Snapshot of where the audit issues filed on 2026-04-14 and the open PRs that address them stand. Use this to decide what to merge next.
| PR | Branch | Issues addressed | Local tests | CI status (after this push) |
|-----|-------------------------------------|---------------------------------------------------|-------------|------------------------------|
| #25 | feature/hoog-assurance-id-scan | HOOG NFC scan + OIDC token customization (no Closes) | unverified | backend Test (Unit + BDD) ❌ — needs c892100 audit-hash fix; mobile flutter analyze ❌; lint ✓; dart-format ✓ |
| #46 | fix/data-contracts | #26, #27, #29, #30 | unverified | unit tests ✓; backend BDD ❌ (separate); selenium E2E ❌ (workflow infra) |
| #47 | fix/psd2-skip-path | #28 | unverified | backend ✓; frontend unit tests ✓; mobile ❌; selenium E2E ❌ |
| #48 | fix/security | #31, #32, #33, #34, #39 | unverified | backend ✓; frontend unit tests ✓; selenium E2E ❌ |
| #49 | fix/edge-cases | #35, #36, #37, #38, #40, #41 | unverified | backend ✓; frontend unit tests ✓; mobile ❌; selenium E2E ❌ |
| #50 | fix/p2-remaining-issues | #42, #43, #45 (also fixes #44 in this push) | passing | backend ✓; frontend unit tests ✓; mobile ❌; selenium E2E ❌ |
fix/p2-remaining-issues HEAD (this push)All run from a clean checkout:
| Check | Result |
|-------------------------------------------------------------------|----------|
| cd backend && ./mvnw test | 29 tests pass (12 unit + 17 Cucumber BDD scenarios) |
| cd backend && ./mvnw clean package -DskipTests | JAR built |
| cd frontend/europe-login-portal && npm run lint | clean (was 4 errors before the fixes in this push) |
| cd frontend/europe-login-portal && npm run test:ci | 128 specs pass; coverage 77.95% statements / 66.66% branches |
| cd frontend/europe-login-portal && npm run build | production bundle built |
| Smoke test (postgres + redis via compose, JAR + npx serve) | /actuator/health UP, POST /api/onboarding returns 201 with session, serve returns the SPA |
Component/signal imports in id-scan-step.component.spec.ts, removed unused capturedNext in review-step.component.spec.ts, replaced != with !== null && !== undefined in review-step.component.ts template (@angular-eslint/template/eqeqeq). The same four lint errors block PR #25, #47, #49, #50; cherry-pick this fix into the others or rebase them.BASIS : BASIS tautology in OnboardingService.completeOnboarding with an explicit guard: throw if !isKvkVerified, otherwise default to BASIS when no achievedAssuranceLevel was set. Tests still green.#1–#24 cover compliance work (DR plan, secrets rotation, processor agreements, log aggregation, BIO/NIS2/GDPR documentation, etc.) and out-of-band features (KvK live API, GoCardless live config, Cucumber E2E). These are tracked in GitHub Issues; none are blocking the current PR queue.
After the lint + dart-format fixes in this push were cascaded across the affected branches, the residual CI failures break down as:
ERR_CONNECTION_REFUSED (every branch with the E2E job): the selenium service container can't reach http://localhost:4301 on the host runner. localhost inside a service container points at the container, not the workflow host. The E2E job in .github/workflows/e2e.yml either needs the frontend served inside a sibling container on the same Docker network, or it needs to substitute the runner host IP ($(hostname -I | awk '{print $1}')) for BASE_URL instead of localhost. Filed as a follow-up — not a code defect in any PR.flutter analyze --fatal-infos errors in mobile/europe-login-mobile (PR #25 + every fix-branch that includes the HOOG NFC scanner commits): real type/import errors in the freshly-added scanner code, e.g. CardThemeData, InputImageRotation, instantiateImageCodecFromList, Size undefined. These predate the current push and live in PR #25's mobile code. They need to be cleaned up in PR #25 (likely missing imports + a Flutter SDK pin/upgrade). Fix-branches that don't touch mobile/** (PR #46, #48) don't trigger the mobile job and aren't affected.c892100 fix(audit): truncate timestamp to millis before hashing to prevent DB round-trip mismatch. PR #25's branch needs to pull this commit (it's already on every fix/* branch).fix/* branches are independent of #25, but #25 has the most surface area.
Reacties