StartsWith($"{ZrcBase}/zaken?") &&
|
|
r.Contains("rol__betrokkeneIdentificatie__natuurlijkPersoon__inpBsn=111222333"));
|
|
}
|
|
|
|
[Fact]
|
|
public void CreateZaak_posts_zaak_status_and_rol_and_maps_the_result_back()
|
|
{
|
|
const string zaaktypeUrl = $"{ZtBase}/zaaktypen/zt-registratie";
|
|
var handler = new ZgwStubHandler(url => url switch
|
|
{
|
|
_ when url == $"{ZrcBase}/zaken" => $$"""
|
|
{ "url": "{{ZrcBase}}/zaken/uuid-new", "identificatie": "BIG-2026-000123",
|
|
"zaaktype": "{{zaaktypeUrl}}", "startdatum": "2026-07-28",
|
|
"einddatum": null, "registratiedatum": "2026-07-28" }
|
|
""",
|
|
_ when url.StartsWith($"{ZtBase}/statustypen") => """
|
|
{ "count": 1, "next": null,
|
|
"results": [ { "url": "https://oz.example/catalogi/api/v1/statustypen/st-1", "volgnummer": 1 } ] }
|
|
""",
|
|
_ when url.StartsWith($"{ZtBase}/roltypen") => """
|
|
{ "count": 1, "next": null,
|
|
"results": [ { "url": "https://oz.example/catalogi/api/v1/roltypen/rt-initiator" } ] }
|
|
""",
|
|
_ when url == $"{ZrcBase}/statussen" => "{}",
|
|
_ when url == $"{ZrcBase}/rollen" => "{}",
|
|
_ => throw new InvalidOperationException($"unexpected ZGW call {url}"),
|
|
});
|
|
|
|
var options = new ZgwOptions
|
|
{
|
|
ZrcBaseUrl = ZrcBase,
|
|
ZtcBaseUrl = ZtBase,
|
|
ClientId = "c",
|
|
Secret = "s",
|
|
Bronorganisatie = "123443210",
|
|
VerantwoordelijkeOrganisatie = "123443210",
|
|
ZaaktypeUrls = new() { ["registratie"] = zaaktypeUrl },
|
|
};
|
|
var source = new OpenZaakZaakSource(new HttpClient(handler), new ZgwTokenProvider(options), options);
|
|
var aanvraag = new Aanvraag
|
|
{
|
|
Id = "a1",
|
|
Type = "registratie",
|
|
Owner = "111222333",
|
|
Referentie = "BIG-2026-000123",
|
|
};
|
|
|
|
var caller = new CallerIdentity(aanvraag.Owner, "Dr. Test", PrincipalRole.Drafter);
|
|
var (referentie, status, zaakUrl) = source.CreateZaak(aanvraag, new DateTimeOffset(2026, 7, 28, 12, 0, 0, TimeSpan.Zero), caller);
|
|
|
|
Assert.Equal("BIG-2026-000123", referentie);
|
|
Assert.Equal("InBehandeling", status.Tag);
|
|
Assert.Equal("BIG-2026-000123", status.Referentie);
|
|
Assert.Equal($"{ZrcBase}/zaken/uuid-new", zaakUrl);
|
|
|
|
// Zaak: mapped zaaktype + configured RSINs + the local reference as identificatie.
|
|
var zaakBody = handler.BodyOf($"{ZrcBase}/zaken");
|
|
Assert.Contains(zaaktypeUrl, zaakBody);
|
|
Assert.Contains("123443210", zaakBody);
|
|
Assert.Contains("BIG-2026-000123", zaakBody);
|
|
|
|
// Status: points at the created zaak's URL and the resolved statustype.
|
|
var statusBody = handler.BodyOf($"{ZrcBase}/statussen");
|
|
Assert.Contains($"{ZrcBase}/zaken/uuid-new", statusBody);
|
|
Assert.Contains("statustypen/st-1", statusBody);
|
|
|
|
// Rol: points at the created zaak, the resolved initiator roltype, and the BSN.
|
|
var rolBody = handler.BodyOf($"{ZrcBase}/rollen");
|
|
Assert.Contains($"{ZrcBase}/zaken/uuid-new", rolBody);
|
|
Assert.Contains("roltypen/rt-initiator", rolBody);
|
|
Assert.Contains("111222333", rolBody);
|
|
}
|
|
|
|
[Fact]
|
|
public void CreateZaak_throws_when_the_aanvraag_type_has_no_configured_zaaktype()
|
|
{
|
|
var options = new ZgwOptions { ZrcBaseUrl = ZrcBase, ZtcBaseUrl = ZtBase, ClientId = "c", Secret = "s" };
|
|
var handler = new ZgwStubHandler(url => throw new InvalidOperationException($"no HTTP call expected, got {url}"));
|
|
var source = new OpenZaakZaakSource(new HttpClient(handler), new ZgwTokenProvider(options), options);
|
|
var aanvraag = new Aanvraag { Id = "a1", Type = "unknown-type", Owner = "111222333", Referentie = "BIG-2026-000123" };
|
|
var caller = new CallerIdentity(aanvraag.Owner, "Dr. Test", PrincipalRole.Drafter);
|
|
|
|
Assert.Throws<InvalidOperationException>(() => source.CreateZaak(aanvraag, DateTimeOffset.UtcNow, caller));
|
|
}
|
|
}
|