ehoandClaude Opus 4.8
1c3c195d32
CI / frontend (push) Successful in 2m59s
CI / backend (push) Successful in 1m27s
CI / semgrep (push) Successful in 58s
CI / e2e (push) Successful in 2m30s
CI / api-client-drift (push) Canceled after 1m14s
CI / storybook-a11y (push) Canceled after 29m8s
Stamdata: add beroepen, opleidingen (temporal), and specialismen tables to the schema-driven catalog (zero UI code). opleidingen.beroep and specialismen.beroep both reference beroepen.code — the first stamdata->stamdata references, enforced by two new StamdataRef entries in the CI gate. OpenZaak/ZGW (WP-49, slice 1 — read-only zaken): introduce IZaakSource as the cases read seam. Default LocalZaakSource reads the local SQLite store (offline); an OpenZaakZaakSource (Zgw/ client: HS256 per-call JWT, ZGW->existing-DTO mapper, paginating HTTP source) is selected behind Zgw:Enabled (default false). The FE never changes — same ApplicationSummaryDto, no api-client drift. Unit-tested with fixtures + a stub HttpMessageHandler; no live OpenZaak needed. Docs: ADR-0005, reference/openzaak-integration.md, WP-49..52 roadmap, stamdata.md update, README index rows. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
67 lines
2.3 KiB
C#
67 lines
2.3 KiB
C#
using System.Security.Cryptography;
|
|
using System.Text;
|
|
using System.Text.Json;
|
|
using BigRegister.Api.Zgw;
|
|
|
|
namespace BigRegister.Tests;
|
|
|
|
/// <summary>
|
|
/// The ZGW JWT is hand-signed (no library), so it needs a check that it's actually a valid
|
|
/// HS256 JWS with the claims OpenZaak requires. Decodes the minted token and re-verifies the
|
|
/// signature with the shared secret.
|
|
/// </summary>
|
|
public class ZgwTokenProviderTests
|
|
{
|
|
private static readonly ZgwOptions Options = new()
|
|
{
|
|
ClientId = "big-register",
|
|
Secret = "super-secret-signing-key",
|
|
UserId = "u-123",
|
|
UserRepresentation = "Dr. Test",
|
|
};
|
|
|
|
[Fact]
|
|
public void Mints_a_three_part_jwt_with_the_required_claims()
|
|
{
|
|
var token = new ZgwTokenProvider(Options).Mint();
|
|
|
|
var parts = token.Split('.');
|
|
Assert.Equal(3, parts.Length);
|
|
|
|
var header = JsonSerializer.Deserialize<JsonElement>(Decode(parts[0]));
|
|
Assert.Equal("HS256", header.GetProperty("alg").GetString());
|
|
Assert.Equal("JWT", header.GetProperty("typ").GetString());
|
|
|
|
var payload = JsonSerializer.Deserialize<JsonElement>(Decode(parts[1]));
|
|
Assert.Equal("big-register", payload.GetProperty("iss").GetString());
|
|
Assert.Equal("big-register", payload.GetProperty("client_id").GetString());
|
|
Assert.Equal("u-123", payload.GetProperty("user_id").GetString());
|
|
Assert.Equal("Dr. Test", payload.GetProperty("user_representation").GetString());
|
|
// iat is a recent unix second
|
|
var iat = payload.GetProperty("iat").GetInt64();
|
|
Assert.InRange(iat, DateTimeOffset.UtcNow.ToUnixTimeSeconds() - 5, DateTimeOffset.UtcNow.ToUnixTimeSeconds() + 5);
|
|
}
|
|
|
|
[Fact]
|
|
public void Signature_verifies_with_the_shared_secret()
|
|
{
|
|
var token = new ZgwTokenProvider(Options).Mint();
|
|
var parts = token.Split('.');
|
|
|
|
using var hmac = new HMACSHA256(Encoding.UTF8.GetBytes(Options.Secret));
|
|
var expected = Base64Url(hmac.ComputeHash(Encoding.UTF8.GetBytes($"{parts[0]}.{parts[1]}")));
|
|
|
|
Assert.Equal(expected, parts[2]);
|
|
}
|
|
|
|
private static string Decode(string b64Url)
|
|
{
|
|
var s = b64Url.Replace('-', '+').Replace('_', '/');
|
|
s = s.PadRight(s.Length + (4 - s.Length % 4) % 4, '=');
|
|
return Encoding.UTF8.GetString(Convert.FromBase64String(s));
|
|
}
|
|
|
|
private static string Base64Url(byte[] bytes) =>
|
|
Convert.ToBase64String(bytes).TrimEnd('=').Replace('+', '-').Replace('/', '_');
|
|
}
|