eho/register-referentie
1
0
Fork 0
Code Issues 17 Pull Requests Actions Packages Projects Releases Wiki Activity

arch(bff): ADR-0010 BFF OIDC validation + downstream boundaries (refs #8, #63)

Browse Source 
The BFF is the portals' only backend (§8.3): it validates Keycloak digid-realm
JWTs on POST /self-service/registrations (extracting bsn → domain), leaves
GET /openbaar/register anonymous (public lookup, S-09), and fans out to the
domain and projection over typed HTTP clients. Tests mint tokens with a test
signing key; real Keycloak validation is a live-stack verify-bff check. Records
the container OIDC issuer-mismatch wrinkle. OpenAPI is generated + committed for
the S-08 client.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This commit is contained in:
Niek Otten
2026-07-01 10:51:59 +02:00
parent 2f5d656b54
commit fea806848b
2 changed files with 75 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
mkdocs.yml
View File

@@ -31,6 +31,7 @@ nav:
- "ADR-0007: OpenZaak → NRC notification wiring": architecture/adr-0007-notification-wiring.md
- "ADR-0008: Read projection store": architecture/adr-0008-read-projection-store.md
- "ADR-0009: External-task job worker": architecture/adr-0009-external-task-job-worker.md
- "ADR-0010: BFF OIDC validation": architecture/adr-0010-bff-oidc.md
- Working in Gitea: gitea-workflow.md
- Demo script: demo-script.md
- Runbooks: