test(bff): documents endpoint forwards the base64 file to the domain (refs #103)

RED: the self-service documents endpoint takes the base64 file (+ fileName/contentType)
as JSON — the portal encodes client-side — with the bsn from the token, and forwards
all of it to the domain. IDomainClient.ProvideDocumentsAsync grows accordingly.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

services/bff/Bff.Tests/BffFactory.cs

@@ -94,15 +94,15 @@ internal sealed class FakeDomainClient : IDomainClient
         return Task.FromResult(WithdrawSucceeds);
     }
 
-    public (string RegistrationId, string Bsn)? DocumentsProvidedFor { get; private set; }
+    public (string RegistrationId, string Bsn, string ContentBase64, string? FileName, string? ContentType)? DocumentsProvidedFor { get; private set; }
 
     /// <summary>Whether the fake domain reports the provide-documents as done (true → 204) or
     /// not-found/not-owned (false → 404). Tests set this to exercise the relay.</summary>
     public bool ProvideDocumentsSucceeds { get; set; } = true;
 
-    public Task<bool> ProvideDocumentsAsync(string registrationId, string bsn, CancellationToken ct = default)
+    public Task<bool> ProvideDocumentsAsync(string registrationId, string bsn, string contentBase64, string? fileName, string? contentType, CancellationToken ct = default)
     {
-        DocumentsProvidedFor = (registrationId, bsn);
+        DocumentsProvidedFor = (registrationId, bsn, contentBase64, fileName, contentType);
         return Task.FromResult(ProvideDocumentsSucceeds);
     }
 

services/bff/Bff.Tests/SelfServiceEndpointTests.cs

@@ -114,7 +114,17 @@ public class SelfServiceEndpointTests
 
     private static HttpRequestMessage ProvideDocuments(string? bearer, string id = "reg-123")
     {
-        var request = new HttpRequestMessage(HttpMethod.Post, $"/self-service/registrations/{id}/documents");
+        var request = new HttpRequestMessage(HttpMethod.Post, $"/self-service/registrations/{id}/documents")
+        {
+            // The portal base64-encodes the file client-side and posts it as JSON (S-10b); the bsn is
+            // never in the body — it comes from the DigiD token.
+            Content = JsonContent.Create(new
+            {
+                contentBase64 = Convert.ToBase64String([1, 2, 3]),
+                fileName = "diploma.pdf",
+                contentType = "application/pdf",
+            }),
+        };
         if (bearer is not null)
             request.Headers.Authorization = new AuthenticationHeaderValue("Bearer", bearer);
         return request;
@@ -132,14 +142,19 @@ public class SelfServiceEndpointTests
     }
 
     [Fact]
-    public async Task Provides_documents_for_the_callers_registration_forwarding_the_id_and_bsn()
+    public async Task Provides_documents_for_the_callers_registration_forwarding_id_bsn_and_file()
     {
         using var factory = new BffFactory();
 
         var response = await factory.CreateClient().SendAsync(ProvideDocuments(TestTokens.Valid("123456782"), "reg-9"));
 
         Assert.Equal(HttpStatusCode.NoContent, response.StatusCode);
-        Assert.Equal(("reg-9", "123456782"), factory.Domain.DocumentsProvidedFor);
+        var provided = factory.Domain.DocumentsProvidedFor;
+        Assert.NotNull(provided);
+        Assert.Equal("reg-9", provided!.Value.RegistrationId);
+        Assert.Equal("123456782", provided.Value.Bsn);
+        Assert.Equal(Convert.ToBase64String([1, 2, 3]), provided.Value.ContentBase64);
+        Assert.Equal("diploma.pdf", provided.Value.FileName);
     }
 
     [Fact]