Niek Otten
9997da8beb
All checks were successful
## What & why Before this change the self-service confirmation and the openbaar register showed **different** identifiers, so a citizen could not look their registration back up (#78). Now both surface the same **reference**: - **domain → ACL (write):** the domain `registrationId` is set as the zaak's `identificatie` on `POST /zaken`. - **event-subscriber → ACL (read):** the subscriber reads the zaak's `identificatie` back through the ACL (§8.1 — only the ACL talks to ZGW) via a new `POST /zaken/reference`, and stores it on the projection row **and** the `processed_notifications` replay log. - **BFF + openbaar:** the public view exposes `id/status/reference` (never bsn/naam) and searches by id or reference; the register's "Referentie" column shows the reference. Storing the reference in the replay log keeps ADR-0008's **rebuild-is-log-only** invariant intact — `/admin/rebuild` reproduces the reference without re-reading the ACL. Decision recorded in **ADR-0012**. ## Definition of Done - [x] Linked issue: #78 - [x] Tests written first; red → green per layer - [x] Unit + acceptance green (`make unit`): domain 49, acl 27, bff 20, event-subscriber 19, acceptance 7 - [x] Frontend lint + test green (`nx run-many -t lint test`) - [x] Mutation ≥ break(90): acl 100%, event-subscriber 100%, bff 100%, domain 98.41% (pre-existing FlowableWorkflowClient baseline, untouched) - [x] e2e extended: confirmation reference == register reference - [x] openapi.json + api-client regenerated (drift guard green) - [x] ADR-0012 added; demo-script note appended - [x] `Acl__BaseUrl` wired for the subscriber in compose closes #78 Reviewed-on: #79
41 lines
1.5 KiB
C#
41 lines
1.5 KiB
C#
using System.Net;
|
|
using System.Net.Http.Json;
|
|
using Bff.Api;
|
|
|
|
namespace Bff.Tests;
|
|
|
|
public class OpenbaarEndpointTests
|
|
{
|
|
[Fact]
|
|
public async Task Serves_public_safe_rows_anonymously()
|
|
{
|
|
using var factory = new BffFactory();
|
|
factory.Projection.Entries.Add(new ProjectionEntry("abc-111", "INGEDIEND", "REG-abc", "123456782", "Jan"));
|
|
|
|
// No Authorization header — the openbaar register is a public lookup (ADR-0010/S-09).
|
|
var response = await factory.CreateClient().GetAsync("/openbaar/register");
|
|
|
|
Assert.Equal(HttpStatusCode.OK, response.StatusCode);
|
|
var body = await response.Content.ReadAsStringAsync();
|
|
Assert.Contains("abc-111", body);
|
|
Assert.Contains("INGEDIEND", body);
|
|
// The public reference is surfaced (matches the submit confirmation, #78)...
|
|
Assert.Contains("REG-abc", body);
|
|
// ...but the bsn must never appear in a public response.
|
|
Assert.DoesNotContain("123456782", body);
|
|
}
|
|
|
|
[Fact]
|
|
public async Task Filters_by_the_query_parameter()
|
|
{
|
|
using var factory = new BffFactory();
|
|
factory.Projection.Entries.Add(new ProjectionEntry("abc-111", "INGEDIEND", "REG-abc", null, null));
|
|
factory.Projection.Entries.Add(new ProjectionEntry("def-222", "INGEDIEND", "REG-def", null, null));
|
|
|
|
var rows = await factory.CreateClient()
|
|
.GetFromJsonAsync<List<OpenbaarEntry>>("/openbaar/register?q=abc");
|
|
|
|
Assert.Equal("abc-111", Assert.Single(rows!).Id);
|
|
}
|
|
}
|