Niek Otten
9c3da48d8e
All checks were successful
## What & why First half of **S-12c** (behandel-portal backend), per **ADR-0013** (decisions recorded in #84): - **BFF multi-realm auth.** A second JWT bearer scheme (`medewerker`) alongside the default `digid` scheme. On validation it lifts Keycloak's `realm_access.roles` onto the principal, and a `behandelaar` policy (medewerker scheme + `behandelaar` role) gates `/behandel/*`. Self-service keeps the digid scheme. - **Werkbak = Flowable tasks.** The domain `Werkbak` query reads the open `Beoordelen` tasks (§8.2, S-12b's `IUserTaskClient`) and enriches each with its aggregate's bsn + status; `GET /behandel/werkbak` (domain) is proxied by the BFF `GET /behandel/werkbak` behind the behandelaar policy. The read projection stays the anonymous openbaar model (no premature `IN_BEHANDELING`/personal-data plumbing — deferred in ADR-0008). Behavior: `/behandel/werkbak` is **401** without a token, **403** for a medewerker lacking the role, **200 + werkbak** for a behandelaar. **S-12c-2** (next): `POST /behandel/registrations/{id}/decide` → domain decision + complete the Flowable task. ## Definition of Done - [x] Linked issue: #13 (umbrella, `refs`); closes the adr-proposal #84 - [x] Tests first; red → green per layer - [x] Unit + acceptance green (`make unit`): domain 78, bff 23, acceptance 9 (+ acl/event-subscriber unaffected) - [x] api-client `test` green; openapi.json regenerated (drift guard passes) - [x] Mutation ≥ break(90): **domain 100%, bff 100%** - [x] ADR-0013 added; `Keycloak__MedewerkerAuthority` wired into compose - [ ] CI green (pending) Part of #13. closes #84 Reviewed-on: #85
47 lines
1.9 KiB
C#
47 lines
1.9 KiB
C#
using System.Text;
|
|
using Microsoft.IdentityModel.JsonWebTokens;
|
|
using Microsoft.IdentityModel.Tokens;
|
|
|
|
namespace Bff.Tests;
|
|
|
|
/// <summary>Mints JWTs for the BFF tests — signed with the factory's test key (valid) or otherwise
|
|
/// (a wrong key / expired) to exercise the bearer validation the BFF configures.</summary>
|
|
internal static class TestTokens
|
|
{
|
|
public static string Valid(string bsn) => Create(bsn, BffFactory.TestSigningKey, expired: false);
|
|
|
|
public static string Expired(string bsn) => Create(bsn, BffFactory.TestSigningKey, expired: true);
|
|
|
|
public static string WrongKey(string bsn) => Create(
|
|
bsn,
|
|
new SymmetricSecurityKey(Encoding.UTF8.GetBytes("a-different-signing-key-256-bits-long-indeed-yes!")),
|
|
expired: false);
|
|
|
|
/// <summary>A medewerker-realm token carrying the given realm roles under <c>realm_access.roles</c>
|
|
/// (Keycloak's shape), signed with the valid test key. Used to exercise behandel authorization.</summary>
|
|
public static string Medewerker(params string[] roles)
|
|
{
|
|
var handler = new JsonWebTokenHandler();
|
|
return handler.CreateToken(new SecurityTokenDescriptor
|
|
{
|
|
Claims = new Dictionary<string, object>
|
|
{
|
|
["realm_access"] = new Dictionary<string, object> { ["roles"] = roles },
|
|
},
|
|
Expires = DateTime.UtcNow.AddMinutes(30),
|
|
SigningCredentials = new SigningCredentials(BffFactory.TestSigningKey, SecurityAlgorithms.HmacSha256),
|
|
});
|
|
}
|
|
|
|
private static string Create(string bsn, SymmetricSecurityKey key, bool expired)
|
|
{
|
|
var handler = new JsonWebTokenHandler();
|
|
return handler.CreateToken(new SecurityTokenDescriptor
|
|
{
|
|
Claims = new Dictionary<string, object> { ["bsn"] = bsn },
|
|
Expires = DateTime.UtcNow.AddMinutes(expired ? -5 : 30),
|
|
SigningCredentials = new SigningCredentials(key, SecurityAlgorithms.HmacSha256),
|
|
});
|
|
}
|
|
}
|