From b412721938538f89f601a58b4ccb1cc693769aa4 Mon Sep 17 00:00:00 2001 From: Niek Otten Date: Fri, 24 Jul 2026 10:55:58 +0200 Subject: [PATCH] test(portal-beheer): beheer app scaffold + catalogus viewer specs (refs #130) --- apps/beheer/Dockerfile | 27 ++++++ apps/beheer/eslint.config.mjs | 34 ++++++++ apps/beheer/nginx.conf | 24 ++++++ apps/beheer/project.json | 80 ++++++++++++++++++ apps/beheer/public/config.json | 3 + apps/beheer/public/favicon.ico | Bin 0 -> 15086 bytes apps/beheer/src/app/app.config.spec.ts | 65 ++++++++++++++ apps/beheer/src/app/app.config.ts | 39 +++++++++ apps/beheer/src/app/app.css | 0 apps/beheer/src/app/app.html | 1 + apps/beheer/src/app/app.routes.ts | 7 ++ apps/beheer/src/app/app.spec.ts | 15 ++++ apps/beheer/src/app/app.ts | 12 +++ .../src/app/catalogus/catalogus-page.html | 40 +++++++++ .../src/app/catalogus/catalogus-page.spec.ts | 75 ++++++++++++++++ .../src/app/catalogus/catalogus-page.ts | 26 ++++++ apps/beheer/src/index.html | 13 +++ apps/beheer/src/main.ts | 10 +++ apps/beheer/src/styles.css | 2 + apps/beheer/tsconfig.app.json | 9 ++ apps/beheer/tsconfig.json | 31 +++++++ apps/beheer/tsconfig.spec.json | 8 ++ 22 files changed, 521 insertions(+) create mode 100644 apps/beheer/Dockerfile create mode 100644 apps/beheer/eslint.config.mjs create mode 100644 apps/beheer/nginx.conf create mode 100644 apps/beheer/project.json create mode 100644 apps/beheer/public/config.json create mode 100644 apps/beheer/public/favicon.ico create mode 100644 apps/beheer/src/app/app.config.spec.ts create mode 100644 apps/beheer/src/app/app.config.ts create mode 100644 apps/beheer/src/app/app.css create mode 100644 apps/beheer/src/app/app.html create mode 100644 apps/beheer/src/app/app.routes.ts create mode 100644 apps/beheer/src/app/app.spec.ts create mode 100644 apps/beheer/src/app/app.ts create mode 100644 apps/beheer/src/app/catalogus/catalogus-page.html create mode 100644 apps/beheer/src/app/catalogus/catalogus-page.spec.ts create mode 100644 apps/beheer/src/app/catalogus/catalogus-page.ts create mode 100644 apps/beheer/src/index.html create mode 100644 apps/beheer/src/main.ts create mode 100644 apps/beheer/src/styles.css create mode 100644 apps/beheer/tsconfig.app.json create mode 100644 apps/beheer/tsconfig.json create mode 100644 apps/beheer/tsconfig.spec.json diff --git a/apps/beheer/Dockerfile b/apps/beheer/Dockerfile new file mode 100644 index 0000000..c8cb1ab --- /dev/null +++ b/apps/beheer/Dockerfile @@ -0,0 +1,27 @@ +# Multi-stage build for the beheer portal (Angular → nginx). +# Build context is the repo root (the app needs the pnpm workspace + libs). See infra/docker-compose.yml. +FROM node:24-slim AS build +WORKDIR /src +RUN corepack enable && corepack prepare pnpm@11.5.2 --activate + +# Restore first (cached unless the manifests change). +COPY package.json pnpm-lock.yaml pnpm-workspace.yaml nx.json tsconfig.base.json eslint.config.mjs ./ +RUN pnpm install --frozen-lockfile + +# Sources (only what the app + its libs need). +COPY apps/beheer apps/beheer +COPY libs libs +RUN pnpm nx build beheer + +FROM nginx:1.27-alpine AS runtime +COPY apps/beheer/nginx.conf /etc/nginx/conf.d/default.conf +COPY --from=build /src/dist/apps/beheer/browser /usr/share/nginx/html +# Compose-time OIDC config: the browser (Playwright, on the compose network) reaches Keycloak by +# service name, so the token issuer matches the BFF's medewerker authority (host-consistent, ADR-0013). +RUN printf '{ "authority": "http://keycloak:8080/realms/medewerker" }\n' > /usr/share/nginx/html/config.json +# Make the reverse-proxy resolver engine-portable (Docker 127.0.0.11 vs podman aardvark); runs from +# the nginx image's /docker-entrypoint.d before nginx starts. +COPY apps/portal-nginx-resolver.sh /docker-entrypoint.d/40-resolver.sh +RUN chmod +x /docker-entrypoint.d/40-resolver.sh + +EXPOSE 80 diff --git a/apps/beheer/eslint.config.mjs b/apps/beheer/eslint.config.mjs new file mode 100644 index 0000000..af5ff32 --- /dev/null +++ b/apps/beheer/eslint.config.mjs @@ -0,0 +1,34 @@ +import nx from '@nx/eslint-plugin'; +import baseConfig from '../../eslint.config.mjs'; + +export default [ + ...nx.configs['flat/angular'], + ...nx.configs['flat/angular-template'], + ...baseConfig, + { + files: ['**/*.ts'], + rules: { + '@angular-eslint/directive-selector': [ + 'error', + { + type: 'attribute', + prefix: 'app', + style: 'camelCase', + }, + ], + '@angular-eslint/component-selector': [ + 'error', + { + type: 'element', + prefix: 'app', + style: 'kebab-case', + }, + ], + }, + }, + { + files: ['**/*.html'], + // Override or add rules here + rules: {}, + }, +]; diff --git a/apps/beheer/nginx.conf b/apps/beheer/nginx.conf new file mode 100644 index 0000000..08439bc --- /dev/null +++ b/apps/beheer/nginx.conf @@ -0,0 +1,24 @@ +server { + listen 80; + server_name _; + root /usr/share/nginx/html; + index index.html; + + # Resolve the BFF via Docker's embedded DNS at request time (variable proxy_pass), so nginx starts + # even before the BFF is up and picks up restarts — instead of failing to load the config. + resolver 127.0.0.11 ipv6=off valid=30s; + + # Same-origin API: proxy the beheer endpoint group to the bff service. The api-client uses + # relative URLs, so the browser calls this origin and nginx forwards to the BFF — no CORS, and the + # medewerker token (same-origin) is attached by the app's interceptor (ADR-0013). + location /beheer/ { + set $bff http://bff:8080; + proxy_pass $bff; + proxy_set_header Host $host; + } + + # SPA fallback — Angular client-side routing. + location / { + try_files $uri $uri/ /index.html; + } +} diff --git a/apps/beheer/project.json b/apps/beheer/project.json new file mode 100644 index 0000000..890a071 --- /dev/null +++ b/apps/beheer/project.json @@ -0,0 +1,80 @@ +{ + "name": "beheer", + "$schema": "../../node_modules/nx/schemas/project-schema.json", + "projectType": "application", + "prefix": "app", + "sourceRoot": "apps/beheer/src", + "tags": [], + "targets": { + "build": { + "executor": "@angular/build:application", + "outputs": ["{options.outputPath}"], + "defaultConfiguration": "production", + "options": { + "outputPath": "dist/apps/beheer", + "browser": "apps/beheer/src/main.ts", + "tsConfig": "apps/beheer/tsconfig.app.json", + "assets": [ + { + "glob": "**/*", + "input": "apps/beheer/public" + } + ], + "styles": ["apps/beheer/src/styles.css"] + }, + "configurations": { + "production": { + "budgets": [ + { + "type": "initial", + "maximumWarning": "1mb", + "maximumError": "2mb" + }, + { + "type": "anyComponentStyle", + "maximumWarning": "4kb", + "maximumError": "8kb" + } + ], + "outputHashing": "all" + }, + "development": { + "optimization": false, + "extractLicenses": false, + "sourceMap": true + } + } + }, + "serve": { + "continuous": true, + "executor": "@angular/build:dev-server", + "defaultConfiguration": "development", + "configurations": { + "production": { + "buildTarget": "beheer:build:production" + }, + "development": { + "buildTarget": "beheer:build:development" + } + } + }, + "lint": { + "executor": "@nx/eslint:lint" + }, + "test": { + "executor": "@angular/build:unit-test", + "options": { + "watch": false + } + }, + "serve-static": { + "continuous": true, + "executor": "@nx/web:file-server", + "options": { + "buildTarget": "beheer:build", + "staticFilePath": "dist/apps/beheer/browser", + "spa": true + } + } + } +} diff --git a/apps/beheer/public/config.json b/apps/beheer/public/config.json new file mode 100644 index 0000000..71c0f65 --- /dev/null +++ b/apps/beheer/public/config.json @@ -0,0 +1,3 @@ +{ + "authority": "http://localhost:8180/realms/medewerker" +} diff --git a/apps/beheer/public/favicon.ico b/apps/beheer/public/favicon.ico new file mode 100644 index 0000000000000000000000000000000000000000..317ebcb2336e0833a22dddf0ab287849f26fda57 GIT binary patch literal 15086 zcmeI332;U^%p|z7g|#(P)qFEA@4f!_@qOK2 z_lJl}!lhL!VT_U|uN7%8B2iKH??xhDa;*`g{yjTFWHvXn;2s{4R7kH|pKGdy(7z!K zgftM+Ku7~24TLlh(!g)gz|foI94G^t2^IO$uvX$3(OR0<_5L2sB)lMAMy|+`xodJ{ z_Uh_1m)~h?a;2W{dmhM;u!YGo=)OdmId_B<%^V^{ovI@y`7^g1_V9G}*f# zNzAtvou}I!W1#{M^@ROc(BZ! z+F!!_aR&Px3_reO(EW+TwlW~tv*2zr?iP7(d~a~yA|@*a89IUke+c472NXM0wiX{- zl`UrZC^1XYyf%1u)-Y)jj9;MZ!SLfd2Hl?o|80Su%Z?To_=^g_Jt0oa#CT*tjx>BI z16wec&AOWNK<#i0Qd=1O$fymLRoUR*%;h@*@v7}wApDl^w*h}!sYq%kw+DKDY)@&A z@9$ULEB3qkR#85`lb8#WZw=@})#kQig9oqy^I$dj&k4jU&^2(M3q{n1AKeGUKPFbr z1^<)aH;VsG@J|B&l>UtU#Ejv3GIqERzYgL@UOAWtW<{p#zy`WyJgpCy8$c_e%wYJL zyGHRRx38)HyjU3y{-4z6)pzb>&Q1pR)B&u01F-|&Gx4EZWK$nkUkOI|(D4UHOXg_- zw{OBf!oWQUn)Pe(=f=nt=zkmdjpO^o8ZZ9o_|4tW1ni+Un9iCW47*-ut$KQOww!;u z`0q)$s6IZO!~9$e_P9X!hqLxu`fpcL|2f^I5d4*a@Dq28;@2271v_N+5HqYZ>x;&O z05*7JT)mUe&%S0@UD)@&8SmQrMtsDfZT;fkdA!r(S=}Oz>iP)w=W508=Rc#nNn7ym z1;42c|8($ALY8#a({%1#IXbWn9-Y|0eDY$_L&j{63?{?AH{);EzcqfydD$@-B`Y3<%IIj7S7rK_N}je^=dEk%JQ4c z!tBdTPE3Tse;oYF>cnrapWq*o)m47X1`~6@(!Y29#>-#8zm&LXrXa(3=7Z)ElaQqj z-#0JJy3Fi(C#Rx(`=VXtJ63E2_bZGCz+QRa{W0e2(m3sI?LOcUBx)~^YCqZ{XEPX)C>G>U4tfqeH8L(3|pQR*zbL1 zT9e~4Tb5p9_G}$y4t`i*4t_Mr9QYvL9C&Ah*}t`q*}S+VYh0M6GxTTSXI)hMpMpIq zD1ImYqJLzbj0}~EpE-aH#VCH_udYEW#`P2zYmi&xSPs_{n6tBj=MY|-XrA;SGA_>y zGtU$?HXm$gYj*!N)_nQ59%lQdXtQZS3*#PC-{iB_sm+ytD*7j`D*k(P&IH2GHT}Eh z5697eQECVIGQAUe#eU2I!yI&%0CP#>%6MWV z@zS!p@+Y1i1b^QuuEF*13CuB zu69dve5k7&Wgb+^s|UB08Dr3u`h@yM0NTj4h7MnHo-4@xmyr7(*4$rpPwsCDZ@2be zRz9V^GnV;;?^Lk%ynzq&K(Aix`mWmW`^152Hoy$CTYVehpD-S1-W^#k#{0^L`V6CN+E z!w+xte;2vu4AmVNEFUOBmrBL>6MK@!O2*N|2=d|Y;oN&A&qv=qKn73lDD zI(+oJAdgv>Yr}8(&@ZuAZE%XUXmX(U!N+Z_sjL<1vjy1R+1IeHt`79fnYdOL{$ci7 z%3f0A*;Zt@ED&Gjm|OFTYBDe%bbo*xXAQsFz+Q`fVBH!N2)kaxN8P$c>sp~QXnv>b zwq=W3&Mtmih7xkR$YA)1Yi?avHNR6C99!u6fh=cL|KQ&PwF!n@ud^n(HNIImHD!h87!i*t?G|p0o+eelJ?B@A64_9%SBhNaJ64EvKgD&%LjLCYnNfc; znj?%*p@*?dq#NqcQFmmX($wms@CSAr9#>hUR^=I+=0B)vvGX%T&#h$kmX*s=^M2E!@N9#m?LhMvz}YB+kd zG~mbP|D(;{s_#;hsKK9lbVK&Lo734x7SIFJ9V_}2$@q?zm^7?*XH94w5Qae{7zOMUF z^?%F%)c1Y)Q?Iy?I>knw*8gYW#ok|2gdS=YYZLiD=CW|Nj;n^x!=S#iJ#`~Ld79+xXpVmUK^B(xO_vO!btA9y7w3L3-0j-y4 z?M-V{%z;JI`bk7yFDcP}OcCd*{Q9S5$iGA7*E1@tfkyjAi!;wP^O71cZ^Ep)qrQ)N z#wqw0_HS;T7x3y|`P==i3hEwK%|>fZ)c&@kgKO1~5<5xBSk?iZV?KI6&i72H6S9A* z=U(*e)EqEs?Oc04)V-~K5AUmh|62H4*`UAtItO$O(q5?6jj+K^oD!04r=6#dsxp?~}{`?&sXn#q2 zGuY~7>O2=!u@@Kfu7q=W*4egu@qPMRM>(eyYyaIE<|j%d=iWNdGsx%c!902v#ngNg z@#U-O_4xN$s_9?(`{>{>7~-6FgWpBpqXb`Ydc3OFL#&I}Irse9F_8R@4zSS*Y*o*B zXL?6*Aw!AfkNCgcr#*yj&p3ZDe2y>v$>FUdKIy_2N~}6AbHc7gA3`6$g@1o|dE>vz z4pl(j9;kyMsjaw}lO?(?Xg%4k!5%^t#@5n=WVc&JRa+XT$~#@rldvN3S1rEpU$;XgxVny7mki3 z-Hh|jUCHrUXuLr!)`w>wgO0N%KTB-1di>cj(x3Bav`7v z3G7EIbU$z>`Nad7Rk_&OT-W{;qg)-GXV-aJT#(ozdmnA~Rq3GQ_3mby(>q6Ocb-RgTUhTN)))x>m&eD;$J5Bg zo&DhY36Yg=J=$Z>t}RJ>o|@hAcwWzN#r(WJ52^g$lh^!63@hh+dR$&_dEGu&^CR*< z!oFqSqO@>xZ*nC2oiOd0eS*F^IL~W-rsrO`J`ej{=ou_q^_(<$&-3f^J z&L^MSYWIe{&pYq&9eGaArA~*kA { + let http: HttpTestingController; + let bff: BffApiV1Service; + const token = 'medewerker-access-token'; + + beforeEach(() => { + TestBed.configureTestingModule({ + providers: [ + provideHttpClient(withInterceptors([authInterceptor()])), + provideHttpClientTesting(), + { + provide: ConfigurationService, + useValue: { + hasAtLeastOneConfig: () => true, + getAllConfigurations: () => [{ configId: 'medewerker', secureRoutes: SECURE_API_ROUTES }], + }, + }, + { + // A signed-in session: the storage the interceptor's token lookup reads from. + provide: AbstractSecurityStorage, + useValue: { + read: () => JSON.stringify({ authzData: token, authnResult: { id_token: 'id-token' } }), + write: () => undefined, + remove: () => undefined, + clear: () => undefined, + }, + }, + ], + }); + http = TestBed.inject(HttpTestingController); + bff = TestBed.inject(BffApiV1Service); + }); + + afterEach(() => http.verify()); + + it('attaches the bearer token to the relative catalogus call', () => { + bff.getBeheerCatalogiZaaktypen().subscribe(); + + const req = http.expectOne('/beheer/catalogi/zaaktypen'); + expect(req.request.headers.get('Authorization')).toBe(`Bearer ${token}`); + req.flush([]); + }); + + it('leaves the anonymous openbaar register call unauthenticated', () => { + bff.getOpenbaarRegister().subscribe(); + + const req = http.expectOne((r) => r.url === '/openbaar/register'); + expect(req.request.headers.has('Authorization')).toBe(false); + req.flush([]); + }); +}); diff --git a/apps/beheer/src/app/app.config.ts b/apps/beheer/src/app/app.config.ts new file mode 100644 index 0000000..5785364 --- /dev/null +++ b/apps/beheer/src/app/app.config.ts @@ -0,0 +1,39 @@ +import { provideHttpClient, withInterceptors } from '@angular/common/http'; +import { ApplicationConfig, provideBrowserGlobalErrorListeners } from '@angular/core'; +import { provideRouter } from '@angular/router'; +import { authInterceptor, provideMedewerkerAuth } from 'auth'; +import { appRoutes } from './app.routes'; + +/** Environment-specific settings fetched from /config.json at startup (see main.ts). */ +export interface RuntimeConfig { + /** The Keycloak `medewerker` realm issuer as the browser reaches it (dev: localhost; compose: keycloak:8080). */ + authority: string; +} + +/** + * Route prefixes whose requests carry the medewerker token. These MUST match the **relative** URLs + * the api-client actually calls (same-origin via the nginx proxy) — the interceptor matches on + * `req.url`, which stays relative, so an absolute origin would never match and the token would go + * unattached. Only `/beheer/` is secured; the app calls no other endpoint group. + */ +export const SECURE_API_ROUTES = ['/beheer/']; + +/** + * Build the app providers from runtime config. `redirectUrl` is the app's own origin (where Keycloak + * redirects back). `secureRoutes` uses {@link SECURE_API_ROUTES} — relative prefixes, not the origin. + */ +export function appConfig(runtime: RuntimeConfig): ApplicationConfig { + const origin = typeof window !== 'undefined' ? window.location.origin : '/'; + return { + providers: [ + provideBrowserGlobalErrorListeners(), + provideRouter(appRoutes), + provideHttpClient(withInterceptors([authInterceptor()])), + provideMedewerkerAuth({ + authority: runtime.authority, + redirectUrl: origin, + secureRoutes: SECURE_API_ROUTES, + }), + ], + }; +} diff --git a/apps/beheer/src/app/app.css b/apps/beheer/src/app/app.css new file mode 100644 index 0000000..e69de29 diff --git a/apps/beheer/src/app/app.html b/apps/beheer/src/app/app.html new file mode 100644 index 0000000..0680b43 --- /dev/null +++ b/apps/beheer/src/app/app.html @@ -0,0 +1 @@ + diff --git a/apps/beheer/src/app/app.routes.ts b/apps/beheer/src/app/app.routes.ts new file mode 100644 index 0000000..942b1be --- /dev/null +++ b/apps/beheer/src/app/app.routes.ts @@ -0,0 +1,7 @@ +import { Route } from '@angular/router'; +import { authenticatedGuard } from 'auth'; +import { CatalogusPage } from './catalogus/catalogus-page'; + +export const appRoutes: Route[] = [ + { path: '', component: CatalogusPage, canActivate: [authenticatedGuard] }, +]; diff --git a/apps/beheer/src/app/app.spec.ts b/apps/beheer/src/app/app.spec.ts new file mode 100644 index 0000000..3ac05ab --- /dev/null +++ b/apps/beheer/src/app/app.spec.ts @@ -0,0 +1,15 @@ +import { provideRouter } from '@angular/router'; +import { render, screen } from '@testing-library/angular'; +import { App } from './app'; + +describe('App', () => { + it('renders the router outlet shell', async () => { + const { container } = await render(App, { + providers: [provideRouter([])], + }); + + // The shell is a thin host for routed pages (the CatalogusPage owns the heading). + expect(container.querySelector('router-outlet')).toBeTruthy(); + expect(screen).toBeTruthy(); + }); +}); diff --git a/apps/beheer/src/app/app.ts b/apps/beheer/src/app/app.ts new file mode 100644 index 0000000..ba93fca --- /dev/null +++ b/apps/beheer/src/app/app.ts @@ -0,0 +1,12 @@ +import { Component } from '@angular/core'; +import { RouterModule } from '@angular/router'; + +@Component({ + imports: [RouterModule], + selector: 'app-root', + templateUrl: './app.html', + styleUrl: './app.css', +}) +export class App { + protected title = 'beheer'; +} diff --git a/apps/beheer/src/app/catalogus/catalogus-page.html b/apps/beheer/src/app/catalogus/catalogus-page.html new file mode 100644 index 0000000..e9767e7 --- /dev/null +++ b/apps/beheer/src/app/catalogus/catalogus-page.html @@ -0,0 +1,40 @@ +
+ + Catalogus +

+ De gepubliceerde zaaktypen uit de ZTC-catalogus. Alleen-lezen — beheer van de default-fill volgt + in een latere slice. +

+ + @if (loading()) { +

Bezig met laden…

+ } @else if (failed()) { +

+ Kon de catalogus niet laden. Controleer of je als beheerder bent ingelogd en probeer het + opnieuw. +

+ } @else if (loaded() && items().length === 0) { +

De catalogus bevat geen gepubliceerde zaaktypen.

+ } @else if (items().length > 0) { + + + + + + + + + + @for (zaaktype of items(); track zaaktype.identificatie) { + + + + + } + +
+ Gepubliceerde zaaktypen +
IdentificatieOmschrijving
{{ zaaktype.identificatie }}{{ zaaktype.omschrijving }}
+ } + +
diff --git a/apps/beheer/src/app/catalogus/catalogus-page.spec.ts b/apps/beheer/src/app/catalogus/catalogus-page.spec.ts new file mode 100644 index 0000000..897aa0e --- /dev/null +++ b/apps/beheer/src/app/catalogus/catalogus-page.spec.ts @@ -0,0 +1,75 @@ +import { signal } from '@angular/core'; +import { render, screen } from '@testing-library/angular'; +import { of, throwError } from 'rxjs'; +import { BeheerZaaktype, BffApiV1Service } from 'api-client'; +import { AuthService } from 'auth'; +import { axe } from 'vitest-axe'; +import { CatalogusPage } from './catalogus-page'; + +const sample: BeheerZaaktype[] = [ + { identificatie: 'BIG-REGISTRATIE', omschrijving: 'BIG-registratie' }, + { identificatie: 'BIG-HERREGISTRATIE', omschrijving: 'BIG-herregistratie' }, +]; + +class FakeAuth extends AuthService { + readonly isAuthenticated = signal(true); + readonly bsn = signal(undefined); + override readonly roles = signal(['beheerder']); + login(): void { + /* not exercised here */ + } + logout(): void { + /* not exercised here */ + } +} + +function setup(overrides: { getBeheerCatalogiZaaktypen?: ReturnType } = {}) { + const getBeheerCatalogiZaaktypen = + overrides.getBeheerCatalogiZaaktypen ?? vi.fn().mockReturnValue(of(sample)); + return { + getBeheerCatalogiZaaktypen, + providers: [ + { provide: BffApiV1Service, useValue: { getBeheerCatalogiZaaktypen } }, + { provide: AuthService, useClass: FakeAuth }, + ], + }; +} + +describe('CatalogusPage', () => { + it('lists the published zaaktypen on open', async () => { + const { getBeheerCatalogiZaaktypen, providers } = setup(); + await render(CatalogusPage, { providers }); + + expect(getBeheerCatalogiZaaktypen).toHaveBeenCalled(); + expect(await screen.findByText('BIG-REGISTRATIE')).toBeTruthy(); + expect(screen.getByText('BIG-registratie')).toBeTruthy(); + expect(screen.getByText('BIG-HERREGISTRATIE')).toBeTruthy(); + }); + + it('shows an empty state when the catalogus has no published zaaktypen', async () => { + const { providers } = setup({ getBeheerCatalogiZaaktypen: vi.fn().mockReturnValue(of([])) }); + await render(CatalogusPage, { providers }); + + expect(await screen.findByText(/geen gepubliceerde zaaktypen/i)).toBeTruthy(); + }); + + it('surfaces a load failure instead of swallowing it', async () => { + const { providers } = setup({ + getBeheerCatalogiZaaktypen: vi.fn().mockReturnValue(throwError(() => new Error('403'))), + }); + await render(CatalogusPage, { providers }); + + expect(await screen.findByText(/kon de catalogus niet laden/i)).toBeTruthy(); + }); + + it('has no WCAG 2.1 AA violations', async () => { + document.documentElement.lang = 'nl'; + const { container } = await render(CatalogusPage, { providers: setup().providers }); + + const results = await axe(container, { + runOnly: { type: 'tag', values: ['wcag2a', 'wcag2aa', 'wcag21a', 'wcag21aa'] }, + }); + + expect(results.violations).toEqual([]); + }); +}); diff --git a/apps/beheer/src/app/catalogus/catalogus-page.ts b/apps/beheer/src/app/catalogus/catalogus-page.ts new file mode 100644 index 0000000..b4922c0 --- /dev/null +++ b/apps/beheer/src/app/catalogus/catalogus-page.ts @@ -0,0 +1,26 @@ +import { Component, inject, signal } from '@angular/core'; +import { BeheerZaaktype, BffApiV1Service } from 'api-client'; +import { UtrechtComponentsModule } from 'ui'; + +/** + * The beheer catalogus viewer (S-15a): a signed-in beheerder sees the published ZTC zaaktypen, + * read-only. The list is served by the BFF (`GET /beheer/catalogi/zaaktypen`), which proxies the ACL — + * the only code allowed to read the ZGW Catalogi API (§8.1, ADR-0025). Managing default-fill is S-15b. + */ +@Component({ + selector: 'app-catalogus-page', + imports: [UtrechtComponentsModule], + templateUrl: './catalogus-page.html', +}) +export class CatalogusPage { + private readonly bff = inject(BffApiV1Service); + + protected readonly items = signal([]); + protected readonly loading = signal(false); + protected readonly loaded = signal(false); + protected readonly failed = signal(false); + + constructor() { + // ponytail: stub for the red test; the real load lands in the green commit. + } +} diff --git a/apps/beheer/src/index.html b/apps/beheer/src/index.html new file mode 100644 index 0000000..0ae574b --- /dev/null +++ b/apps/beheer/src/index.html @@ -0,0 +1,13 @@ + + + + + Beheerportaal BIG-register + + + + + + + + diff --git a/apps/beheer/src/main.ts b/apps/beheer/src/main.ts new file mode 100644 index 0000000..29b0198 --- /dev/null +++ b/apps/beheer/src/main.ts @@ -0,0 +1,10 @@ +import { bootstrapApplication } from '@angular/platform-browser'; +import { App } from './app/app'; +import { appConfig, type RuntimeConfig } from './app/app.config'; + +// Load environment config before bootstrap so the OIDC authority is set per environment +// (dev: localhost; compose: keycloak:8080) from a single build — 12-factor (S-08d). +fetch('config.json') + .then((response) => response.json() as Promise) + .then((config) => bootstrapApplication(App, appConfig(config))) + .catch((err) => console.error(err)); diff --git a/apps/beheer/src/styles.css b/apps/beheer/src/styles.css new file mode 100644 index 0000000..ade77c5 --- /dev/null +++ b/apps/beheer/src/styles.css @@ -0,0 +1,2 @@ +/* NL Design System theme — Utrecht design tokens (docs/frontend-decisions.md). */ +@import '@utrecht/design-tokens/dist/index.css'; diff --git a/apps/beheer/tsconfig.app.json b/apps/beheer/tsconfig.app.json new file mode 100644 index 0000000..a75ddab --- /dev/null +++ b/apps/beheer/tsconfig.app.json @@ -0,0 +1,9 @@ +{ + "extends": "./tsconfig.json", + "compilerOptions": { + "outDir": "../../dist/out-tsc", + "types": [] + }, + "include": ["src/**/*.ts"], + "exclude": ["src/**/*.spec.ts", "src/**/*.test.ts"] +} diff --git a/apps/beheer/tsconfig.json b/apps/beheer/tsconfig.json new file mode 100644 index 0000000..bb7614f --- /dev/null +++ b/apps/beheer/tsconfig.json @@ -0,0 +1,31 @@ +{ + "extends": "../../tsconfig.base.json", + "compilerOptions": { + "strict": true, + "noImplicitOverride": true, + "noPropertyAccessFromIndexSignature": true, + "noImplicitReturns": true, + "noFallthroughCasesInSwitch": true, + "isolatedModules": true, + "target": "es2022", + "moduleResolution": "bundler", + "emitDecoratorMetadata": false, + "module": "preserve" + }, + "angularCompilerOptions": { + "enableI18nLegacyMessageIdFormat": false, + "strictInjectionParameters": true, + "strictInputAccessModifiers": true, + "strictTemplates": true + }, + "files": [], + "include": [], + "references": [ + { + "path": "./tsconfig.app.json" + }, + { + "path": "./tsconfig.spec.json" + } + ] +} diff --git a/apps/beheer/tsconfig.spec.json b/apps/beheer/tsconfig.spec.json new file mode 100644 index 0000000..2d36c49 --- /dev/null +++ b/apps/beheer/tsconfig.spec.json @@ -0,0 +1,8 @@ +{ + "extends": "./tsconfig.json", + "compilerOptions": { + "outDir": "../../dist/out-tsc", + "types": ["vitest/globals"] + }, + "include": ["src/**/*.ts", "src/**/*.d.ts"] +}