confidentiality: not providing the data of a person to third parties

# language: en

@gba
Feature: confidentiality: not providing the data of a person to third parties

  When a consumer of the BRP API queries data of a person who has not given permission for their data to be provided to third parties
  Then the consumer wants to be alerted to this by means of an indication with the requested data

Rule: indicatie geheim with value 0 is not supplied

  Scenario: a person who has given permission for their data to be provided to third parties is consulted by citizen service number
    Given the person with citizen service number '000000152' has the following 'inschrijving' data
    | naam                     | waarde |
    | indicatie geheim (70.10) | 0      |
    When gba persons are searched with the following parameters
    | naam                | waarde                          |
    | type                | RaadpleegMetBurgerservicenummer |
    | burgerservicenummer | 000000152                       |
    | fields              | burgerservicenummer             |
    Then the response has a person with the following data
    | naam                | waarde    |
    | burgerservicenummer | 000000152 |

Rule: indicatie geheim with a value higher than 0 is translated into geheimhoudingPersoonsgegevens with value true and supplied without being requested

  Scenario Outline: a person with indicatie geheim <waarde> is consulted by citizen service number
    Given the person with citizen service number '000000152' has the following 'inschrijving' data
    | naam                     | waarde   |
    | indicatie geheim (70.10) | <waarde> |
    When gba persons are searched with the following parameters
    | naam                | waarde                          |
    | type                | RaadpleegMetBurgerservicenummer |
    | burgerservicenummer | 000000152                       |
    | fields              | burgerservicenummer             |
    Then the response has a person with the following data
    | naam                          | waarde    |
    | burgerservicenummer           | 000000152 |
    | geheimhoudingPersoonsgegevens | <waarde>  |

    Examples:
    | waarde |
    | 1      |
    | 2      |
    | 3      |
    | 4      |
    | 5      |
    | 6      |
    | 7      |

Rule: geheimhoudingPersoonsgegevens may not be requested, because it is supplied automatically

  @fout-case
  Scenario Outline: the field geheimhoudingPersoonsgegevens may not be requested, because it is supplied automatically
    When gba persons are searched with the following parameters
    | naam                | waarde                          |
    | type                | RaadpleegMetBurgerservicenummer |
    | burgerservicenummer | 000000024                       |
    | fields              | <fields>                        |
    Then the response has an object with the following data
    | naam     | waarde                                                      |
    | type     | https://datatracker.ietf.org/doc/html/rfc7231#section-6.5.1 |
    | title    | Een of meerdere parameters zijn niet correct.               |
    | status   | 400                                                         |
    | detail   | De foutieve parameter(s) zijn: fields[<index>].             |
    | code     | paramsValidation                                            |
    | instance | /haalcentraal/api/brp/personen                              |
    And the object has the following 'invalidParams' data
    | code   | name            | reason                                        |
    | fields | fields[<index>] | Parameter bevat een niet toegestane veldnaam. |

    Examples:
    | fields                                                                                   | index |
    | geheimhoudingPersoonsgegevens                                                            | 0     |
    | burgerservicenummer,geheimhoudingPersoonsgegevens,naam,partners                          | 1     |
    | geheimhoudingPersoonsgegevens,geboorte,ouders                                            | 0     |
    | verblijfplaats.verblijfadres,nationaliteiten.nationaliteit,geheimhoudingPersoonsgegevens | 2     |