Niek Otten
d226b6402d
All checks were successful
## What & why
Second half of **S-12c** (behandel-portal backend), completing the decision path per **ADR-0013**:
- **Domain:** `BeoordeelRegistratie` now, after applying the decision (aggregate + ACL for approval), **completes the open Flowable `Beoordelen` task** for that registration (found by registrationId) with the besluit, so the workflow advances. No open task → the decision still stands (completes nothing); idempotent.
- **BFF:** `POST /behandel/registrations/{id}/decide` behind the medewerker/`behandelaar` policy, forwarding `goedkeuren`/`afwijzen` to the domain. Validates the besluit vocabulary (400 on unknown) without troubling the domain.
Behavior: decide is **401** without a token, **403** without the role, **400** for an unknown besluit, **204** (forwarded) for a behandelaar.
This completes the behandel backend. **S-12d** (the Angular behandel-portal + Playwright e2e) closes umbrella #13 and retires the temporary `/approve`.
## Definition of Done
- [x] Linked issue: #13 (umbrella, `refs`)
- [x] Tests first; red → green per layer
- [x] Unit + acceptance green (`make unit`): domain 79, bff 27, acceptance 9 (acl/event-subscriber unaffected)
- [x] Beoordeling acceptance scenario asserts task completion (goedkeuren + afwijzen)
- [x] openapi.json + api-client regenerated (drift guard passes)
- [x] Mutation ≥ break(90): **domain 100%, bff 100%**
- [ ] CI green (pending)
Part of #13.
Reviewed-on: #86
69 lines
3.5 KiB
C#
69 lines
3.5 KiB
C#
using System.Net.Http.Json;
|
|
|
|
namespace Bff.Api;
|
|
|
|
/// <summary>What the self-service submit returns to the portal (the domain's registration id + status).</summary>
|
|
public sealed record SubmitAccepted(string RegistrationId, string Status);
|
|
|
|
/// <summary>A projection row as the projection-api serves it. <c>Bsn</c>/<c>NaamPlaceholder</c> are
|
|
/// read but never surfaced by the openbaar endpoint (public-safe filtering, ADR-0010/S-09).
|
|
/// <c>Reference</c> is the public-safe citizen reference (the zaak identificatie, #78).</summary>
|
|
public sealed record ProjectionEntry(string Id, string Status, string? Reference, string? Bsn, string? NaamPlaceholder);
|
|
|
|
/// <summary>A public-safe openbaar register row — only non-sensitive fields leave the BFF.</summary>
|
|
public sealed record OpenbaarEntry(string Id, string Status, string? Reference);
|
|
|
|
/// <summary>A behandelaar's werkbak row: a registration awaiting beoordeling, with the bsn + status a
|
|
/// behandelaar sees (staff view — reached only behind medewerker/behandelaar authorization, S-12c).</summary>
|
|
public sealed record WerkbakItem(string RegistrationId, string Bsn, string Status);
|
|
|
|
/// <summary>Port to the Domain Service (§8.3: the BFF is the portals' only backend; it fans out).</summary>
|
|
public interface IDomainClient
|
|
{
|
|
Task<SubmitAccepted> SubmitRegistrationAsync(string bsn, CancellationToken ct = default);
|
|
|
|
/// <summary>The behandelaar's werkbak — registrations awaiting beoordeling.</summary>
|
|
Task<IReadOnlyList<WerkbakItem>> GetWerkbakAsync(CancellationToken ct = default);
|
|
|
|
/// <summary>Apply a behandelaar's decision (<c>goedkeuren</c>/<c>afwijzen</c>) to a registration.</summary>
|
|
Task DecideAsync(string registrationId, string besluit, CancellationToken ct = default);
|
|
}
|
|
|
|
/// <summary>Port to the read projection.</summary>
|
|
public interface IProjectionClient
|
|
{
|
|
Task<IReadOnlyList<ProjectionEntry>> GetRegisterAsync(CancellationToken ct = default);
|
|
}
|
|
|
|
/// <summary>Calls the Domain Service's <c>POST /registrations</c>.</summary>
|
|
public sealed class DomainClient(HttpClient http) : IDomainClient
|
|
{
|
|
public async Task<SubmitAccepted> SubmitRegistrationAsync(string bsn, CancellationToken ct = default)
|
|
{
|
|
using var response = await http.PostAsJsonAsync("registrations", new { bsn }, ct);
|
|
response.EnsureSuccessStatusCode();
|
|
var dto = await response.Content.ReadFromJsonAsync<DomainResponse>(ct)
|
|
?? throw new InvalidOperationException("The Domain Service returned an empty registration response.");
|
|
return new SubmitAccepted(dto.RegistrationId, dto.Status);
|
|
}
|
|
|
|
public async Task<IReadOnlyList<WerkbakItem>> GetWerkbakAsync(CancellationToken ct = default)
|
|
=> await http.GetFromJsonAsync<List<WerkbakItem>>("behandel/werkbak", ct) ?? [];
|
|
|
|
public async Task DecideAsync(string registrationId, string besluit, CancellationToken ct = default)
|
|
{
|
|
using var response = await http.PostAsJsonAsync(
|
|
$"registrations/{registrationId}/decide", new { besluit }, ct);
|
|
response.EnsureSuccessStatusCode();
|
|
}
|
|
|
|
private sealed record DomainResponse(string RegistrationId, string Status, string? ZaakUrl);
|
|
}
|
|
|
|
/// <summary>Calls the projection-api's <c>GET /register</c>.</summary>
|
|
public sealed class ProjectionClient(HttpClient http) : IProjectionClient
|
|
{
|
|
public async Task<IReadOnlyList<ProjectionEntry>> GetRegisterAsync(CancellationToken ct = default)
|
|
=> await http.GetFromJsonAsync<List<ProjectionEntry>>("register", ct) ?? [];
|
|
}
|