Skip to content

Bevindingen Remko#896

Open
rubenvdlinde wants to merge 30 commits intofeature/accept-validationfrom
feature/php-linting
Open

Bevindingen Remko#896
rubenvdlinde wants to merge 30 commits intofeature/accept-validationfrom
feature/php-linting

Conversation

@rubenvdlinde
Copy link
Contributor

Nieuwe Organisatie aanmaken en accepteren zet niet een gebruiker direct om.
De organisatie die aangemaakt word in openregister heeft niet het zelfd uuid als die in het voorzieningen register

Calls na eerste inlog zijn heel traag
Mijn account update contactpersoon niet. Contactpersoon update wel mijn account
Niet ingelogd geeft 404 bij het ophalen van logo's

rubenvdlinde and others added 8 commits February 22, 2026 11:31
…rience

Eliminates ~500ms overhead from every API request by moving background job
registration from boot() (runs every request) to info.xml (runs once at
install). Also optimizes OrganisationService with in-memory caching and
FileChangeListener with early path checks to reduce first-user login from
7.8s to 4.1s.

- Remove 8 redundant $jobList->has() DB queries from boot()
- Move 4 background jobs to declarative info.xml registration
- Add request-level in-memory cache to getUserOrganisations()
- Pass pre-loaded organisations to getActiveOrganisation() to avoid double lookup
- Only run admin/RBAC checks on org creation, not every lookup
- Cache extraction scope in FileChangeListener (1 DB read vs 128 per skeleton)
- Check file path before settings DB read for early skip

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Files uploaded by admin or non-admin users were stored under that user's
Nextcloud folder, but public/anonymous access (via @publicpage endpoint)
could not resolve the file because IRootFolder::getById() requires a user
context.

Added getFileViaKnownUsers() fallback in FilesController::show() that
tries the object owner, then the OpenRegister system user, then admin
to find the file by ID. Also improved FolderManagementHandler::getNodeById()
to fall back to root folder lookup.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Remove all catch-and-fallback-to-blob patterns that silently return
empty results from the unused openregister_objects table when
MagicMapper/UnifiedObjectMapper operations fail. Operations now
propagate errors instead of hiding them.

Changed: find(), tryMagicMapperFindAll(), insert(), update(),
deleteObjects(), publishObjects(), depublishObjects(),
shouldUseMagicMapper(), shouldUseMagicMapperForRegisterSchema()

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Register lookups for file/folder operations should not apply multitenancy
filtering, as registers are shared infrastructure that all users need to
access. This fixes non-admin users being unable to upload files to objects
because the register lookup was blocked by org-based filtering.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
rubenvdlinde and others added 21 commits February 22, 2026 19:32
When creating organisations, a unique constraint violation on the slug
column would crash the entire request. Now the service catches the
DbalException and returns the existing organisation instead.

Also adds findBySlug() to OrganisationMapper and downgrades the noisy
FilePropertyHandler isFileProperty log from warning to debug.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
When createOrganisation encounters a slug collision and finds an
existing entity by slug, update its UUID to match the requested
UUID if they differ. This ensures the entity UUID stays in sync
with the object UUID, preventing broken references in downstream
code that relies on UUID-based lookups.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Set SITE_TITLE=Softwarecatalogus on nginx frontend service
- Add 'extend' to reserved property list in MagicSearchHandler to
  prevent it from being treated as a search filter

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
… results

When findByRelationBatchInSchema() returned 0 results (e.g., empty magic
table or no matching objects), the cache was not populated due to a
`if (count > 0)` guard. This caused every entity to fall through to the
slow per-entity findByRelation() path, which does LIKE scans on the blob
table and iterates all magic mapper tables.

On the test environment with 3,093 organisations and an empty contactpersoon
magic table, this caused _extend[]=contactpersonen to take 10-13 seconds
instead of <1 second.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
OAS documentation generation was failing with 500 for org-bound
registers because RegisterMapper::find() applied multitenancy filtering.
Registers with an organisation UUID were inaccessible to users outside
that org, including for public API documentation.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
…roperties

Linked diensten and koppelingen were not shown on applicatie pages because
resolveSchemaReference() and getSchema() applied multi-tenancy filtering
when looking up schemas internally. This caused $ref references like
"#/components/schemas/dienst" to fail resolution when the schema belonged
to a different organization than the current user, breaking both:
- The single-object API (_extend=diensten on show endpoint)
- The list API (batch preloadInverseRelationships path)

The fix bypasses RBAC and multi-tenancy for internal schema resolution
since schemas must always be accessible when resolving inversedBy
references regardless of the requesting user's organization.

Resolves: VNG-Realisatie/Softwarecatalogus#373

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
The OAS specification endpoint was only returning 1 of 6 schemas because
findMultiple() applied multi-tenancy filtering by default. Schemas
belonging to organizations other than the current user's were excluded.

OAS generation is a system-level operation that needs access to all
schemas in a register, regardless of organization ownership.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
The export endpoint returned 500 because registerMapper.find() applied
multi-tenancy filtering by default. Registers with an organisation set
(like voorzieningen) were excluded when the current user's org didn't
match. The lookup is only needed for filename generation — access
control is already handled by setRegister/setSchema above.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Replace Apache-2.0 LICENSE with EUPL-1.2. Update appinfo/info.xml,
composer.json, and package.json license fields.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- ObjectsController: Accept both 'format' and 'type' query parameters
  for export, so CSV downloads work from all endpoints consistently.
- UserService: Wrap getUserOrganisationStats() in try-catch to prevent
  500 errors on /api/user/me when organisation data is unavailable.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Add schema title to the delete dialog heading and body text so users
can see what type of object (applicatie, dienst, etc.) they are about
to delete, instead of a generic confirmation message.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Add PR checks for PHP quality (PHPCS, PHPMD, phpmetrics) and frontend
quality (ESLint, stylelint) that run on pull requests to main branches.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Add OpenSpec config, change tracking for deep link registry and global
search features, and shared Nextcloud app specifications.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Add DeepLinkRegistryService for cross-app entity linking, notes and
tasks controllers/services with DTOs, comments entity listener, object
cleanup listener, and fix global unified search across registers.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants