ehoandClaude Opus 5
772c47ea43
BIO-012: roleInterceptor/subjectInterceptor are correctly registered only under isDevMode(), but three hand-written fetch adapters (reveal-bignummer, letter-preview, org-template's proefbrief) bypass HttpClient and set X-Role/X-Subject themselves with no guard. The readers underneath, role.ts and subject.ts, were ungated too: they read ?role=/?subject= and wrote it into sessionStorage on any navigation, in any build -- for ?subject= that value is a BSN, which is exactly what SessionStore's G1 comment promises never happens. Gate both layers: currentRole()/currentSubject() return their safe default immediately outside isDevMode() (no query-param read, no sessionStorage write), and the three adapters additionally wrap their headers in isDevMode() so a production request carries neither header at all, matching what an HttpClient request already does once the interceptors aren't registered. TE-002: reveal-bignummer's response-shape validation was a "Trust boundary" a spec could only reach by stubbing globalThis.fetch. Exported it as parseRevealed(body), matching the other 30 parse* boundaries in the repo. Same treatment for letter-preview's errorMessage and org-template's proefbrief error mapping (extracted from an inline try/catch into a named, exported function first, since it wasn't already separate). BIO-006(a): reveal-bignummer sent X-Step-Up: 'true' unconditionally, so the backend's step-up precondition constrained nothing. reveal() now takes a stepUp flag; BriefStore.revealBigNummer() -- reachable only after the UI's confirm() gesture -- is the one that supplies it, so the literal no longer lives in the transport adapter. BIO-006(b): documented in roles-and-access.md that drafter is also the backend's fallback identity (StubIdentityProvider's catch-all arm), not just the dev switcher's initial choice -- so the least-privilege consequence of it also being the only role that may reveal a BSN is visible. Doc correction, same diff: roles-and-access.md's "wired only under isDevMode()" claim was false for the three hand-written fetch paths; it now says where the gate lives (interceptor registration and the reader functions) so it doesn't go stale the same way again. CLAUDE.md's dev-only claims needed no correction -- they already noted these three calls bypass the interceptor. Every fix has a test confirmed red by temporarily reverting the source change and rerunning the suite before restoring it. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
83 lines
2.7 KiB
TypeScript
83 lines
2.7 KiB
TypeScript
import { describe, it, expect } from 'vitest';
|
|
import { OrgTemplateAdminViewDto, OrgTemplateDto } from '@shared/infrastructure/api-client';
|
|
import {
|
|
parseOrgTemplateAdminView,
|
|
proefbriefErrorMessage,
|
|
PROEFBRIEF_FAILED,
|
|
} from './org-template.adapter';
|
|
|
|
const draft: OrgTemplateDto = {
|
|
subOrgId: 'cibg-registers',
|
|
orgName: 'CIBG',
|
|
returnAddress: 'Postbus 1',
|
|
footerContact: 'info@cibg.nl',
|
|
footerLegal: 'onderdeel van VWS',
|
|
signatureName: 'A. de Vries',
|
|
signatureRole: 'Hoofd Registratie',
|
|
signatureClosing: 'Met vriendelijke groet,',
|
|
margins: { topMm: 25, rightMm: 20, bottomMm: 25, leftMm: 20 },
|
|
version: 3,
|
|
};
|
|
|
|
const view: OrgTemplateAdminViewDto = {
|
|
draft,
|
|
publishedVersion: 3,
|
|
unsentBriefs: 2,
|
|
history: [{ version: 2, publishedAt: '2026-06-01', template: draft }],
|
|
};
|
|
|
|
describe('parseOrgTemplateAdminView', () => {
|
|
it('parses a well-formed admin view', () => {
|
|
const r = parseOrgTemplateAdminView(view);
|
|
expect(r.ok).toBe(true);
|
|
if (!r.ok) return;
|
|
expect(r.value.draft.orgName).toBe('CIBG');
|
|
expect(r.value.publishedVersion).toBe(3);
|
|
expect(r.value.unsentBriefs).toBe(2);
|
|
expect(r.value.history).toHaveLength(1);
|
|
expect(r.value.history[0].version).toBe(2);
|
|
});
|
|
|
|
it('rejects a missing draft', () => {
|
|
const r = parseOrgTemplateAdminView({ ...view, draft: undefined });
|
|
expect(r.ok).toBe(false);
|
|
});
|
|
|
|
it('rejects a missing count field', () => {
|
|
const r = parseOrgTemplateAdminView({ ...view, unsentBriefs: undefined });
|
|
expect(r.ok).toBe(false);
|
|
});
|
|
|
|
it('rejects a malformed history entry', () => {
|
|
const r = parseOrgTemplateAdminView({
|
|
...view,
|
|
history: [
|
|
{ version: 2, publishedAt: '2026-06-01', template: { ...draft, orgName: undefined } },
|
|
],
|
|
});
|
|
expect(r.ok).toBe(false);
|
|
});
|
|
});
|
|
|
|
// Minimal Response stand-in — proefbriefErrorMessage only calls `.json()`. Avoids
|
|
// stubbing globalThis.fetch to reach this trust boundary (TE-002).
|
|
const fakeResponse = (body: unknown): Response =>
|
|
({ json: () => Promise.resolve(body) }) as unknown as Response;
|
|
|
|
describe('proefbriefErrorMessage (TE-002 trust boundary)', () => {
|
|
it('surfaces the ProblemDetails detail when present', async () => {
|
|
expect(
|
|
await proefbriefErrorMessage(fakeResponse({ detail: 'Niet gevonden.', status: 404 })),
|
|
).toBe('Niet gevonden.');
|
|
});
|
|
|
|
it('falls back to PROEFBRIEF_FAILED when the body has no detail', async () => {
|
|
expect(await proefbriefErrorMessage(fakeResponse({ status: 500 }))).toBe(PROEFBRIEF_FAILED);
|
|
});
|
|
|
|
it('falls back to PROEFBRIEF_FAILED when the body is not JSON', async () => {
|
|
const res = { json: () => Promise.reject(new Error('not json')) } as unknown as Response;
|
|
expect(await proefbriefErrorMessage(res)).toBe(PROEFBRIEF_FAILED);
|
|
});
|
|
});
|