fix(federation): honour confidentiality under every name it is stored as

[rubenvdlinde]

A confidentiality guard that fails open on a property-name mismatch

FederationController::applyShareVisibility() withholds non-public objects from non-object-scope federated shares. It read exactly one property name:

$confidentiality = strtolower((string) ($object['confidentiality'] ?? ''));
if (in_array($confidentiality, self::PUBLIC_CONFIDENTIALITY, true) === false) return false;

The same concept is written under two others:

name	written by
confidentiality	what this guard reads
confidentialityLevel	SeedZgwZakenMigrationPack maps /vertrouwelijkheidaanduiding onto it
vertrouwelijkheidaanduiding	the ZGW/GGM schema property itself

This fails open, not closed. ?? '' yields the empty string for an object storing its level under either other name, and PUBLIC_CONFIDENTIALITY is ['', 'openbaar', 'public', 'open'] — the empty string is in the allowlist, because an object with no level set is public. So an object marked zeer_geheim under a name the guard didn't read was served as public.

The mismatch is silent in both directions: nothing errors, nothing logs, and a response-shape assertion can't catch it because the field is absent rather than wrong.

The fix

Read the first present, non-empty key from an explicit alias list. Present and non-empty, not merely present — a schema sync can add an empty column before anything writes to it, and an empty confidentiality in front of a populated confidentialityLevel would reinstate the same fail-open.

The alias-reading pattern isn't new here: the organisation guard two lines above already does $self['organisation'] ?? $object['organisation'].

Direction of change

Measured across seven cases:

case	before	after
pack target, zeer_geheim	SHARED	blocked
schema name, vertrouwelijk	SHARED	blocked
empty canonical + secret alias	SHARED	blocked
canonical name, zeer_geheim	blocked	blocked
canonical name, openbaar	SHARED	SHARED
no level set (genuinely public)	SHARED	SHARED
whitespace-only value	SHARED	SHARED

Three moved SHARED → blocked; none moved blocked → SHARED. The change can only withhold more, never expose more. Objects with no level set stay public, which is what the empty string is there to mean.

Verification

• 14 tests, 20 assertions green across the new suite and the existing FederationControllerScopeTest, on PHP 8.3 — this app's floor; the host runs 8.2 and composer's platform check refuses it, so a local run would have been no evidence.
• Positive control: reverting the guard to the single-key read turns the new suite red at 4 of 8 — precisely the leaking rows — and restoring it returns 8/8.
  A first attempt at that control silently failed to apply the revert and re-tested the fixed code twice, reporting green both times. The run quoted above is the one that actually flipped the source.
• phpcs: 0 errors on both files. FederationController carries 7 warnings both before and after.

Scope I did not close

• I could not check live rows — the dev database container was not running. Whether any production object currently stores its level under a non-canonical name is unverified.
• SeedZgwZakenMigrationPack's own docblock calls it "a worked example (not a ready-to-run pack)", so it may never have run as-is. The schema property vertrouwelijkheidaanduiding is real regardless.
• The guard only applies to shares whose scope is not object.

The fix is worth landing on its own merits either way: reading one of three names for a security decision is wrong whether or not it is currently being exploited.

Related finding, not addressed here

ZaaktypeAuthorizationService — the ZGW authorization mapper that owns confidentiality ordinal ordering and buildConfidentialityMatch() — has zero call sites in lib/. All seven public methods are exercised only by their own unit test, while the archived change 2026-06-14-rbac-zaaktype marks those tasks [x] and describes the service as the enforcement path. A fully-tested authorization service with no callers is indistinguishable from no check at all. That needs its own investigation and I have not done it.

[github-actions]

Quality Report — ConductionNL/openregister @ 979162b

Check	PHP	Vue	Security	License	Tests
lint	✅
phpcs	❌
phpmd	❌
psalm	✅
phpstan	✅
phpmetrics	✅
eslint		✅
stylelint		✅
build		✅
check-specs		✅
test-l10n		✅
composer			✅	✅ 173/173
npm			✅	✅ 546/546
PHPUnit					❌
Newman					✅
Playwright					✅
Hydra gates					❌

---

Quality workflow — 2026-08-12 07:48 UTC

Download the full PDF report from the workflow artifacts.

[rubenvdlinde]

The seven red checks are pre-existing — measured, not assumed

development's own latest Code Quality run (31574073255) fails six of the same seven: phpcs, phpmd, PHPUnit (8.3), PHPUnit (8.4), Hydra Gates, Quality Report.

PHPUnit is the one worth showing, because it is the check most likely to be mine:

	tests	failures	message
development	16,298	1	Expectation failed for method name is "find" when invoked 0 times.
this PR	16,306	1	identical

The delta is exactly +8 tests — the 8 this PR adds — and the same single pre-existing failure. Nothing here broke it and nothing here fixes it.

The seventh, Newman API Test Suite, needed care. development runs a job called Integration Tests (Newman), which is green there — a different job from the one red here, so a name-to-name comparison would have read as "this PR broke Newman". Its log resolves to the same PHPUnit run and the same single "find" expectation failure.

That trap is worth naming: comparing a PR-only job (or a similarly-named different job) against a branch that never runs it makes a pre-existing failure look new. It is the same shape as Quality Report on openbuild#176.

What this PR contains

The federation confidentiality alias read and its 8-test regression suite. phpcs measured 0 errors on both changed files locally, against a 7-warning baseline that is unchanged.