authorization for the use of the BewoningMetPeildatum API

# language: en

@gba @autorisatie
Feature: authorization for the use of the BewoningMetPeildatum API
  Authorization for the use of the API takes place at two levels:
  1. authorization of the user by the consuming organization
  2. authorization of the consumer (the organization) by RvIG

  This feature describes only the authorization of the consumer by RvIG.

  For the time being the Bewoning API is offered only to municipalities, for consulting addressable objects within their own municipality.

  Authorization is obtained by means of an OAuth 2 token.
  The token obtained contains the consumer indication that uniquely identifies the consumer. The authorization can be looked up on the basis of the consumer indication.
  Where the consumer is a municipality, a municipality code is also included in the OAuth token. This is used to determine whether the address queried lies within the municipality's own territory.

  There can be several rows in the authorization table for one consumer, but only one of them can be current. Only the current one may be used.
  An authorization is current where the Datum ingang (start date) (35.99.98) lies in the past and the Datum beëindiging tabelregel (end date of the table row) (35.99.99) is empty or lies in the future.

  # To Do (in due course): rules for authorization on the basis of an authorization decision
  # To Do (in due course): rules for supplying personal data with geheimhouding to a third party (35.95.12)
  # To Do (in due course): rules for the ad hoc condition rule (35.95.61)



    Background:
      Given the consumer with indication '000008' has the following 'autorisatie' data
      | Rubrieknummer ad hoc (35.95.60) | Medium ad hoc (35.95.67) | Datum ingang (35.99.98) |
      | 10120                           | N                        | 20201128                |
      And the authenticated consumer has the following 'claim' data
      | afnemerID | gemeenteCode |
      | 000008    | 0800         |
      And address 'A1' has the following data
      | gemeentecode (92.10) | identificatiecode verblijfplaats (11.80) |
      | 0800                 | 0800010000000001                         |
      And address 'A2' has the following data
      | gemeentecode (92.10) | identificatiecode verblijfplaats (11.80) |
      | 0518                 | 0518010000000002                         |


  Rule: A municipality as a consumer is authorized to query the occupancy of an addressable object within its own municipality.
      - 'gemeentecode' in the claim matches 'gemeentecode (92.10)' of the address

    Scenario: A municipality consults the occupancy of an addressable object within the municipality
      Given the person with citizen service number '000000024' is registered at address 'A1' with the following data
      | gemeente van inschrijving (09.10) | datum aanvang adreshouding (10.30) |
      | 0800                              | 20100818                           |
      When gba occupancy is searched with the following parameters
      | naam                             | waarde               |
      | type                             | BewoningMetPeildatum |
      | peildatum                        | 2023-01-01           |
      | adresseerbaarObjectIdentificatie | 0800010000000001     |
      Then the response has 1 occupancy

    @fout-case
    Scenario: A municipality consults the occupancy of an addressable object outside the municipality
      Given the person with citizen service number '000000024' is registered at address 'A2' with the following data
      | gemeente van inschrijving (09.10) | datum aanvang adreshouding (10.30) |
      | 0518                              | 20041103                           |
      When gba occupancy is searched with the following parameters
      | naam                             | waarde               |
      | type                             | BewoningMetPeildatum |
      | peildatum                        | 2023-01-01           |
      | adresseerbaarObjectIdentificatie | 0518010000000002     |
      Then the response has an object with the following data
      | naam     | waarde                                                                                 |
      | type     | https://datatracker.ietf.org/doc/html/rfc7231#section-6.5.3                            |
      | title    | U bent niet geautoriseerd voor deze vraag.                                             |
      | status   | 403                                                                                    |
      | detail   | Je mag alleen bewoning van adresseerbare objecten binnen de eigen gemeente raadplegen. |
      | code     | unauthorized                                                                           |
      | instance | /haalcentraal/api/bewoning/bewoningen                                                  |

    Scenario: A municipality consults the occupancy of an addressable object within the municipality and the occupant is no longer registered in the municipality
      Given the person with citizen service number '000000024' is registered at address 'A1' with the following data
      | gemeente van inschrijving (09.10) | datum aanvang adreshouding (10.30) |
      | 0800                              | 20100818                           |
      And the person was subsequently registered at address 'A2' with the following data
      | gemeente van inschrijving (09.10) | datum aanvang adreshouding (10.30) |
      | 0518                              | 20230526                           |
      When gba occupancy is searched with the following parameters
      | naam                             | waarde               |
      | type                             | BewoningMetPeildatum |
      | peildatum                        | 2023-01-01           |
      | adresseerbaarObjectIdentificatie | 0800010000000001     |
      Then the response has 1 occupancy

    @fout-case
    Scenario: A municipality consults the occupancy of an addressable object outside the municipality and the occupant is now registered in the municipality
      Given the person with citizen service number '000000024' is registered at address 'A2' with the following data
      | gemeente van inschrijving (09.10) | datum aanvang adreshouding (10.30) |
      | 0518                              | 20041103                           |
      And the person was subsequently registered at address 'A1' with the following data
      | gemeente van inschrijving (09.10) | datum aanvang adreshouding (10.30) |
      | 0800                              | 20230601                           |
      When gba occupancy is searched with the following parameters
      | naam                             | waarde               |
      | type                             | BewoningMetPeildatum |
      | peildatum                        | 2023-01-01           |
      | adresseerbaarObjectIdentificatie | 0518010000000002     |
      Then the response has an object with the following data
      | naam     | waarde                                                                                 |
      | type     | https://datatracker.ietf.org/doc/html/rfc7231#section-6.5.3                            |
      | title    | U bent niet geautoriseerd voor deze vraag.                                             |
      | status   | 403                                                                                    |
      | detail   | Je mag alleen bewoning van adresseerbare objecten binnen de eigen gemeente raadplegen. |
      | code     | unauthorized                                                                           |
      | instance | /haalcentraal/api/bewoning/bewoningen                                                  |

  Rule: A municipality as a consumer is authorized to query the occupancy of an addressable object transferred from another municipality, from the moment of transfer

    Scenario: After a municipal reorganization the address came to lie in the querying municipality and the reference date falls after the reorganization
      Given address 'A3' has the following data
      | gemeentecode (92.10) | identificatiecode verblijfplaats (11.80) |
      | 0530                 | 0530010000000003                         |
      And the person with citizen service number '000000024' is registered at address 'A3' with the following data
      | gemeente van inschrijving (09.10) | datum aanvang adreshouding (10.30) |
      | 0530                              | 20100818                           |
      And address 'A3' was changed infrastructurally on '2023-05-26' with the following data
      | gemeentecode (92.10) |
      | 0800                 |
      When gba occupancy is searched with the following parameters
      | naam                             | waarde               |
      | type                             | BewoningMetPeildatum |
      | peildatum                        | 2023-07-01           |
      | adresseerbaarObjectIdentificatie | 0530010000000003     |
      Then the response has 1 occupancy

    @fout-case
    Scenario: After a municipal reorganization the address came to lie in the querying municipality and the reference date falls before the reorganization
      Given address 'A3' has the following data
      | gemeentecode (92.10) | identificatiecode verblijfplaats (11.80) |
      | 0530                 | 0530010000000003                         |
      And the person with citizen service number '000000024' is registered at address 'A3' with the following data
      | gemeente van inschrijving (09.10) | datum aanvang adreshouding (10.30) |
      | 0530                              | 20100818                           |
      And address 'A3' was changed infrastructurally on '2023-05-26' with the following data
      | gemeentecode (92.10) |
      | 0800                 |
      When gba occupancy is searched with the following parameters
      | naam                             | waarde               |
      | type                             | BewoningMetPeildatum |
      | peildatum                        | 2023-01-01           |
      | adresseerbaarObjectIdentificatie | 0530010000000003     |
      Then the response has an object with the following data
      | naam     | waarde                                                                                 |
      | type     | https://datatracker.ietf.org/doc/html/rfc7231#section-6.5.3                            |
      | title    | U bent niet geautoriseerd voor deze vraag.                                             |
      | status   | 403                                                                                    |
      | detail   | Je mag alleen bewoning van adresseerbare objecten binnen de eigen gemeente raadplegen. |
      | code     | unauthorized                                                                           |
      | instance | /haalcentraal/api/bewoning/bewoningen                                                  |

    Scenario: After a municipal reorganization the address came to lie in another municipality and the reference date falls before the date of the reorganization
      Given address 'A3' has the following data
      | gemeentecode (92.10) | identificatiecode verblijfplaats (11.80) |
      | 0800                 | 0800010000000003                         |
      And the person with citizen service number '000000024' is registered at address 'A3' with the following data
      | gemeente van inschrijving (09.10) | datum aanvang adreshouding (10.30) |
      | 0800                              | 20100818                           |
      And address 'A3' was changed infrastructurally on '2023-05-26' with the following data
      | gemeentecode (92.10) |
      | 0530                 |
      When gba occupancy is searched with the following parameters
      | naam                             | waarde               |
      | type                             | BewoningMetPeildatum |
      | peildatum                        | 2023-01-01           |
      | adresseerbaarObjectIdentificatie | 0800010000000003     |
      Then the response has 1 occupancy

    @fout-case
    Scenario: After a municipal reorganization the address came to lie in another municipality and the reference date falls after the date of the reorganization
      Given address 'A3' has the following data
      | gemeentecode (92.10) | identificatiecode verblijfplaats (11.80) |
      | 0800                 | 0800010000000003                         |
      And the person with citizen service number '000000024' is registered at address 'A3' with the following data
      | gemeente van inschrijving (09.10) | datum aanvang adreshouding (10.30) |
      | 0800                              | 20100818                           |
      And address 'A3' was changed infrastructurally on '2023-05-26' with the following data
      | gemeentecode (92.10) |
      | 0530                 |
      When gba occupancy is searched with the following parameters
      | naam                             | waarde               |
      | type                             | BewoningMetPeildatum |
      | peildatum                        | 2023-07-01           |
      | adresseerbaarObjectIdentificatie | 0800010000000003     |
      Then the response has an object with the following data
      | naam     | waarde                                                                                 |
      | type     | https://datatracker.ietf.org/doc/html/rfc7231#section-6.5.3                            |
      | title    | U bent niet geautoriseerd voor deze vraag.                                             |
      | status   | 403                                                                                    |
      | detail   | Je mag alleen bewoning van adresseerbare objecten binnen de eigen gemeente raadplegen. |
      | code     | unauthorized                                                                           |
      | instance | /haalcentraal/api/bewoning/bewoningen                                                  |


  Rule: A municipality as a consumer is authorized to query the occupancy of an addressable object in a municipality that has been transferred to or merged with the consumer municipality

    Scenario Outline: The address is in a merged municipality and <scenario>
      Given municipality 'G1' has the following data
      | gemeentecode (92.10) | gemeentenaam (92.11) |
      | 9999                 | Ons Dorp             |
      And address 'A3' has the following data
      | gemeentecode (92.10) | identificatiecode verblijfplaats (11.80) |
      | 9999                 | 9999010000000003                         |
      And the person with citizen service number '000000024' is registered at address 'A3' with the following data
      | gemeente van inschrijving (09.10) | datum aanvang adreshouding (10.30) |
      | 9999                              | 20100818                           |
      And municipality 'G1' has been merged with the following data
      | nieuwe gemeentecode (92.12) | datum beëindiging (99.99) |
      | 0800                        | 20230526                  |
      When gba occupancy is searched with the following parameters
      | naam                             | waarde               |
      | type                             | BewoningMetPeildatum |
      | peildatum                        | <peildatum>          |
      | adresseerbaarObjectIdentificatie | 9999010000000003     |
      Then the response has 1 occupancy

      Examples:
      | peildatum  | scenario                                                                            |
      | 2023-07-01 | peildatum ligt na datum samenvoeging (adresseerbaar object ligt in gemeente 0800)   |
      | 2023-01-01 | peildatum ligt voor datum samenvoeging (adresseerbaar object ligt in gemeente 9999) |