Niek Otten
44e6f81f81
The BFF's public view exposes id/status/reference (never bsn/naam) and searches by id or reference; the openbaar register's Referentie column and search now show the reference the citizen saw on submit. api-client + openapi.json regenerated. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
41 lines
1.5 KiB
C#
41 lines
1.5 KiB
C#
using System.Net;
|
|
using System.Net.Http.Json;
|
|
using Bff.Api;
|
|
|
|
namespace Bff.Tests;
|
|
|
|
public class OpenbaarEndpointTests
|
|
{
|
|
[Fact]
|
|
public async Task Serves_public_safe_rows_anonymously()
|
|
{
|
|
using var factory = new BffFactory();
|
|
factory.Projection.Entries.Add(new ProjectionEntry("abc-111", "INGEDIEND", "REG-abc", "123456782", "Jan"));
|
|
|
|
// No Authorization header — the openbaar register is a public lookup (ADR-0010/S-09).
|
|
var response = await factory.CreateClient().GetAsync("/openbaar/register");
|
|
|
|
Assert.Equal(HttpStatusCode.OK, response.StatusCode);
|
|
var body = await response.Content.ReadAsStringAsync();
|
|
Assert.Contains("abc-111", body);
|
|
Assert.Contains("INGEDIEND", body);
|
|
// The public reference is surfaced (matches the submit confirmation, #78)...
|
|
Assert.Contains("REG-abc", body);
|
|
// ...but the bsn must never appear in a public response.
|
|
Assert.DoesNotContain("123456782", body);
|
|
}
|
|
|
|
[Fact]
|
|
public async Task Filters_by_the_query_parameter()
|
|
{
|
|
using var factory = new BffFactory();
|
|
factory.Projection.Entries.Add(new ProjectionEntry("abc-111", "INGEDIEND", "REG-abc", null, null));
|
|
factory.Projection.Entries.Add(new ProjectionEntry("def-222", "INGEDIEND", "REG-def", null, null));
|
|
|
|
var rows = await factory.CreateClient()
|
|
.GetFromJsonAsync<List<OpenbaarEntry>>("/openbaar/register?q=abc");
|
|
|
|
Assert.Equal("abc-111", Assert.Single(rows!).Id);
|
|
}
|
|
}
|