feat(gis-integration): implement spec (#462)

[rubenvdlinde]

Closes #462

Summary

Auto-generated draft PR for OpenSpec change gis-integration.
The Hydra builder ran the spec but could not run gh pr create itself
(Phase D+E credential strip — Claude has no GH_TOKEN by design).
The entrypoint detected commits on the feature branch with no PR and
created this draft so the reviewer + security + applier can proceed.

Spec Reference

• Issue: Implement: GIS Integration #462
• Spec: /spec/
  • /spec/proposal.md

Commits on this branch

• 80e6b92 chore: add task-audit.json spec coherence record (Implement: GIS Integration #462)
• 8b50eff fix: add auth guard to WfsExportController, use camelCase route names (Implement: GIS Integration #462)
• b308c93 feat: GIS integration — WFS export endpoint and unit tests (Implement: GIS Integration #462)

Files changed

• appinfo/routes.php
• lib/Controller/WfsExportController.php
• lib/Service/WfsExportService.php
• openspec/changes/gis-integration/design.md
• openspec/changes/gis-integration/tasks.md
• task-audit.json
• tests/Unit/Controller/WfsExportControllerTest.php
• tests/Unit/Controller/WmsWfsControllerTest.php
• tests/Unit/Service/LocationServiceTest.php
• tests/Unit/Service/WfsExportServiceTest.php

---

PR auto-created by Hydra builder entrypoint (hydra_ensure_pr_exists)
because Claude's session closed without running gh pr create.
Reviewer + applier follow as normal.

[github-actions]

Quality Report — ConductionNL/procest @ 278453e

Check	PHP	Vue	Security	License	Tests
lint	✅
phpcs	✅
phpmd	✅
psalm	✅
phpstan	✅
phpmetrics	✅
eslint		✅
stylelint		✅
composer			✅	✅ 100/100
npm			✅	✅ 420/420
PHPUnit					❌
Newman					⏭️
Playwright					❌

Coverage: 0% (0/81 statements)

Spec coverage: 6% (30 tests / 512 specs)

---

Quality workflow — 2026-05-19 02:55 UTC

Download the full PDF report from the workflow artifacts.

[rubenvdlinde]

Security Review — Clyde Barcode

Result: PASS (0 fixed, 0 unfixed, 0 blocking)

• Total findings in PR diff: 0
• Fixed: 0
• Unfixed: 0
• Verdict: pass

All 14 hydra gates green. Semgrep (p/security-audit, p/owasp-top-ten, p/secrets) — 0 findings. composer audit — no PHP CVEs. gitleaks — 303 total findings, 0 in PR diff files (inherited debt). npm audit — 16 CVEs all pre-existing in Vue 2 / @nextcloud/* ecosystem (not introduced by this PR). PHPUnit 13/13 pass.

Manual OWASP review: auth annotations correct and consistent with sibling GisProxyController; input validation thorough (allowlisting, hard caps, floatval+bounds for bbox); no raw SQL; JSON-only responses (no XSS surface); GET endpoints (no CSRF concern); Host header validated by Nextcloud TrustedDomainMiddleware before controller runs.

Out-of-scope inherited debt (informational, non-blocking)

• npm audit: 16 low/moderate/high CVEs in Vue 2 ecosystem (vue ReDoS, vue-template-compiler XSS, vue-router→tinyglobby→picomatch). Not introduced by this PR — pre-existed on development. Recommend a dedicated dep-bump PR targeting @nextcloud/vue major version upgrade.
• gitleaks: 303 findings in unchanged files; 0 in PR diff.

---

🤖 Changes Clyde Barcode applied

• 93fd1db — fix(security-review bounded): Clyde post-run mechanical commit

View full diff · 1 file changed, 1 insertion(+), 1 deletion(-)

[github-actions]

Quality Report — ConductionNL/procest @ b988db7

Check	PHP	Vue	Security	License	Tests
lint	✅
phpcs	❌
phpmd	✅
psalm	❌
phpstan	❌
phpmetrics	✅
eslint		✅
stylelint		✅
composer			✅	✅ 100/100
npm			✅	❌
PHPUnit					❌
Newman					❌
Playwright					❌

---

Quality workflow — 2026-05-19 04:08 UTC

Download the full PDF report from the workflow artifacts.

[github-actions]

Quality Report — ConductionNL/procest @ 2817617

Check	PHP	Vue	Security	License	Tests
lint	✅
phpcs	✅
phpmd	✅
psalm	✅
phpstan	✅
phpmetrics	✅
eslint		✅
stylelint		✅
composer			✅	✅ 100/100
npm			✅	✅ 420/420
PHPUnit					✅
Newman					⏭️
Playwright					⏭️

Coverage: 0% (0/81 statements)

---

Quality workflow — 2026-05-19 04:13 UTC

Download the full PDF report from the workflow artifacts.

[WilcoLouwerse]

The WfsExport endpoint is explicitly designed for external GIS applications (QGIS, ArcGIS, MapInfo) that authenticate via HTTP Basic Auth or OIDC — as stated in both the controller doc-block and design.md. However, getFeatures() is missing @NoCSRFRequired.

Nextcloud's SecurityMiddleware enforces CSRF for every request not annotated with @NoCSRFRequired, regardless of HTTP verb. passesCSRFCheck() requires either an OCS-APIRequest header or a valid requesttoken parameter — neither of which an external GIS client sends. Since WfsExportController extends Controller (not OCSController), the middleware throws CrossSiteRequestForgeryException → 403, and the WFS layer is completely inaccessible to external tools.

For comparison, MetricsController (Prometheus scraper), HealthController (container health checks), and all DrcController ZGW-API endpoints all carry @NoCSRFRequired for exactly this reason.

Fix: add * @NoCSRFRequired directly below * @NoAdminRequired here.

[WilcoLouwerse]

Same root cause as getFeatures(): getCapabilities() is also missing @NoCSRFRequired.

The standard WFS client discovery flow calls /capabilities first. If this returns a CSRF 403, external GIS tools (QGIS, ArcGIS, etc.) cannot even discover the feature types, let alone add the layer — the entire integration is dead on arrival.

Fix: add * @NoCSRFRequired directly below * @NoAdminRequired here.

[WilcoLouwerse]

fetchLocations() always fetches up to $limit (max 2000) location records with only ['_limit' => $limit], then applies status and caseType filters in PHP memory via applyFilters().

This means a request for status=closed&maxFeatures=10 still loads 2000 rows from the database before discarding most of them. Not a blocker given the 2000 hard cap, but as case location datasets grow for active municipalities this will become noticeably expensive.

Suggested follow-up: pass caseStatus and caseType directly into $params so OpenRegister can filter at query time:

if ($status !== null) {
    $params['caseStatus'] = $status;
}
if ($caseType !== null) {
    $params['caseType'] = $caseType;
}

[WilcoLouwerse]

REQUEST_CHANGES — 2 blocking issues, 1 informational concern.

Blockers

Both WFS endpoints (getFeatures and getCapabilities) are missing @NoCSRFRequired. Nextcloud's SecurityMiddleware enforces CSRF on every route not annotated with that tag, regardless of HTTP verb. External GIS applications (QGIS, ArcGIS, MapInfo) connecting via HTTP Basic Auth or OIDC — the explicitly stated use case in the doc-block and design.md — will receive a 403 CrossSiteRequestForgeryException on every request, making the WFS layer completely inaccessible.

• 🔴 Missing @NoCSRFRequired on getFeatures()
• 🔴 Missing @NoCSRFRequired on getCapabilities()

Fix: add * @NoCSRFRequired below * @NoAdminRequired on both methods. Compare MetricsController, HealthController, and DrcController which all carry this annotation for the same reason (external consumers without Nextcloud session cookies).

Informational

• 🟡 Client-side status/caseType filtering after full fetch — no DB-level pushdown — not a blocker given the 2000 hard cap, worth a follow-up task.

Positives

• Architecture is correct: WfsExportService reads exclusively through OpenRegister via SettingsService.getObjectService() — no direct outbound HTTP calls, no PDOK bypass.
• All new PHP files carry correct SPDX headers, EUPL-1.2 license, and copyright blocks.
• Tasks 18–24 are all implemented and verified; AC 6 (WFS GeoJSON export) is complete.
• All CI checks pass (PHPUnit PHP 8.3/8.4 × NC stable31/32, CodeQL, ESLint, Psalm, PHPStan).

[rubenvdlinde]

Superseded by #604 (merged), which ports the unique work from this PR onto the current development baseline.

This branch had diverged from an unrelated history root (~117 commits behind dev) and could not be merged directly — its shared-file changes (routes.php, openspec change dirs) would have reverted merged dev work, and dev had independently grown a proxy-based GIS implementation (GisProxy/WmsWfs + LocationService + the gis-integration change dir with builds).

The genuinely-unique, self-contained additions — WfsExportService, WfsExportController, the two /api/gis/wfs routes, and both unit tests — were carried over verbatim in #604 (API-compatible with dev's SettingsService/ObjectService, @SPEC retargeted to dev's TASK-GIS-04/06, php -l clean).

No work lost. Closing in favour of #604.