ehoandClaude Opus 5
772c47ea43
BIO-012: roleInterceptor/subjectInterceptor are correctly registered only under isDevMode(), but three hand-written fetch adapters (reveal-bignummer, letter-preview, org-template's proefbrief) bypass HttpClient and set X-Role/X-Subject themselves with no guard. The readers underneath, role.ts and subject.ts, were ungated too: they read ?role=/?subject= and wrote it into sessionStorage on any navigation, in any build -- for ?subject= that value is a BSN, which is exactly what SessionStore's G1 comment promises never happens. Gate both layers: currentRole()/currentSubject() return their safe default immediately outside isDevMode() (no query-param read, no sessionStorage write), and the three adapters additionally wrap their headers in isDevMode() so a production request carries neither header at all, matching what an HttpClient request already does once the interceptors aren't registered. TE-002: reveal-bignummer's response-shape validation was a "Trust boundary" a spec could only reach by stubbing globalThis.fetch. Exported it as parseRevealed(body), matching the other 30 parse* boundaries in the repo. Same treatment for letter-preview's errorMessage and org-template's proefbrief error mapping (extracted from an inline try/catch into a named, exported function first, since it wasn't already separate). BIO-006(a): reveal-bignummer sent X-Step-Up: 'true' unconditionally, so the backend's step-up precondition constrained nothing. reveal() now takes a stepUp flag; BriefStore.revealBigNummer() -- reachable only after the UI's confirm() gesture -- is the one that supplies it, so the literal no longer lives in the transport adapter. BIO-006(b): documented in roles-and-access.md that drafter is also the backend's fallback identity (StubIdentityProvider's catch-all arm), not just the dev switcher's initial choice -- so the least-privilege consequence of it also being the only role that may reveal a BSN is visible. Doc correction, same diff: roles-and-access.md's "wired only under isDevMode()" claim was false for the three hand-written fetch paths; it now says where the gate lives (interceptor registration and the reader functions) so it doesn't go stale the same way again. CLAUDE.md's dev-only claims needed no correction -- they already noted these three calls bypass the interceptor. Every fix has a test confirmed red by temporarily reverting the source change and rerunning the suite before restoring it. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
70 lines
2.6 KiB
TypeScript
70 lines
2.6 KiB
TypeScript
import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest';
|
|
import { errorMessage, PREVIEW_FAILED, LetterPreviewAdapter } from './letter-preview.adapter';
|
|
|
|
// Minimal Response stand-in — errorMessage only calls `.json()`. Avoids stubbing
|
|
// globalThis.fetch to reach this trust boundary (TE-002).
|
|
const fakeResponse = (body: unknown): Response =>
|
|
({ json: () => Promise.resolve(body) }) as unknown as Response;
|
|
|
|
describe('errorMessage (TE-002 trust boundary)', () => {
|
|
it('surfaces the ProblemDetails detail when present', async () => {
|
|
expect(await errorMessage(fakeResponse({ detail: 'Geen toegang.', status: 403 }))).toBe(
|
|
'Geen toegang.',
|
|
);
|
|
});
|
|
|
|
it('falls back to PREVIEW_FAILED when the body has no detail', async () => {
|
|
expect(await errorMessage(fakeResponse({ status: 500 }))).toBe(PREVIEW_FAILED);
|
|
});
|
|
|
|
it('falls back to PREVIEW_FAILED when the body is not JSON', async () => {
|
|
const res = { json: () => Promise.reject(new Error('not json')) } as unknown as Response;
|
|
expect(await errorMessage(res)).toBe(PREVIEW_FAILED);
|
|
});
|
|
});
|
|
|
|
// isDevMode() reads the `ngDevMode` global the Angular CLI defines away in a
|
|
// production build. There is no ambient type for it in app code, so this is
|
|
// accessed through an untyped bag rather than a `declare const`.
|
|
const globals = globalThis as Record<string, unknown>;
|
|
const originalNgDevMode = globals['ngDevMode'];
|
|
const setDevMode = (on: boolean) => {
|
|
globals['ngDevMode'] = on;
|
|
};
|
|
|
|
describe('LetterPreviewAdapter.preview (BIO-012)', () => {
|
|
const okResponse = () =>
|
|
({ ok: true, blob: () => Promise.resolve(new Blob()) }) as unknown as Response;
|
|
|
|
afterEach(() => {
|
|
globals['ngDevMode'] = originalNgDevMode;
|
|
vi.unstubAllGlobals();
|
|
history.pushState({}, '', '/');
|
|
sessionStorage.clear();
|
|
});
|
|
|
|
it('sends no X-Role/X-Subject headers outside isDevMode()', async () => {
|
|
setDevMode(false);
|
|
history.pushState({}, '', '/?subject=111222333');
|
|
const fetchSpy = vi.fn().mockResolvedValue(okResponse());
|
|
vi.stubGlobal('fetch', fetchSpy);
|
|
|
|
await new LetterPreviewAdapter().preview();
|
|
|
|
expect(fetchSpy.mock.calls[0][1].headers).toEqual({});
|
|
});
|
|
|
|
it('sends X-Role (and X-Subject when known) under isDevMode()', async () => {
|
|
setDevMode(true);
|
|
history.pushState({}, '', '/?subject=111222333');
|
|
const fetchSpy = vi.fn().mockResolvedValue(okResponse());
|
|
vi.stubGlobal('fetch', fetchSpy);
|
|
|
|
await new LetterPreviewAdapter().preview();
|
|
|
|
const headers = fetchSpy.mock.calls[0][1].headers as Record<string, string>;
|
|
expect(headers['X-Role']).toBeDefined();
|
|
expect(headers['X-Subject']).toBe('111222333');
|
|
});
|
|
});
|