feat(domain): virus-scan and PDF-check uploaded diplomas with ClamAV (closes #192) #194

2026-10-02T07:30:31Z

not commented

2026-10-02 07:30:31 +00:00

Uploaded diplomas are now virus-scanned and type-checked before they reach OpenZaak (ADR-0036). Builds on #193 (clamd infra, merged).

What changes

Domain: a new IDocumentScanner port, implemented by ClamdDocumentScanner (clamd INSTREAM over TcpClient, no NuGet package). ProvideDocuments checks ownership, then scans, then checks for %PDF-, and only then stores the file and completes the wait. New outcomes: Infected, NotAPdf, ScannerUnavailable. The API answers 422 {reason} or 503.
Fail closed: an unreachable clamd, a timeout or an ERROR reply all count as Unavailable. The upload is refused, nothing is stored and the wait stays open.
The scan runs before the PDF check: clamd only matches EICAR at the start of a file (verified against a real clamd: %PDF-1.4\n + EICAR scans OK), so a PDF check in front of the scan would report malware as "not a PDF".
BFF: relays 422 with the reason and 503. openapi.json and the generated client are regenerated.
Self-service portal: a specific, accessible role="alert" message for infected, not-a-PDF and scanner-unavailable.
Acceptance: EenDiplomaAanleveren.feature has four scenarios (clean, infected, not a PDF, scanner down).

Verified locally: every .NET unit and acceptance suite is green, as are the self-service vitest + axe tests and dotnet format. The adapter was run against a real clamd 1.4.6: clean gives Clean, EICAR gives Infected, a closed port gives Unavailable. The existing e2e and local-flow uploads begin with %PDF- and are clean, so the happy path is unchanged.
Not run: the full verify-stack (main only) and a Playwright e2e for the infected path. That path is covered by unit, BFF, portal and acceptance tests, plus verify-clamav for the live engine.

closes #192

🤖 Generated with Claude Code

Uploaded diplomas are now virus-scanned and type-checked before they reach OpenZaak (ADR-0036). Builds on #193 (clamd infra, merged). **What changes** - **Domain:** a new `IDocumentScanner` port, implemented by `ClamdDocumentScanner` (clamd INSTREAM over `TcpClient`, no NuGet package). `ProvideDocuments` checks ownership, then scans, then checks for `%PDF-`, and only then stores the file and completes the wait. New outcomes: `Infected`, `NotAPdf`, `ScannerUnavailable`. The API answers 422 `{reason}` or 503. - **Fail closed:** an unreachable clamd, a timeout or an ERROR reply all count as `Unavailable`. The upload is refused, nothing is stored and the wait stays open. - **The scan runs before the PDF check:** clamd only matches EICAR at the start of a file (verified against a real clamd: `%PDF-1.4\n` + EICAR scans `OK`), so a PDF check in front of the scan would report malware as "not a PDF". - **BFF:** relays 422 with the reason and 503. `openapi.json` and the generated client are regenerated. - **Self-service portal:** a specific, accessible `role="alert"` message for infected, not-a-PDF and scanner-unavailable. - **Acceptance:** `EenDiplomaAanleveren.feature` has four scenarios (clean, infected, not a PDF, scanner down). **Verified locally:** every .NET unit and acceptance suite is green, as are the self-service vitest + axe tests and `dotnet format`. The adapter was run against a real clamd 1.4.6: clean gives Clean, EICAR gives Infected, a closed port gives Unavailable. The existing e2e and local-flow uploads begin with `%PDF-` and are clean, so the happy path is unchanged. **Not run:** the full verify-stack (main only) and a Playwright e2e for the infected path. That path is covered by unit, BFF, portal and acceptance tests, plus `verify-clamav` for the live engine. closes #192 🤖 Generated with [Claude Code](https://claude.com/claude-code)

not added this to the Iteration 6 — Production Posture milestone 2026-10-02 07:30:31 +00:00

not added the type:slice area:domain area:portal-self-service area:bff labels 2026-10-02 07:30:33 +00:00

not changed target branch from build/191-clamav to main

2026-10-02 07:53:33 +00:00

not added 12 commits 2026-10-02 07:53:33 +00:00

test(domain): only a clean PDF diploma is stored and unblocks beoordeling (refs #192 ) eaef19747b

Red: ProvideDocuments takes the new IDocumentScanner port but ignores it, so
infected, non-PDF and scanner-unavailable uploads are still Accepted.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

feat(domain): refuse non-PDF, infected or unscannable diplomas before storing (refs #192 ) 764ae6e1be

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

test(domain): clamd INSTREAM adapter maps replies to scan verdicts (refs #192 ) 64dd5420d7

Red: the stub adapter never connects and always answers Clean.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

feat(domain): scan uploads with clamd over INSTREAM; 422 refused, 503 scanner down (refs #192 ) d2c035679b

Verified against a real clamd 1.4.6: clean → Clean, EICAR → Infected,
closed port → Unavailable.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

test(bff): relay a refused diploma as 422 with its reason, a down scanner as 503 (refs #192 ) 77de63bf8b

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

feat(bff): relay refused diplomas as 422 with reason, scanner down as 503 (refs #192 ) da7813a84e

openapi.json and the generated portal client regenerated from the served spec.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

test(portal-self-service): explain a refused or unscannable diploma upload (refs #192 ) e15253487e

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

feat(portal-self-service): tell the citizen why a diploma upload was refused (refs #192 ) 5ceace718a

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

fix(test): acceptance BFF fake returns the provide-documents result (refs #192 ) 38026879c7

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

test(domain): malware is reported infected even when the file is not a PDF (refs #192 ) c245182c87

clamd matches EICAR only at the start of a file, so a %PDF- check ahead of the
scan made the infected path unreachable for the EICAR test file.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

feat(domain): scan before the PDF check so malware is always reported as infected (refs #192 ) 4e7e0526b2

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

docs: demo note and backlog mirror for S-28/S-29 (refs #192 ) 940aac7d25

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

not closed this pull request

2026-10-02 07:53:50 +00:00

not reopened this pull request

2026-10-02 07:53:50 +00:00

not added 1 commit 2026-10-02 10:54:45 +00:00

test(domain): cover clamd timeout, caller cancellation, null content and defaults (refs #192 )

CI / k8s (pull_request) Successful in 8s

Details

CI / lint (pull_request) Successful in 1m47s

Details

CI / build (pull_request) Successful in 1m38s

Details

CI / docs (pull_request) Successful in 55s

Details

CI / unit (pull_request) Successful in 1m13s

Details

CI / frontend (pull_request) Successful in 2m24s

Details

CI / mutation (pull_request) Successful in 4m42s

Details

CI / verify-stack (pull_request) Skipped

Details

254b1796dc

Domain mutation score 89.87% → 91.98%, back above the 90% break.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

not force-pushed feat/192-scan-uploads from e39a46febc to 254b1796dc

2026-10-02 10:54:45 +00:00

Compare

not referenced this pull request

2026-10-02 10:55:34 +00:00

docs(runbook): stale "out-of-date" PR after a stacked PR is retargeted #195

not referenced this pull request

2026-10-02 10:56:32 +00:00

docs(runbook): stale "out-of-date" PR after a stacked PR is retargeted (closes #195) #196

All checks were successful

CI / k8s (pull_request) Successful in 8s

Details

CI / lint (pull_request) Successful in 1m47s

Required

Details

CI / build (pull_request) Successful in 1m38s

Required

Details

CI / docs (pull_request) Successful in 55s

Details

CI / unit (pull_request) Successful in 1m13s

Required

Details

CI / frontend (pull_request) Successful in 2m24s

Required

Details

CI / mutation (pull_request) Successful in 4m42s

Required

Details

CI / verify-stack (pull_request) Skipped

Details

You are not authorized to merge this pull request.

This pull request can be merged automatically.

View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.

git fetch -u origin feat/192-scan-uploads:feat/192-scan-uploads

git checkout feat/192-scan-uploads

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: eho/register-referentie#194