register-referentie/services/bff/Bff.Tests/BeheerDefaultFillEndpointTests.cs

using System.Net;
using System.Net.Http.Headers;
using System.Net.Http.Json;
using Bff.Api;

namespace Bff.Tests;

/// <summary>
/// The beheer default-fill config endpoints (S-15b): read (GET) and edit (PUT) the ACL's default-fill,
/// reached only with a medewerker-realm token carrying the <c>beheerder</c> role. Missing token → 401;
/// a medewerker without the role → 403; a beheerder reads and updates via the ACL client.
/// </summary>
public class BeheerDefaultFillEndpointTests
{
    private static HttpRequestMessage Get(string? bearer)
    {
        var r = new HttpRequestMessage(HttpMethod.Get, "/beheer/default-fill");
        if (bearer is not null) r.Headers.Authorization = new AuthenticationHeaderValue("Bearer", bearer);
        return r;
    }

    private static HttpRequestMessage Put(string? bearer, object body)
    {
        var r = new HttpRequestMessage(HttpMethod.Put, "/beheer/default-fill") { Content = JsonContent.Create(body) };
        if (bearer is not null) r.Headers.Authorization = new AuthenticationHeaderValue("Bearer", bearer);
        return r;
    }

    [Fact]
    public async Task Rejects_read_without_a_token()
    {
        using var factory = new BffFactory();
        var response = await factory.CreateClient().SendAsync(Get(bearer: null));
        Assert.Equal(HttpStatusCode.Unauthorized, response.StatusCode);
    }

    [Fact]
    public async Task Rejects_a_medewerker_without_the_beheerder_role()
    {
        using var factory = new BffFactory();
        var response = await factory.CreateClient().SendAsync(Get(TestTokens.Medewerker("behandelaar")));
        Assert.Equal(HttpStatusCode.Forbidden, response.StatusCode);
    }

    [Fact]
    public async Task Serves_the_current_default_fill_to_a_beheerder()
    {
        using var factory = new BffFactory();
        factory.Acl.DefaultFill = new BeheerDefaultFill("517439943", "517439943", "openbaar");

        var response = await factory.CreateClient().SendAsync(Get(TestTokens.Medewerker("beheerder")));

        Assert.Equal(HttpStatusCode.OK, response.StatusCode);
        var body = await response.Content.ReadFromJsonAsync<BeheerDefaultFill>();
        Assert.Equal("517439943", body!.Bronorganisatie);
        Assert.Equal("openbaar", body.Vertrouwelijkheidaanduiding);
    }

    [Fact]
    public async Task Updates_the_default_fill_via_the_acl_for_a_beheerder()
    {
        using var factory = new BffFactory();

        var response = await factory.CreateClient().SendAsync(
            Put(TestTokens.Medewerker("beheerder"),
                new { bronorganisatie = "999999999", verantwoordelijkeOrganisatie = "888888888", vertrouwelijkheidaanduiding = "vertrouwelijk" }));

        Assert.Equal(HttpStatusCode.NoContent, response.StatusCode);
        Assert.Equal("999999999", factory.Acl.Updated!.Bronorganisatie);
        Assert.Equal("vertrouwelijk", factory.Acl.Updated.Vertrouwelijkheidaanduiding);
    }

    [Fact]
    public async Task Rejects_an_update_from_a_non_beheerder()
    {
        using var factory = new BffFactory();

        var response = await factory.CreateClient().SendAsync(
            Put(TestTokens.Medewerker("behandelaar"), new { bronorganisatie = "1", verantwoordelijkeOrganisatie = "2", vertrouwelijkheidaanduiding = "openbaar" }));

        Assert.Equal(HttpStatusCode.Forbidden, response.StatusCode);
        Assert.Null(factory.Acl.Updated);
    }
}