feat(#78): one citizen reference across self-service and the openbaar register #79

2026-07-14T12:47:42Z

not commented

2026-07-14 12:47:42 +00:00

What & why

Before this change the self-service confirmation and the openbaar register showed different identifiers, so a citizen could not look their registration back up (#78). Now both surface the same reference:

domain → ACL (write): the domain registrationId is set as the zaak's identificatie on POST /zaken.
event-subscriber → ACL (read): the subscriber reads the zaak's identificatie back through the ACL (§8.1 — only the ACL talks to ZGW) via a new POST /zaken/reference, and stores it on the projection row and the processed_notifications replay log.
BFF + openbaar: the public view exposes id/status/reference (never bsn/naam) and searches by id or reference; the register's "Referentie" column shows the reference.

Storing the reference in the replay log keeps ADR-0008's rebuild-is-log-only invariant intact — /admin/rebuild reproduces the reference without re-reading the ACL.

Decision recorded in ADR-0012.

Definition of Done

Linked issue: adr-proposal: correlate the citizen reference with the openbaar register (enrich projection via the ACL) (#78)
Tests written first; red → green per layer
Unit + acceptance green (make unit): domain 49, acl 27, bff 20, event-subscriber 19, acceptance 7
Frontend lint + test green (nx run-many -t lint test)
Mutation ≥ break(90): acl 100%, event-subscriber 100%, bff 100%, domain 98.41% (pre-existing FlowableWorkflowClient baseline, untouched)
e2e extended: confirmation reference == register reference
openapi.json + api-client regenerated (drift guard green)
ADR-0012 added; demo-script note appended
Acl__BaseUrl wired for the subscriber in compose

closes #78

## What & why Before this change the self-service confirmation and the openbaar register showed **different** identifiers, so a citizen could not look their registration back up (#78). Now both surface the same **reference**: - **domain → ACL (write):** the domain `registrationId` is set as the zaak's `identificatie` on `POST /zaken`. - **event-subscriber → ACL (read):** the subscriber reads the zaak's `identificatie` back through the ACL (§8.1 — only the ACL talks to ZGW) via a new `POST /zaken/reference`, and stores it on the projection row **and** the `processed_notifications` replay log. - **BFF + openbaar:** the public view exposes `id/status/reference` (never bsn/naam) and searches by id or reference; the register's "Referentie" column shows the reference. Storing the reference in the replay log keeps ADR-0008's **rebuild-is-log-only** invariant intact — `/admin/rebuild` reproduces the reference without re-reading the ACL. Decision recorded in **ADR-0012**. ## Definition of Done - [x] Linked issue: #78 - [x] Tests written first; red → green per layer - [x] Unit + acceptance green (`make unit`): domain 49, acl 27, bff 20, event-subscriber 19, acceptance 7 - [x] Frontend lint + test green (`nx run-many -t lint test`) - [x] Mutation ≥ break(90): acl 100%, event-subscriber 100%, bff 100%, domain 98.41% (pre-existing FlowableWorkflowClient baseline, untouched) - [x] e2e extended: confirmation reference == register reference - [x] openapi.json + api-client regenerated (drift guard green) - [x] ADR-0012 added; demo-script note appended - [x] `Acl__BaseUrl` wired for the subscriber in compose closes #78

not added 5 commits 2026-07-14 12:47:44 +00:00

feat(acl): set and read the zaak identificatie as the citizen reference (refs #78 ) ffbd8072b2

The ACL now writes the domain registrationId as the zaak's identificatie on
POST /zaken, and exposes GET-through POST /zaken/reference to read a zaak's
identificatie back. Only the ACL touches ZGW (§8.1); the reference is the single
value shown on both the self-service confirmation and the openbaar register.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

feat(domain): pass the registrationId to the ACL as the zaak reference (refs #78 ) 7b841d6e62

OpenZaakWorker forwards registration.Id to IAclClient.OpenZaakAsync so the zaak's
identificatie equals the reference the citizen sees on the submit confirmation.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

feat(event-subscriber): enrich the projection with the zaak reference via the ACL (refs #78 ) 566fc9bcea

On each notification the subscriber reads the zaak's reference (identificatie)
through the ACL — the only code allowed to talk to ZGW (§8.1) — and persists it on
the register_projection row and in the processed_notifications replay log. Storing
it in the log keeps rebuild log-only (ADR-0008): no ACL/ZGW access on rebuild.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

feat(portal-openbaar): surface the citizen reference in the public register (refs #78 ) 44e6f81f81

The BFF's public view exposes id/status/reference (never bsn/naam) and searches by
id or reference; the openbaar register's Referentie column and search now show the
reference the citizen saw on submit. api-client + openapi.json regenerated.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

docs(architecture): ADR-0012 reference correlation + wire ACL for the subscriber (refs #78 )

CI / lint (pull_request) Successful in 4m33s

Details

CI / build (pull_request) Successful in 1m17s

Details

CI / unit (pull_request) Successful in 1m34s

Details

CI / frontend (pull_request) Successful in 3m8s

Details

CI / mutation (pull_request) Successful in 6m36s

Details

CI / verify-stack (pull_request) Failing after 10m17s

Details

78e6c1d3d2

Records the domain->ACL (write) and event-subscriber->ACL (read) boundary for the
single citizen reference, wires Acl__BaseUrl into the subscriber in compose, extends
the e2e happy path to assert confirmation reference == register reference, and adds
the demo note.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

not added the area:acl area:domain area:portal-openbaar area:event-subscriber area:projection area:bff area:docs labels 2026-07-14 12:48:09 +00:00

not added 1 commit 2026-07-14 13:36:28 +00:00

fix(e2e): poll the register by reference, not a shared INGEDIEND cell (refs #78 )

CI / lint (pull_request) Successful in 1m23s

Details

CI / build (pull_request) Successful in 1m17s

Details

CI / frontend (pull_request) Successful in 2m30s

Details

CI / mutation (pull_request) Successful in 5m40s

Details

CI / verify-stack (pull_request) Successful in 7m16s

Details

CI / unit (pull_request) Successful in 1m36s

Details

f2d79919c4

The verify stack is shared: earlier verify-projection/verify-domain checks leave
INGEDIEND rows in the register before the e2e submits. A status-only poll
short-circuited on a stale row, then the reference assertion ran against a
not-yet-reloaded page and timed out. Poll (with reload) on this submission's
reference cell instead — stronger, and it directly proves the #78 correlation.
Scope the INGEDIEND/INGESCHREVEN status checks to that reference row too.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

not merged commit 9997da8beb into main

2026-07-14 14:01:51 +00:00

not referenced this issue from a commit

2026-07-14 14:01:52 +00:00

feat(#78): one citizen reference across self-service and the openbaar register (#79)

not referenced this pull request

2026-07-14 14:12:08 +00:00

chore(release): 2026.07.0 #81

not referenced this issue from a commit

2026-07-14 14:46:58 +00:00

chore(release): 2026.07.0 (#81)

Sign in to join this conversation.