S-29 · Uploaded diplomas are virus-scanned and PDF-checked before storage #192

New Issue

2026-10-02T06:59:40Z

not commented

2026-10-02 06:59:40 +00:00

Outcome: a zorgprofessional who uploads an infected file, or a file that is not a PDF, is told the upload is refused; the file is never stored in OpenZaak and the registration keeps waiting for a valid diploma.

Acceptance:

Scenario: an infected diploma is refused
  Given a registration waiting for documents
  When the zorgprofessional uploads a file containing the EICAR test signature
  Then the upload is refused as unsafe
  And no document is stored against the zaak
  And the registration still waits for documents

Scenario: a file that is not a PDF is refused
  When the zorgprofessional uploads a file that does not start with "%PDF-"
  Then the upload is refused as not a PDF

Scenario: the scanner is unavailable
  When clamd cannot be reached
  Then the upload is refused as temporarily unavailable and nothing is stored

Domain: IDocumentScanner port in Big.Application; ProvideDocuments returns new outcomes Rejected / ScannerUnavailable; clamd INSTREAM adapter in Big.Infrastructure (no NuGet).
Domain API: 422 for rejected, 503 for scanner unavailable; BFF passes both through; the self-service portal shows an accessible error message.
A clean PDF follows today's flow unchanged.

Touches: services/domain/*, services/bff/Bff.Api, apps/self-service/src/app/registration, tests/acceptance, docs/demo-script.md.

Out of scope: quarantine storage of infected files; notifying a behandelaar; file-size limits beyond the existing request limit.

Depends on #191 (ClamAV infra) and #190 (ADR).

Definition of Done

This linked Gitea issue exists and is on the right milestone.
Failing test written and committed first (test(scope): … (refs #NN)).
Implementation makes the test pass (feat(scope): … (refs #NN)).
Refactor commit follows if structure improved.
Conventional Commit messages referencing this issue.
All Gitea Actions CI jobs green (or make ci green while no runner exists).
docker compose up from a fresh clone reaches green health checks within 3 minutes.
Docs touched if behaviour, contracts, or operations changed.
ADR added in docs/architecture/ if a non-obvious decision was made.
Demo note appended to docs/demo-script.md if the slice is user-visible.
This issue closed by the merging PR (closes #NN).

**Outcome:** a zorgprofessional who uploads an infected file, or a file that is not a PDF, is told the upload is refused; the file is never stored in OpenZaak and the registration keeps waiting for a valid diploma. **Acceptance:** ```gherkin Scenario: an infected diploma is refused Given a registration waiting for documents When the zorgprofessional uploads a file containing the EICAR test signature Then the upload is refused as unsafe And no document is stored against the zaak And the registration still waits for documents Scenario: a file that is not a PDF is refused When the zorgprofessional uploads a file that does not start with "%PDF-" Then the upload is refused as not a PDF Scenario: the scanner is unavailable When clamd cannot be reached Then the upload is refused as temporarily unavailable and nothing is stored ``` - Domain: `IDocumentScanner` port in `Big.Application`; `ProvideDocuments` returns new outcomes `Rejected` / `ScannerUnavailable`; clamd INSTREAM adapter in `Big.Infrastructure` (no NuGet). - Domain API: 422 for rejected, 503 for scanner unavailable; BFF passes both through; the self-service portal shows an accessible error message. - A clean PDF follows today's flow unchanged. **Touches:** `services/domain/*`, `services/bff/Bff.Api`, `apps/self-service/src/app/registration`, `tests/acceptance`, `docs/demo-script.md`. **Out of scope:** quarantine storage of infected files; notifying a behandelaar; file-size limits beyond the existing request limit. Depends on #191 (ClamAV infra) and #190 (ADR). ## Definition of Done - [ ] This linked Gitea issue exists and is on the right milestone. - [ ] Failing test written and committed first (`test(scope): … (refs #NN)`). - [ ] Implementation makes the test pass (`feat(scope): … (refs #NN)`). - [ ] Refactor commit follows if structure improved. - [ ] Conventional Commit messages referencing this issue. - [ ] All Gitea Actions CI jobs green (or `make ci` green while no runner exists). - [ ] `docker compose up` from a fresh clone reaches green health checks within 3 minutes. - [ ] Docs touched if behaviour, contracts, or operations changed. - [ ] ADR added in `docs/architecture/` if a non-obvious decision was made. - [ ] Demo note appended to `docs/demo-script.md` if the slice is user-visible. - [ ] This issue closed by the merging PR (`closes #NN`).

not added this to the Iteration 6 — Production Posture milestone 2026-10-02 06:59:40 +00:00

not added the type:slice area:domain area:portal-self-service area:bff labels 2026-10-02 06:59:42 +00:00

not referenced this issue

2026-10-02 07:03:11 +00:00

build(infra): run ClamAV in compose and on the cluster (closes #191) #193

not referenced a pull request that will close this issue

2026-10-02 07:30:31 +00:00

feat(domain): virus-scan and PDF-check uploaded diplomas with ClamAV (closes #192) #194