test(bff): self-service withdraw is owner-scoped and relays not-found (refs #12)

The withdraw handler returns an outcome and refuses a bsn that doesn't own the registration; the

BFF endpoint requires a digid token, forwards id+bsn, and relays the domain's 404.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

services/bff/Bff.Tests/SelfServiceEndpointTests.cs

@@ -71,5 +71,46 @@ public class SelfServiceEndpointTests
         Assert.Equal("reg-123", body!.RegistrationId);
     }
 
+    private static HttpRequestMessage Withdraw(string? bearer, string id = "reg-123")
+    {
+        var request = new HttpRequestMessage(HttpMethod.Post, $"/self-service/registrations/{id}/withdraw");
+        if (bearer is not null)
+            request.Headers.Authorization = new AuthenticationHeaderValue("Bearer", bearer);
+        return request;
+    }
+
+    [Fact]
+    public async Task Rejects_a_withdrawal_without_a_token()
+    {
+        using var factory = new BffFactory();
+
+        var response = await factory.CreateClient().SendAsync(Withdraw(bearer: null));
+
+        Assert.Equal(HttpStatusCode.Unauthorized, response.StatusCode);
+        Assert.Null(factory.Domain.Withdrawn);
+    }
+
+    [Fact]
+    public async Task Withdraws_the_callers_registration_forwarding_the_id_and_bsn()
+    {
+        using var factory = new BffFactory();
+
+        var response = await factory.CreateClient().SendAsync(Withdraw(TestTokens.Valid("123456782"), "reg-9"));
+
+        Assert.Equal(HttpStatusCode.NoContent, response.StatusCode);
+        Assert.Equal(("reg-9", "123456782"), factory.Domain.Withdrawn);
+    }
+
+    [Fact]
+    public async Task Relays_not_found_when_the_registration_is_unknown_or_not_the_callers()
+    {
+        using var factory = new BffFactory();
+        factory.Domain.WithdrawSucceeds = false;
+
+        var response = await factory.CreateClient().SendAsync(Withdraw(TestTokens.Valid("123456782")));
+
+        Assert.Equal(HttpStatusCode.NotFound, response.StatusCode);
+    }
+
     private sealed record SubmitAcceptedDto(string RegistrationId, string Status);
 }