feat(bff): POST /self-service/registrations/{id}/withdraw, owner-scoped (refs #12)

The domain withdraw command carries the caller's bsn and owner-scopes the aggregate; unknown or

not-owned is 404 (indistinguishable). The BFF forwards the DigiD token's bsn and relays 204/404.

Regenerate the OpenAPI spec + Angular client for the new endpoint.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

services/domain/Big.Api/Program.cs

@@ -76,16 +76,19 @@ app.MapPost("/registrations/{id}/decide", async (string id, DecideRequest body,
 });
 
 // Withdraw a registration (S-11): the zorgprofessional pulls their own still-open submission back,
-// advancing it to INGETROKKEN. Idempotent. The BFF reaches this behind a digid token, owner-scoped
-// to the caller's bsn (S-11c); the domain trusts its callers (§8.3). Cancelling the running Flowable
-// process is a later sub-slice (S-11b).
-app.MapPost("/registrations/{id}/withdraw", async (string id, WithdrawRegistration withdraw, CancellationToken ct) =>
+// advancing it to INGETROKKEN and cancelling its workflow. Owner-scoped by the caller's bsn (the BFF
+// forwards it from the DigiD token, S-11c); a registration that is unknown or not the caller's is
+// 404 (indistinguishable, so ownership isn't leaked). Idempotent.
+app.MapPost("/registrations/{id}/withdraw", async (string id, WithdrawRequest body, WithdrawRegistration withdraw, CancellationToken ct) =>
 {
     if (!Guid.TryParse(id, out var guid))
         return Results.NotFound();
 
-    await withdraw.HandleAsync(new WithdrawRegistrationCommand(new RegistrationId(guid)), ct);
-    return Results.NoContent();
+    if (string.IsNullOrWhiteSpace(body?.Bsn))
+        return Results.BadRequest(new { error = "A bsn is required to withdraw a registration." });
+
+    var outcome = await withdraw.HandleAsync(new WithdrawRegistrationCommand(new RegistrationId(guid), body.Bsn), ct);
+    return outcome == WithdrawOutcome.Withdrawn ? Results.NoContent() : Results.NotFound();
 });
 
 // The behandelaar's werkbak (S-12): the registrations awaiting beoordeling, read from the open
@@ -113,6 +116,8 @@ public sealed record SubmitRegistrationRequest(string Bsn);
 
 public sealed record DecideRequest(string Besluit);
 
+public sealed record WithdrawRequest(string Bsn);
+
 public sealed record RegistrationResponse(string RegistrationId, string Status, string? ZaakUrl);
 
 public partial class Program;

services/domain/Big.Application/WithdrawRegistration.cs

@@ -2,8 +2,21 @@ using Big.Domain;
 
 namespace Big.Application;
 
-/// <summary>A zorgprofessional's request to withdraw their own registration ("trek aanvraag in").</summary>
-public sealed record WithdrawRegistrationCommand(RegistrationId RegistrationId);
+/// <summary>A zorgprofessional's request to withdraw their own registration ("trek aanvraag in").
+/// <paramref name="Bsn"/> is the authenticated caller (from the DigiD token, forwarded by the BFF):
+/// only the registration's own bsn may withdraw it.</summary>
+public sealed record WithdrawRegistrationCommand(RegistrationId RegistrationId, string Bsn);
+
+/// <summary>The outcome of a withdrawal request.</summary>
+public enum WithdrawOutcome
+{
+    /// <summary>The registration is now (or already was) INGETROKKEN.</summary>
+    Withdrawn,
+
+    /// <summary>No registration with that id belongs to the caller — unknown, or owned by someone
+    /// else (the two are deliberately indistinguishable, so the endpoint reveals neither).</summary>
+    NotFound,
+}
 
 /// <summary>
 /// The withdrawal use case (S-11): a zorgprofessional pulls a still-open registration back. It
@@ -16,16 +29,19 @@ public sealed record WithdrawRegistrationCommand(RegistrationId RegistrationId);
 /// </summary>
 public sealed class WithdrawRegistration(IRegistrationStore store, IWorkflowClient workflow)
 {
-    public async Task HandleAsync(WithdrawRegistrationCommand command, CancellationToken ct = default)
+    public async Task<WithdrawOutcome> HandleAsync(WithdrawRegistrationCommand command, CancellationToken ct = default)
     {
         ArgumentNullException.ThrowIfNull(command);
 
-        var registration = await store.GetAsync(command.RegistrationId, ct)
-            ?? throw new InvalidOperationException($"No registration {command.RegistrationId} to withdraw.");
+        var registration = await store.GetAsync(command.RegistrationId, ct);
+
+        // Unknown, or not the caller's registration: report NotFound either way (don't reveal which).
+        if (registration is null || registration.Bsn != command.Bsn)
+            return WithdrawOutcome.NotFound;
 
         // A repeated withdrawal is a no-op: don't persist or cancel the already-withdrawn one again.
         if (registration.Status == RegistrationStatus.Ingetrokken)
-            return;
+            return WithdrawOutcome.Withdrawn;
 
         registration.Withdraw();
         await store.SaveAsync(registration, ct);
@@ -33,5 +49,7 @@ public sealed class WithdrawRegistration(IRegistrationStore store, IWorkflowClie
         // Cancel the running process (if one was started) so its Beoordelen task leaves the werkbak.
         if (registration.ProcessInstanceId is not null)
             await workflow.WithdrawProcessAsync(registration.ProcessInstanceId, ct);
+
+        return WithdrawOutcome.Withdrawn;
     }
 }