feat(acl): GET /catalogi/zaaktypen lists published zaaktypen (refs #130)

2026-07-24 10:44:48 +02:00
parent a62a09bdff
commit 7368bf3bce
3 changed files with 18 additions and 6 deletions
@@ -85,6 +85,12 @@ app.MapPost("/documenten", async (StoreDocumentRequest body, AclService acl, Can
    return Results.Ok(new { informatieobjectUrl = url.ToString() });
 });

+// List the published zaaktypen — the read-only catalogus the beheer portal shows (S-15a). The BFF
+// proxies this behind medewerker-realm + beheerder authorization; the ACL trusts its callers (§8.3)
+// and is the only code allowed to read the ZGW Catalogi API (§8.1).
+app.MapGet("/catalogi/zaaktypen", async (AclService acl, CancellationToken ct) =>
+    Results.Ok(await acl.ListZaaktypenAsync(ct)));
+
 app.Run();

 public sealed record OpenZaakRequest(string Bsn, string Reference);