eho/register-referentie
1
0
Fork 0
Code Issues 10 Pull Requests 1 Actions Packages Projects Releases 1 Wiki Activity

feat(behandel): behandel-portal — werkbak + beoordeling (closes #13) #87

Merged
not merged 8 commits from feat/13-behandel-portal into main 2026-07-16 08:31:58 +00:00
Conversation 0 Commits 8 Files Changed 35
+918 -24
8 Commits
Author SHA1 Message Date
notandClaude Opus 4.8 52ba2fc242 fix(e2e): await the decide POST before leaving the werkbak page (refs #13)
CI / lint (pull_request) Successful in 1m13s
Details
CI / build (pull_request) Successful in 54s
Details
CI / unit (pull_request) Successful in 1m4s
Details
CI / frontend (pull_request) Successful in 2m31s
Details
CI / mutation (pull_request) Successful in 4m57s
Details
CI / verify-stack (pull_request) Successful in 6m55s
Details 
The happy path clicked Goedkeuren and immediately navigated to the openbaar register, which

cancelled the in-flight POST /behandel/registrations/{id}/decide (nginx 499) — the decision

never reached the domain, so the registration stayed INGEDIEND and the final INGESCHREVEN

assertion failed. Wait for the decide response (204) before navigating away.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
 2026-07-16 10:12:50 +02:00
notandClaude Opus 4.8 2c88cb0db0 docs(behandel): frontend decision log + demo-script for the behandel portal (refs #13)
CI / lint (pull_request) Successful in 1m20s
Details
CI / build (pull_request) Successful in 59s
Details
CI / unit (pull_request) Successful in 1m12s
Details
CI / frontend (pull_request) Successful in 6m36s
Details
CI / mutation (pull_request) Successful in 5m10s
Details
CI / verify-stack (pull_request) Failing after 5m27s
Details 
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
 2026-07-16 09:17:11 +02:00
notandClaude Opus 4.8 4e792c2d16 build(infra): serve the behandel portal in compose and gate it in the smoke (refs #13) 
Add the behandel service (:8142, nginx → BFF, depends on Keycloak for the medewerker realm) to

docker-compose, add it to the smoke's WAIT_SVCS and the CI failure-log dump.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
 2026-07-16 09:17:11 +02:00
notandClaude Opus 4.8 7b327a5601 test(e2e): approve via the behandel-portal werkbak instead of the admin endpoint (refs #13) 
The walking-skeleton happy path now drives the real S-12 flow: after submit, a behandelaar logs

in to the behandel portal (medewerker realm), finds the registration in the werkbak by its

reference, and clicks Goedkeuren — replacing the temporary domain admin endpoint. Treat the

behandel origin as secure too, for its PKCE login.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
 2026-07-16 09:17:11 +02:00
notandClaude Opus 4.8 b4c4ffcd19 feat(behandel): behandel-portal app — medewerker login + werkbak with decide (refs #13) 
Scaffold apps/behandel (mirrors self-service): medewerker-realm OIDC login, the werkbak page

listing registrations awaiting beoordeling (GET /behandel/werkbak) with goedkeuren/afwijzen

actions (POST /behandel/registrations/{id}/decide) that refresh the list, plus Dockerfile and

same-origin nginx reverse proxy for /behandel/ (ADR-0013; S-12).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
 2026-07-16 09:11:04 +02:00
notandClaude Opus 4.8 76fe414802 test(behandel): werkbak lists cases, decides them, and secures the BFF calls (refs #13) 
Drives the behandel-portal frontend: the werkbak lists registrations awaiting beoordeling, a

decision (goedkeuren/afwijzen) posts to the BFF and refreshes, an empty werkbak and a load

failure are surfaced, the page is WCAG 2.1 AA clean, and the medewerker token attaches to the

relative /behandel/ calls (and not to the anonymous openbaar register).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
 2026-07-16 09:10:56 +02:00
notandClaude Opus 4.8 a88584514c feat(auth): medewerker-realm AuthService + provider, roles surface, realm-roles mapper (refs #13) 
The behandel-portal authenticates staff against the Keycloak `medewerker` realm. Add

MedewerkerAuthService (reads nested realm_access.roles), provideMedewerkerAuth, a roles/hasRole

surface on the shared AuthService, and a realm-roles protocol mapper so the frontend can read

the behandelaar/teamlead roles from the token. Per ADR-0013 the BFF remains the security boundary.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
 2026-07-16 09:05:45 +02:00
notandClaude Opus 4.8 1d12d693ce test(auth): MedewerkerAuthService exposes realm roles from the medewerker token (refs #13) 
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
 2026-07-16 09:05:45 +02:00