test(domain): only a clean PDF diploma is stored and unblocks beoordeling (refs #192)

Red: ProvideDocuments takes the new IDocumentScanner port but ignores it, so
infected, non-PDF and scanner-unavailable uploads are still Accepted.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

services/domain/Big.Tests/Fakes.cs

@@ -146,3 +146,14 @@ internal sealed class FakeAclClient(Uri? zaakUrl = null) : IAclClient
         return Task.CompletedTask;
     }
 }
+
+internal sealed class FakeDocumentScanner(ScanVerdict verdict = ScanVerdict.Clean) : IDocumentScanner
+{
+    public byte[]? Scanned { get; private set; }
+
+    public Task<ScanVerdict> ScanAsync(byte[] content, CancellationToken ct = default)
+    {
+        Scanned = content;
+        return Task.FromResult(verdict);
+    }
+}

services/domain/Big.Tests/ProvideDocumentsTests.cs

@@ -20,8 +20,10 @@ public class ProvideDocumentsTests
         return registration;
     }
 
-    private static ProvideDocumentsCommand Command(RegistrationId id, string bsn = Bsn) =>
-        new(id, bsn, [1, 2, 3], "diploma.pdf", "application/pdf");
+    private static readonly byte[] Pdf = "%PDF-1.4 diploma"u8.ToArray();
+
+    private static ProvideDocumentsCommand Command(RegistrationId id, string bsn = Bsn, byte[]? content = null) =>
+        new(id, bsn, content ?? Pdf, "diploma.pdf", "application/pdf");
 
     [Fact]
     public async Task Providing_documents_stores_the_diploma_and_completes_the_wait()
@@ -31,13 +33,13 @@ public class ProvideDocumentsTests
         store.Seed(registration);
         var workflow = new FakeWorkflowClient();
         var acl = new FakeAclClient();
-        var handler = new ProvideDocuments(store, workflow, acl);
+        var handler = new ProvideDocuments(store, workflow, acl, new FakeDocumentScanner());
 
         var outcome = await handler.HandleAsync(Command(registration.Id));
 
         Assert.Equal(ProvideDocumentsOutcome.Accepted, outcome);
         // Stored against the registration's zaak, carrying the uploaded bytes + file metadata.
-        Assert.Equal((Zaak, new byte[] { 1, 2, 3 }, "diploma.pdf", "application/pdf"), acl.StoredDiploma);
+        Assert.Equal((Zaak, Pdf, "diploma.pdf", "application/pdf"), acl.StoredDiploma);
         // …and the wait is completed so beoordeling can proceed.
         Assert.Equal("proc-42", workflow.CompletedDocumentWaitFor);
     }
@@ -51,7 +53,7 @@ public class ProvideDocumentsTests
         store.Seed(registration);
         var workflow = new FakeWorkflowClient();
         var acl = new FakeAclClient();
-        var handler = new ProvideDocuments(store, workflow, acl);
+        var handler = new ProvideDocuments(store, workflow, acl, new FakeDocumentScanner());
 
         var outcome = await handler.HandleAsync(Command(registration.Id, bsn: "999999990"));
 
@@ -64,7 +66,7 @@ public class ProvideDocumentsTests
     public async Task Providing_for_an_unknown_registration_is_not_found()
     {
         var store = new FakeRegistrationStore();
-        var handler = new ProvideDocuments(store, new FakeWorkflowClient(), new FakeAclClient());
+        var handler = new ProvideDocuments(store, new FakeWorkflowClient(), new FakeAclClient(), new FakeDocumentScanner());
 
         Assert.Equal(ProvideDocumentsOutcome.NotFound, await handler.HandleAsync(Command(RegistrationId.New())));
     }
@@ -80,7 +82,7 @@ public class ProvideDocumentsTests
         store.Seed(registration);
         var workflow = new FakeWorkflowClient();
         var acl = new FakeAclClient();
-        var handler = new ProvideDocuments(store, workflow, acl);
+        var handler = new ProvideDocuments(store, workflow, acl, new FakeDocumentScanner());
 
         var outcome = await handler.HandleAsync(Command(registration.Id));
 
@@ -89,8 +91,78 @@ public class ProvideDocumentsTests
         Assert.Equal("proc-9", workflow.CompletedDocumentWaitFor);
     }
 
+    // S-29 (#192, ADR-0036): only a clean PDF is stored and unblocks beoordeling.
+    [Theory]
+    [InlineData(ScanVerdict.Infected, ProvideDocumentsOutcome.Infected)]
+    [InlineData(ScanVerdict.Unavailable, ProvideDocumentsOutcome.ScannerUnavailable)]
+    public async Task A_document_that_does_not_scan_clean_is_refused_and_the_wait_stays_open(
+        ScanVerdict verdict, ProvideDocumentsOutcome expected)
+    {
+        var store = new FakeRegistrationStore();
+        var registration = Submitted();
+        store.Seed(registration);
+        var workflow = new FakeWorkflowClient();
+        var acl = new FakeAclClient();
+        var handler = new ProvideDocuments(store, workflow, acl, new FakeDocumentScanner(verdict));
+
+        var outcome = await handler.HandleAsync(Command(registration.Id));
+
+        Assert.Equal(expected, outcome);
+        Assert.Null(acl.StoredDiploma);
+        Assert.Null(workflow.CompletedDocumentWaitFor);
+    }
+
+    [Fact]
+    public async Task A_file_that_is_not_a_pdf_is_refused_without_being_scanned()
+    {
+        var store = new FakeRegistrationStore();
+        var registration = Submitted();
+        store.Seed(registration);
+        var workflow = new FakeWorkflowClient();
+        var acl = new FakeAclClient();
+        var scanner = new FakeDocumentScanner();
+        var handler = new ProvideDocuments(store, workflow, acl, scanner);
+
+        var outcome = await handler.HandleAsync(Command(registration.Id, content: "MZ not a pdf"u8.ToArray()));
+
+        Assert.Equal(ProvideDocumentsOutcome.NotAPdf, outcome);
+        Assert.Null(scanner.Scanned);
+        Assert.Null(acl.StoredDiploma);
+        Assert.Null(workflow.CompletedDocumentWaitFor);
+    }
+
+    [Fact]
+    public async Task A_clean_pdf_is_scanned_before_it_is_stored()
+    {
+        var store = new FakeRegistrationStore();
+        var registration = Submitted();
+        store.Seed(registration);
+        var scanner = new FakeDocumentScanner();
+        var handler = new ProvideDocuments(store, new FakeWorkflowClient(), new FakeAclClient(), scanner);
+
+        await handler.HandleAsync(Command(registration.Id));
+
+        Assert.Equal(Pdf, scanner.Scanned);
+    }
+
+    [Fact]
+    public async Task A_different_bsn_learns_nothing_about_the_scan()
+    {
+        // Ownership is checked first: someone else's registration is NotFound even for an infected file.
+        var store = new FakeRegistrationStore();
+        var registration = Submitted();
+        store.Seed(registration);
+        var scanner = new FakeDocumentScanner(ScanVerdict.Infected);
+        var handler = new ProvideDocuments(store, new FakeWorkflowClient(), new FakeAclClient(), scanner);
+
+        var outcome = await handler.HandleAsync(Command(registration.Id, bsn: "999999990"));
+
+        Assert.Equal(ProvideDocumentsOutcome.NotFound, outcome);
+        Assert.Null(scanner.Scanned);
+    }
+
     [Fact]
     public async Task Rejects_a_null_command()
         => await Assert.ThrowsAsync<ArgumentNullException>(() =>
-            new ProvideDocuments(new FakeRegistrationStore(), new FakeWorkflowClient(), new FakeAclClient()).HandleAsync(null!));
+            new ProvideDocuments(new FakeRegistrationStore(), new FakeWorkflowClient(), new FakeAclClient(), new FakeDocumentScanner()).HandleAsync(null!));
 }