Feature/FUND-2062 zrc bsn encrypt - #172
Merged
Merged
Conversation
![aikido-pr-checks[bot]](https://avatars.githubusercontent.com/in/898896?s=60&v=4){kind=small}
![github-code-quality[bot]](https://avatars.githubusercontent.com/u/9919?s=60&v=4){kind=small}
ragaumon
force-pushed
the
feature/FUND-2062_zrc_bsn_encrypt
branch
from
April 7, 2026 12:47
b03e724 to
a040f0a
Compare
Contributor
There was a problem hiding this comment.
Pull request overview
Adds infrastructure to store BSN securely in the ZRC domain by introducing (1) HMAC hashing for searchable lookups and (2) ASP.NET Core DataProtection for reversible encryption at rest, including DB-backed key persistence.
Changes:
- Add HMAC-SHA256 hashing and DataProtection-based encryption utilities + configuration.
- Extend ZRC data model and query filters to use
InpBsnHashand persistInpBsnEncrypted. - Add EF migrations for new BSN columns and for DataProtection key storage, plus unit tests and documentation.
Reviewed changes
Copilot reviewed 34 out of 36 changed files in this pull request and generated 13 comments.
Show a summary per file
| File | Description |
|---|---|
| src/Tests/OneGround.ZGW.Zaken.WebApi.UnitTests/MappingTests/RequestToDomainProfileTests.cs | Extends mapping assertions for new BSN fields |
| src/Tests/OneGround.ZGW.Zaken.WebApi.UnitTests/Encryption/InpBsnFieldTests.cs | Adds unit tests for hashing/encryption primitives |
| src/Tests/OneGround.ZGW.Zaken.WebApi.UnitTests/Encryption/HmacSha256HasherTests.cs | Adds unit tests for HMAC hasher behavior/validation |
| src/OneGround.ZGW.Zaken.WebApi/Program.cs | Registers data protection services + key DB initializer |
| src/OneGround.ZGW.Zaken.WebApi/Extensions/ZakenDataProtectionExtensions.cs | New DI extension configuring HMAC + DataProtection |
| src/OneGround.ZGW.Zaken.WebApi/appsettings.Local.json | Adds local HMAC/DataProtection config placeholders |
| src/OneGround.ZGW.Zaken.WebApi/appsettings.json | Adds production HMAC/DataProtection config placeholders |
| src/OneGround.ZGW.Zaken.Web/Startup.cs | Adds using for new extensions |
| src/OneGround.ZGW.Zaken.Web/MappingProfiles/v1/RequestToDomainProfile.cs | Maps incoming BSN into hash/encrypted fields |
| src/OneGround.ZGW.Zaken.Web/Handlers/v1/GetAllZaakRollenQueryHandler.cs | Switches BSN filtering to hashed field |
| src/OneGround.ZGW.Zaken.Web/Handlers/v1/5/GetAllZakenQueryHandler.cs | Switches BSN filtering (zaken via rollen) to hashed field |
| src/OneGround.ZGW.Zaken.Web/Handlers/v1/5/GetAllZaakRollenQueryHandler.cs | Switches BSN filtering to hashed field |
| src/OneGround.ZGW.Zaken.DataModel/ZrcDbContextFactory.cs | Injects protector/hasher into ZrcDbContext creation |
| src/OneGround.ZGW.Zaken.DataModel/ZrcDbContext.cs | Applies converters + configures hash/encrypted columns/index |
| src/OneGround.ZGW.Zaken.DataModel/ZGW.Zaken.DataModel.csproj | Adds DataProtection EF Core package reference |
| src/OneGround.ZGW.Zaken.DataModel/ZaakRol/NatuurlijkPersoonZaakRol.cs | Adds InpBsnHash + InpBsnEncrypted fields |
| src/OneGround.ZGW.Zaken.DataModel/Migrations/ZrcDbContextModelSnapshot.cs | Updates model snapshot for new BSN columns/index |
| src/OneGround.ZGW.Zaken.DataModel/Migrations/DataProtectionKeyDb/DataProtectionKeyDbContextModelSnapshot.cs | Adds snapshot for DataProtection key context |
| src/OneGround.ZGW.Zaken.DataModel/Migrations/DataProtectionKeyDb/20260401134941_create_data_protection_keys.Designer.cs | Designer for DataProtection key migration |
| src/OneGround.ZGW.Zaken.DataModel/Migrations/DataProtectionKeyDb/20260401134941_create_data_protection_keys.cs | Creates data_protection.DataProtectionKeys table |
| src/OneGround.ZGW.Zaken.DataModel/Migrations/20260331000000_add_inpbsn_hash_and_encrypted_columns_to_zaakrollen.Designer.cs | Designer for BSN hash/encrypted migration |
| src/OneGround.ZGW.Zaken.DataModel/Migrations/20260331000000_add_inpbsn_hash_and_encrypted_columns_to_zaakrollen.cs | Adds new BSN columns + concurrent index |
| src/OneGround.ZGW.Zaken.DataModel/DataProtectionKeyDbContextFactory.cs | Design-time factory for DataProtection key context |
| src/OneGround.ZGW.Zaken.DataModel/DataProtectionKeyDbContext.cs | DbContext for persisting DataProtection keys in Postgres |
| src/OneGround.ZGW.DataAccess/ZGW.DataAccess.csproj | Adds packages needed for options + DataProtection abstractions |
| src/OneGround.ZGW.DataAccess/Encryption/ProtectedDataAttribute.cs | New attribute to mark properties for encryption |
| src/OneGround.ZGW.DataAccess/Encryption/ModelBuilderExtensions.cs | Applies DataProtection converter to marked properties |
| src/OneGround.ZGW.DataAccess/Encryption/IHmacHasher.cs | New interface for hashing abstraction |
| src/OneGround.ZGW.DataAccess/Encryption/IDatabaseProtector.cs | New interfaces for DB encryption/decryption |
| src/OneGround.ZGW.DataAccess/Encryption/HmacSha256Hasher.cs | Implements HMAC-SHA256 hashing |
| src/OneGround.ZGW.DataAccess/Encryption/HmacHasherConfiguration.cs | Options model for HMAC key configuration |
| src/OneGround.ZGW.DataAccess/Encryption/DataProtectionConverter.cs | EF value converter wrapping database protection |
| src/OneGround.ZGW.DataAccess/Encryption/DatabaseProtector.cs | DataProtection-based implementation of DB protector |
| src/Directory.Packages.props | Central package versions for DataProtection packages |
| README.md | Documents configuration for hashing + DataProtection |
| localdev/postgresql/init-database.sh/init-database.sh | Grants schema permissions for data_protection schema |
Files not reviewed (1)
- src/OneGround.ZGW.Zaken.DataModel/Migrations/DataProtectionKeyDb/20260401134941_create_data_protection_keys.Designer.cs: Language not supported
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
heuvea
reviewed
Apr 8, 2026
… MNIgration under the same schema
ragaumon
force-pushed
the
feature/FUND-2062_zrc_bsn_encrypt
branch
from
April 8, 2026 13:53
1f7ef34 to
3e9893b
Compare
Contributor
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 43 out of 45 changed files in this pull request and generated 4 comments.
Files not reviewed (1)
- src/OneGround.ZGW.Common.DataProtection.DataModel/Migrations/20260401134941_create_data_protection_keys.Designer.cs: Language not supported
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
heuvea
approved these changes
Apr 9, 2026
Grabauskas
reviewed
Apr 9, 2026
ragaumon
force-pushed
the
feature/FUND-2062_zrc_bsn_encrypt
branch
from
April 13, 2026 12:04
282726f to
79b2f0a
Compare
Grabauskas
reviewed
Apr 14, 2026
Contributor
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 48 out of 50 changed files in this pull request and generated 3 comments.
Files not reviewed (1)
- src/OneGround.ZGW.Common.DataProtection.DataModel/Migrations/20260401134941_create_data_protection_keys.Designer.cs: Language not supported
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Grabauskas
approved these changes
Apr 14, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Pull Request
Description
Encrypted BSN
Type of Change
Related Issues
FUND-2062
Testing
Checklist