test(domain): only a clean PDF diploma is stored and unblocks beoordeling (refs #192)

Red: ProvideDocuments takes the new IDocumentScanner port but ignores it, so
infected, non-PDF and scanner-unavailable uploads are still Accepted.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

services/domain/Big.Application/Ports.cs

@@ -136,3 +136,22 @@ public sealed record EscalatieJob(string JobId, string ProcessInstanceId);
 /// cancels the case (ADR-0017).
 /// </summary>
 public sealed record RegistratieVerlopenJob(string JobId, RegistrationId RegistrationId);
+
+/// <summary>What a malware scan of an uploaded document found (S-29, ADR-0036).</summary>
+public enum ScanVerdict
+{
+    Clean,
+    Infected,
+
+    /// <summary>The scanner could not be reached or did not answer — the upload is refused (fail closed).</summary>
+    Unavailable,
+}
+
+/// <summary>
+/// The port to the malware scanner (S-29, ADR-0036). Implemented in Infrastructure over clamd's INSTREAM
+/// protocol. Never throws for a scanner outage: an unreachable scanner is <see cref="ScanVerdict.Unavailable"/>.
+/// </summary>
+public interface IDocumentScanner
+{
+    Task<ScanVerdict> ScanAsync(byte[] content, CancellationToken ct = default);
+}

services/domain/Big.Application/ProvideDocuments.cs

@@ -18,6 +18,15 @@ public enum ProvideDocumentsOutcome
     /// <summary>No registration with that id belongs to the caller — unknown, or owned by someone else
     /// (the two are deliberately indistinguishable, so the endpoint reveals neither).</summary>
     NotFound,
+
+    /// <summary>The file does not start with the PDF signature (<c>%PDF-</c>); nothing was stored.</summary>
+    NotAPdf,
+
+    /// <summary>The malware scan found something; nothing was stored and the wait stays open.</summary>
+    Infected,
+
+    /// <summary>The scanner could not be reached — refused rather than storing an unscanned file.</summary>
+    ScannerUnavailable,
 }
 
 /// <summary>
@@ -28,7 +37,7 @@ public enum ProvideDocumentsOutcome
 /// (mirroring <see cref="WithdrawRegistration"/>): storage needs an opened zaak, and completion needs a
 /// running process — a request that arrives before either still stands, storing/completing what it can.
 /// </summary>
-public sealed class ProvideDocuments(IRegistrationStore store, IWorkflowClient workflow, IAclClient acl)
+public sealed class ProvideDocuments(IRegistrationStore store, IWorkflowClient workflow, IAclClient acl, IDocumentScanner scanner)
 {
     public async Task<ProvideDocumentsOutcome> HandleAsync(ProvideDocumentsCommand command, CancellationToken ct = default)
     {

services/domain/Big.Tests/Fakes.cs

@@ -146,3 +146,14 @@ internal sealed class FakeAclClient(Uri? zaakUrl = null) : IAclClient
         return Task.CompletedTask;
     }
 }
+
+internal sealed class FakeDocumentScanner(ScanVerdict verdict = ScanVerdict.Clean) : IDocumentScanner
+{
+    public byte[]? Scanned { get; private set; }
+
+    public Task<ScanVerdict> ScanAsync(byte[] content, CancellationToken ct = default)
+    {
+        Scanned = content;
+        return Task.FromResult(verdict);
+    }
+}

services/domain/Big.Tests/ProvideDocumentsTests.cs

@@ -20,8 +20,10 @@ public class ProvideDocumentsTests
         return registration;
     }
 
-    private static ProvideDocumentsCommand Command(RegistrationId id, string bsn = Bsn) =>
-        new(id, bsn, [1, 2, 3], "diploma.pdf", "application/pdf");
+    private static readonly byte[] Pdf = "%PDF-1.4 diploma"u8.ToArray();
+
+    private static ProvideDocumentsCommand Command(RegistrationId id, string bsn = Bsn, byte[]? content = null) =>
+        new(id, bsn, content ?? Pdf, "diploma.pdf", "application/pdf");
 
     [Fact]
     public async Task Providing_documents_stores_the_diploma_and_completes_the_wait()
@@ -31,13 +33,13 @@ public class ProvideDocumentsTests
         store.Seed(registration);
         var workflow = new FakeWorkflowClient();
         var acl = new FakeAclClient();
-        var handler = new ProvideDocuments(store, workflow, acl);
+        var handler = new ProvideDocuments(store, workflow, acl, new FakeDocumentScanner());
 
         var outcome = await handler.HandleAsync(Command(registration.Id));
 
         Assert.Equal(ProvideDocumentsOutcome.Accepted, outcome);
         // Stored against the registration's zaak, carrying the uploaded bytes + file metadata.
-        Assert.Equal((Zaak, new byte[] { 1, 2, 3 }, "diploma.pdf", "application/pdf"), acl.StoredDiploma);
+        Assert.Equal((Zaak, Pdf, "diploma.pdf", "application/pdf"), acl.StoredDiploma);
         // …and the wait is completed so beoordeling can proceed.
         Assert.Equal("proc-42", workflow.CompletedDocumentWaitFor);
     }
@@ -51,7 +53,7 @@ public class ProvideDocumentsTests
         store.Seed(registration);
         var workflow = new FakeWorkflowClient();
         var acl = new FakeAclClient();
-        var handler = new ProvideDocuments(store, workflow, acl);
+        var handler = new ProvideDocuments(store, workflow, acl, new FakeDocumentScanner());
 
         var outcome = await handler.HandleAsync(Command(registration.Id, bsn: "999999990"));
 
@@ -64,7 +66,7 @@ public class ProvideDocumentsTests
     public async Task Providing_for_an_unknown_registration_is_not_found()
     {
         var store = new FakeRegistrationStore();
-        var handler = new ProvideDocuments(store, new FakeWorkflowClient(), new FakeAclClient());
+        var handler = new ProvideDocuments(store, new FakeWorkflowClient(), new FakeAclClient(), new FakeDocumentScanner());
 
         Assert.Equal(ProvideDocumentsOutcome.NotFound, await handler.HandleAsync(Command(RegistrationId.New())));
     }
@@ -80,7 +82,7 @@ public class ProvideDocumentsTests
         store.Seed(registration);
         var workflow = new FakeWorkflowClient();
         var acl = new FakeAclClient();
-        var handler = new ProvideDocuments(store, workflow, acl);
+        var handler = new ProvideDocuments(store, workflow, acl, new FakeDocumentScanner());
 
         var outcome = await handler.HandleAsync(Command(registration.Id));
 
@@ -89,8 +91,78 @@ public class ProvideDocumentsTests
         Assert.Equal("proc-9", workflow.CompletedDocumentWaitFor);
     }
 
+    // S-29 (#192, ADR-0036): only a clean PDF is stored and unblocks beoordeling.
+    [Theory]
+    [InlineData(ScanVerdict.Infected, ProvideDocumentsOutcome.Infected)]
+    [InlineData(ScanVerdict.Unavailable, ProvideDocumentsOutcome.ScannerUnavailable)]
+    public async Task A_document_that_does_not_scan_clean_is_refused_and_the_wait_stays_open(
+        ScanVerdict verdict, ProvideDocumentsOutcome expected)
+    {
+        var store = new FakeRegistrationStore();
+        var registration = Submitted();
+        store.Seed(registration);
+        var workflow = new FakeWorkflowClient();
+        var acl = new FakeAclClient();
+        var handler = new ProvideDocuments(store, workflow, acl, new FakeDocumentScanner(verdict));
+
+        var outcome = await handler.HandleAsync(Command(registration.Id));
+
+        Assert.Equal(expected, outcome);
+        Assert.Null(acl.StoredDiploma);
+        Assert.Null(workflow.CompletedDocumentWaitFor);
+    }
+
+    [Fact]
+    public async Task A_file_that_is_not_a_pdf_is_refused_without_being_scanned()
+    {
+        var store = new FakeRegistrationStore();
+        var registration = Submitted();
+        store.Seed(registration);
+        var workflow = new FakeWorkflowClient();
+        var acl = new FakeAclClient();
+        var scanner = new FakeDocumentScanner();
+        var handler = new ProvideDocuments(store, workflow, acl, scanner);
+
+        var outcome = await handler.HandleAsync(Command(registration.Id, content: "MZ not a pdf"u8.ToArray()));
+
+        Assert.Equal(ProvideDocumentsOutcome.NotAPdf, outcome);
+        Assert.Null(scanner.Scanned);
+        Assert.Null(acl.StoredDiploma);
+        Assert.Null(workflow.CompletedDocumentWaitFor);
+    }
+
+    [Fact]
+    public async Task A_clean_pdf_is_scanned_before_it_is_stored()
+    {
+        var store = new FakeRegistrationStore();
+        var registration = Submitted();
+        store.Seed(registration);
+        var scanner = new FakeDocumentScanner();
+        var handler = new ProvideDocuments(store, new FakeWorkflowClient(), new FakeAclClient(), scanner);
+
+        await handler.HandleAsync(Command(registration.Id));
+
+        Assert.Equal(Pdf, scanner.Scanned);
+    }
+
+    [Fact]
+    public async Task A_different_bsn_learns_nothing_about_the_scan()
+    {
+        // Ownership is checked first: someone else's registration is NotFound even for an infected file.
+        var store = new FakeRegistrationStore();
+        var registration = Submitted();
+        store.Seed(registration);
+        var scanner = new FakeDocumentScanner(ScanVerdict.Infected);
+        var handler = new ProvideDocuments(store, new FakeWorkflowClient(), new FakeAclClient(), scanner);
+
+        var outcome = await handler.HandleAsync(Command(registration.Id, bsn: "999999990"));
+
+        Assert.Equal(ProvideDocumentsOutcome.NotFound, outcome);
+        Assert.Null(scanner.Scanned);
+    }
+
     [Fact]
     public async Task Rejects_a_null_command()
         => await Assert.ThrowsAsync<ArgumentNullException>(() =>
-            new ProvideDocuments(new FakeRegistrationStore(), new FakeWorkflowClient(), new FakeAclClient()).HandleAsync(null!));
+            new ProvideDocuments(new FakeRegistrationStore(), new FakeWorkflowClient(), new FakeAclClient(), new FakeDocumentScanner()).HandleAsync(null!));
 }