Niek Otten
2397d9196a
## What & why Third sub-slice of **S-11 · Withdrawal (Flow 3)** (#12) — the **owner-scoped BFF withdraw endpoint** (backend). S-11a/b made a withdrawal transition the aggregate and cancel the workflow; this adds the citizen-facing entry point through the BFF, gated to the registration's owner. - **Domain**: `WithdrawRegistrationCommand` carries the caller's `bsn`; the handler returns a `WithdrawOutcome` and refuses a bsn that doesn't own the registration. Unknown and not-owned are **both 404** (indistinguishable — ownership isn't revealed). `POST /registrations/{id}/withdraw` takes `{bsn}` and maps the outcome (204/404). - **BFF**: `POST /self-service/registrations/{id}/withdraw` (DigiD-authenticated) forwards the token's `bsn` to the domain and relays 204/404. The BFF authenticates; the domain owner-scopes (an aggregate invariant, not the domain doing auth). - OpenAPI spec + Angular client regenerated for the new endpoint. - `run-domain-check.sh` withdrawal step now sends the owner `bsn` (verify-stack). Refs #12 — the self-service "trek aanvraag in" button + e2e (S-11c-2) closes it. ## Definition of Done - [x] Linked Gitea issue (#12). - [x] Failing tests committed before the implementation. - [x] Implementation makes the tests pass. - [x] Conventional Commits referencing the issue (`refs #12`). - [ ] CI green — all Gitea Actions jobs. - [x] `docker compose up` unaffected. - [x] No ADR needed (owner-scoping is an aggregate invariant; no boundary change). - [x] Docs — the user-visible demo note lands with S-11c-2. ## Notes for reviewers - **Full local gate run before pushing this time** (lessons from #89): `dotnet format --verify-no-changes` clean; `make unit` green — Acl 27, EventSubscriber 19, BFF 30, Acceptance 9, Big 95; `api-client` lint+test green. - Owner mismatch returns 404 (not 403) so the portal can't be used to probe which references exist. Reviewed-on: #90
242 lines
4.9 KiB
JSON
242 lines
4.9 KiB
JSON
{
|
|
"openapi": "3.1.1",
|
|
"info": {
|
|
"title": "Bff.Api | v1",
|
|
"version": "1.0.0"
|
|
},
|
|
"paths": {
|
|
"/self-service/registrations": {
|
|
"post": {
|
|
"tags": [
|
|
"Bff.Api"
|
|
],
|
|
"responses": {
|
|
"202": {
|
|
"description": "Accepted",
|
|
"content": {
|
|
"application/json": {
|
|
"schema": {
|
|
"$ref": "#/components/schemas/SubmitAccepted"
|
|
}
|
|
}
|
|
}
|
|
},
|
|
"400": {
|
|
"description": "Bad Request"
|
|
},
|
|
"401": {
|
|
"description": "Unauthorized"
|
|
}
|
|
}
|
|
}
|
|
},
|
|
"/self-service/registrations/{id}/withdraw": {
|
|
"post": {
|
|
"tags": [
|
|
"Bff.Api"
|
|
],
|
|
"parameters": [
|
|
{
|
|
"name": "id",
|
|
"in": "path",
|
|
"required": true,
|
|
"schema": {
|
|
"type": "string"
|
|
}
|
|
}
|
|
],
|
|
"responses": {
|
|
"204": {
|
|
"description": "No Content"
|
|
},
|
|
"400": {
|
|
"description": "Bad Request"
|
|
},
|
|
"401": {
|
|
"description": "Unauthorized"
|
|
},
|
|
"404": {
|
|
"description": "Not Found"
|
|
}
|
|
}
|
|
}
|
|
},
|
|
"/openbaar/register": {
|
|
"get": {
|
|
"tags": [
|
|
"Bff.Api"
|
|
],
|
|
"parameters": [
|
|
{
|
|
"name": "q",
|
|
"in": "query",
|
|
"schema": {
|
|
"type": "string"
|
|
}
|
|
}
|
|
],
|
|
"responses": {
|
|
"200": {
|
|
"description": "OK",
|
|
"content": {
|
|
"application/json": {
|
|
"schema": {
|
|
"type": "array",
|
|
"items": {
|
|
"$ref": "#/components/schemas/OpenbaarEntry"
|
|
}
|
|
}
|
|
}
|
|
}
|
|
}
|
|
}
|
|
}
|
|
},
|
|
"/behandel/werkbak": {
|
|
"get": {
|
|
"tags": [
|
|
"Bff.Api"
|
|
],
|
|
"responses": {
|
|
"200": {
|
|
"description": "OK",
|
|
"content": {
|
|
"application/json": {
|
|
"schema": {
|
|
"type": "array",
|
|
"items": {
|
|
"$ref": "#/components/schemas/WerkbakItem"
|
|
}
|
|
}
|
|
}
|
|
}
|
|
},
|
|
"401": {
|
|
"description": "Unauthorized"
|
|
},
|
|
"403": {
|
|
"description": "Forbidden"
|
|
}
|
|
}
|
|
}
|
|
},
|
|
"/behandel/registrations/{id}/decide": {
|
|
"post": {
|
|
"tags": [
|
|
"Bff.Api"
|
|
],
|
|
"parameters": [
|
|
{
|
|
"name": "id",
|
|
"in": "path",
|
|
"required": true,
|
|
"schema": {
|
|
"type": "string"
|
|
}
|
|
}
|
|
],
|
|
"requestBody": {
|
|
"content": {
|
|
"application/json": {
|
|
"schema": {
|
|
"$ref": "#/components/schemas/DecideRequest"
|
|
}
|
|
}
|
|
},
|
|
"required": true
|
|
},
|
|
"responses": {
|
|
"204": {
|
|
"description": "No Content"
|
|
},
|
|
"400": {
|
|
"description": "Bad Request"
|
|
},
|
|
"401": {
|
|
"description": "Unauthorized"
|
|
},
|
|
"403": {
|
|
"description": "Forbidden"
|
|
}
|
|
}
|
|
}
|
|
}
|
|
},
|
|
"components": {
|
|
"schemas": {
|
|
"DecideRequest": {
|
|
"required": [
|
|
"besluit"
|
|
],
|
|
"type": "object",
|
|
"properties": {
|
|
"besluit": {
|
|
"type": "string"
|
|
}
|
|
}
|
|
},
|
|
"OpenbaarEntry": {
|
|
"required": [
|
|
"id",
|
|
"status",
|
|
"reference"
|
|
],
|
|
"type": "object",
|
|
"properties": {
|
|
"id": {
|
|
"type": "string"
|
|
},
|
|
"status": {
|
|
"type": "string"
|
|
},
|
|
"reference": {
|
|
"type": [
|
|
"null",
|
|
"string"
|
|
]
|
|
}
|
|
}
|
|
},
|
|
"SubmitAccepted": {
|
|
"required": [
|
|
"registrationId",
|
|
"status"
|
|
],
|
|
"type": "object",
|
|
"properties": {
|
|
"registrationId": {
|
|
"type": "string"
|
|
},
|
|
"status": {
|
|
"type": "string"
|
|
}
|
|
}
|
|
},
|
|
"WerkbakItem": {
|
|
"required": [
|
|
"registrationId",
|
|
"bsn",
|
|
"status"
|
|
],
|
|
"type": "object",
|
|
"properties": {
|
|
"registrationId": {
|
|
"type": "string"
|
|
},
|
|
"bsn": {
|
|
"type": "string"
|
|
},
|
|
"status": {
|
|
"type": "string"
|
|
}
|
|
}
|
|
}
|
|
}
|
|
},
|
|
"tags": [
|
|
{
|
|
"name": "Bff.Api"
|
|
}
|
|
]
|
|
}
|