confidentiality: not providing the data of a person to third parties

# language: en

@gba
Feature: confidentiality: not providing the data of a person to third parties

  When a consumer of the BRP API queries data of a person who has not given permission for their data to be provided to third parties
  Then the consumer wants to be alerted to this by means of an indication with the requested data

  Rule: indicatie geheim with value 0 is not supplied

    Scenario: a person who has given permission for their data to be provided to third parties is searched for by addressable object identification
      Given the person with citizen service number '000000152' has the following 'verblijfplaats' data
      | gemeente van inschrijving (09.10) |
      | 0518                              |
      And the 'verblijfplaats' has the following 'adres' data
      | gemeentecode (92.10) | identificatiecode verblijfplaats (11.80) |
      | 0518                 | 0599010051001502                         |
      And the person has the following 'inschrijving' data
      | naam                     | waarde |
      | indicatie geheim (70.10) | 0      |
      When gba persons are searched with the following parameters
      | naam                             | waarde                                  |
      | type                             | ZoekMetAdresseerbaarObjectIdentificatie |
      | adresseerbaarObjectIdentificatie | 0599010051001502                        |
      | fields                           | burgerservicenummer                     |
      Then the response has a person with the following data
      | naam                | waarde    |
      | burgerservicenummer | 000000152 |

  Rule: indicatie geheim with a value higher than 0 is translated into geheimhoudingPersoonsgegevens with value true and supplied without being requested

    Scenario Outline: a person with indicatie geheim <waarde> is searched for by addressable object identification
      Given the person with citizen service number '000000152' has the following 'verblijfplaats' data
      | gemeente van inschrijving (09.10) |
      | 0518                              |
      And the 'verblijfplaats' has the following 'adres' data
      | gemeentecode (92.10) | identificatiecode verblijfplaats (11.80) |
      | 0518                 | 0599010051001502                         |
      And the person has the following 'inschrijving' data
      | naam                     | waarde   |
      | indicatie geheim (70.10) | <waarde> |
      When gba persons are searched with the following parameters
      | naam                             | waarde                                  |
      | type                             | ZoekMetAdresseerbaarObjectIdentificatie |
      | adresseerbaarObjectIdentificatie | 0599010051001502                        |
      | fields                           | burgerservicenummer                     |
      Then the response has a person with the following data
      | naam                          | waarde    |
      | burgerservicenummer           | 000000152 |
      | geheimhoudingPersoonsgegevens | <waarde>  |

      Examples:
      | waarde |
      | 1      |
      | 2      |
      | 3      |
      | 4      |
      | 5      |
      | 6      |
      | 7      |

  Rule: geheimhoudingPersoonsgegevens may not be requested, because it is supplied automatically

    @fout-case
    Scenario Outline: the field geheimhoudingPersoonsgegevens may not be requested, because it is supplied automatically
      When gba persons are searched with the following parameters
      | naam                             | waarde                                  |
      | type                             | ZoekMetAdresseerbaarObjectIdentificatie |
      | adresseerbaarObjectIdentificatie | 0599010051001502                        |
      | fields                           | <fields>                                |
      Then the response has an object with the following data
      | naam     | waarde                                                      |
      | type     | https://datatracker.ietf.org/doc/html/rfc7231#section-6.5.1 |
      | title    | Een of meerdere parameters zijn niet correct.               |
      | status   | 400                                                         |
      | detail   | De foutieve parameter(s) zijn: fields[<index>].             |
      | code     | paramsValidation                                            |
      | instance | /haalcentraal/api/brp/personen                              |
      And the object has the following 'invalidParams' data
      | code   | name            | reason                                        |
      | fields | fields[<index>] | Parameter bevat een niet toegestane veldnaam. |

      Examples:
      | fields                                                    | index |
      | geheimhoudingPersoonsgegevens                             | 0     |
      | burgerservicenummer,geheimhoudingPersoonsgegevens,naam    | 1     |
      | geheimhoudingPersoonsgegevens,geboorte                    | 0     |
      | naam.geslachtsnaam,geboorte,geheimhoudingPersoonsgegevens | 2     |