fix(security): clear Bucket-B (ADR-023 + auth/routing)

appinfo/routes.php

@@ -17,8 +17,9 @@
 
 return [
     'routes' => [
-        // Dashboard route
+        // Dashboard routes
         ['name' => 'dashboard#page', 'url' => '/', 'verb' => 'GET'],
+        ['name' => 'dashboard#index', 'url' => '/api/dashboard', 'verb' => 'GET'],
 
         // Generic per-user preferences (used by shared nextcloud-vue widgets, e.g. CnSupportDialog).
         ['name' => 'preferences#getPreference', 'url' => '/api/preferences/{key}', 'verb' => 'GET'],
@@ -30,7 +31,9 @@
         ['name' => 'settings#load', 'url' => '/api/settings/load', 'verb' => 'GET'],
         ['name' => 'settings#initialize', 'url' => '/api/settings/initialize', 'verb' => 'POST'],
         ['name' => 'settings#status', 'url' => '/api/settings/status', 'verb' => 'GET'],
-        ['name' => 'settings#auto_configure', 'url' => '/api/settings/auto-configure', 'verb' => 'POST'],
+        ['name' => 'settings#stats', 'url' => '/api/settings/stats', 'verb' => 'GET'],
+        ['name' => 'settings#autoConfigure', 'url' => '/api/settings/auto-configure', 'verb' => 'POST'],
+        ['name' => 'settings#consolidatedAutoConfigure', 'url' => '/api/settings/consolidated-auto-configure', 'verb' => 'POST'],
         ['name' => 'settings#debug', 'url' => '/api/settings/debug', 'verb' => 'GET'],
 
         // Separate endpoints for performance optimization
@@ -51,26 +54,22 @@
         ['name' => 'settings#resetAutoConfig', 'url' => '/api/settings/reset-auto-config', 'verb' => 'POST'],
 
         // Email management routes
-        ['name' => 'settings#send_test_email', 'url' => '/api/email/test', 'verb' => 'POST'],
-        ['name' => 'settings#test_email_connection', 'url' => '/api/email/test-connection', 'verb' => 'POST'],
-        ['name' => 'settings#get_email_settings', 'url' => '/api/settings/email', 'verb' => 'GET'],
-        ['name' => 'settings#update_email_settings', 'url' => '/api/settings/email', 'verb' => 'POST'],
+        ['name' => 'settings#sendTestEmail', 'url' => '/api/email/test', 'verb' => 'POST'],
+        ['name' => 'settings#testEmailConnection', 'url' => '/api/email/test-connection', 'verb' => 'POST'],
+        ['name' => 'settings#getEmailSettings', 'url' => '/api/settings/email', 'verb' => 'GET'],
+        ['name' => 'settings#updateEmailSettings', 'url' => '/api/settings/email', 'verb' => 'POST'],
 
         // Email template management routes
-        ['name' => 'settings#get_email_templates', 'url' => '/api/email/templates', 'verb' => 'GET'],
-        ['name' => 'settings#get_email_template', 'url' => '/api/email/templates/{templateName}', 'verb' => 'GET'],
-        ['name' => 'settings#update_email_template', 'url' => '/api/email/templates/{templateName}', 'verb' => 'POST'],
-        ['name' => 'settings#get_email_template_default', 'url' => '/api/email/templates/{templateName}/default', 'verb' => 'GET'],
-        ['name' => 'settings#get_email_template_variables', 'url' => '/api/email/templates/{templateName}/variables', 'verb' => 'GET'],
+        ['name' => 'settings#getEmailTemplates', 'url' => '/api/email/templates', 'verb' => 'GET'],
+        ['name' => 'settings#getEmailTemplate', 'url' => '/api/email/templates/{templateName}', 'verb' => 'GET'],
+        ['name' => 'settings#updateEmailTemplate', 'url' => '/api/email/templates/{templateName}', 'verb' => 'POST'],
+        ['name' => 'settings#getEmailTemplateDefault', 'url' => '/api/email/templates/{templateName}/default', 'verb' => 'GET'],
+        ['name' => 'settings#getEmailTemplateVariables', 'url' => '/api/email/templates/{templateName}/variables', 'verb' => 'GET'],
 
-        // Health check endpoint
-        ['name' => 'settings#health_check', 'url' => '/api/health', 'verb' => 'GET'],
+        // Note: /api/health is served by settings#status above
 
         // Configuration cache management
-        ['name' => 'settings#clear_cache', 'url' => '/api/settings/clear-cache', 'verb' => 'POST'],
-
-        // Force re-initialization endpoint
-        ['name' => 'settings#force_reinit', 'url' => '/api/settings/force-reinit', 'verb' => 'POST'],
+        ['name' => 'settings#clearCache', 'url' => '/api/settings/clear-cache', 'verb' => 'POST'],
 
         // ArchiMate import/export routes
         ['name' => 'settings#importArchiMate', 'url' => '/api/archimate/import', 'verb' => 'POST'],
@@ -84,16 +83,16 @@
         ['name' => 'settings#killArchiMateImport', 'url' => '/api/archimate/import/kill', 'verb' => 'POST'], // deprecated
         ['name' => 'settings#clearArchiMateExportStatus', 'url' => '/api/archimate/status/export/clear', 'verb' => 'POST'],
 
-        ['name' => 'settings#test_archimate_round_trip', 'url' => '/api/archimate/test-round-trip', 'verb' => 'POST'],
+        ['name' => 'settings#testArchiMateRoundTrip', 'url' => '/api/archimate/test-round-trip', 'verb' => 'POST'],
 
         // User Groups management routes
-        ['name' => 'settings#get_generic_user_groups', 'url' => '/api/settings/user-groups/generic', 'verb' => 'GET'],
-        ['name' => 'settings#set_generic_user_groups', 'url' => '/api/settings/user-groups/generic', 'verb' => 'POST'],
-        ['name' => 'settings#get_organization_admin_groups', 'url' => '/api/settings/user-groups/organization-admin', 'verb' => 'GET'],
-        ['name' => 'settings#set_organization_admin_groups', 'url' => '/api/settings/user-groups/organization-admin', 'verb' => 'POST'],
-        ['name' => 'settings#get_super_user_groups', 'url' => '/api/settings/user-groups/super-user', 'verb' => 'GET'],
-        ['name' => 'settings#set_super_user_groups', 'url' => '/api/settings/user-groups/super-user', 'verb' => 'POST'],
-        ['name' => 'settings#get_all_groups', 'url' => '/api/settings/user-groups/all', 'verb' => 'GET'],
+        ['name' => 'settings#getGenericUserGroups', 'url' => '/api/settings/user-groups/generic', 'verb' => 'GET'],
+        ['name' => 'settings#setGenericUserGroups', 'url' => '/api/settings/user-groups/generic', 'verb' => 'POST'],
+        ['name' => 'settings#getOrganizationAdminGroups', 'url' => '/api/settings/user-groups/organization-admin', 'verb' => 'GET'],
+        ['name' => 'settings#setOrganizationAdminGroups', 'url' => '/api/settings/user-groups/organization-admin', 'verb' => 'POST'],
+        ['name' => 'settings#getSuperUserGroups', 'url' => '/api/settings/user-groups/super-user', 'verb' => 'GET'],
+        ['name' => 'settings#setSuperUserGroups', 'url' => '/api/settings/user-groups/super-user', 'verb' => 'POST'],
+        ['name' => 'settings#getAllGroups', 'url' => '/api/settings/user-groups/all', 'verb' => 'GET'],
 
         // Progress streaming routes
         ['name' => 'settings#getProgress', 'url' => '/api/progress/{operationId}', 'verb' => 'GET'],
@@ -177,6 +176,8 @@
 
         // AangebodenGebruik API endpoints for filtering gebruiks by organization involvement
         ['name' => 'aangebodenGebruik#getGebruiksWhereAfnemer', 'url' => '/api/aangeboden-gebruik/afnemer', 'verb' => 'GET'],
+        ['name' => 'aangebodenGebruik#getAllGebruiksForAmbtenaar', 'url' => '/api/aangeboden-gebruik/ambtenaar', 'verb' => 'GET'],
+        ['name' => 'aangebodenGebruik#getSingleGebruikForAmbtenaar', 'url' => '/api/aangeboden-gebruik/ambtenaar/{gebruikId}', 'verb' => 'GET'],
         ['name' => 'aangebodenGebruik#getGebruiksWhereDeelnemers', 'url' => '/api/aangeboden-gebruik/deelnemers', 'verb' => 'GET'],
         ['name' => 'aangebodenGebruik#setGebruikSelfToActiveOrg', 'url' => '/api/aangeboden-gebruik/{gebruikId}/set-self', 'verb' => 'PUT'],
         ['name' => 'aangebodenGebruik#deleteGebruikAsAfnemer', 'url' => '/api/aangeboden-gebruik/{gebruikId}/deny', 'verb' => 'DELETE'],

lib/Controller/AanbodController.php

@@ -79,7 +79,6 @@ public function __construct(
      *
      * @return JSONResponse JSON response with aanbod objects array
      *
-     * @NoAdminRequired
      * @NoCSRFRequired
      * @PublicPage
      *
@@ -156,7 +155,6 @@ public function getAanbod(): JSONResponse
      *
      * @return JSONResponse JSON response with success status and updated object
      *
-     * @NoAdminRequired
      * @NoCSRFRequired
      * @PublicPage
      *
@@ -257,7 +255,6 @@ function ($key) {
      *
      * @return JSONResponse JSON response with success status and deletion details
      *
-     * @NoAdminRequired
      * @NoCSRFRequired
      * @PublicPage
      *

lib/Controller/AangebodenGebruikController.php

@@ -84,10 +84,8 @@ public function __construct(
      *
      * @return JSONResponse JSON response with gebruiks array where org is afnemer
      *
-     * @NoAdminRequired
      * @NoCSRFRequired
      * @PublicPage
-     * @PublicPage
      * @spec            openspec/changes/retrofit-2026-05-26-aangeboden-gebruik-api/tasks.md#task-1
      */
     public function getGebruiksWhereAfnemer(): JSONResponse
@@ -161,7 +159,6 @@ public function getGebruiksWhereAfnemer(): JSONResponse
      *
      * @return JSONResponse Koppelingen and gebruiks objects for the specified UUID
      *
-     * @NoAdminRequired
      * @NoCSRFRequired
      * @PublicPage
      * @spec            openspec/changes/retrofit-2026-05-26-aangeboden-gebruik-api/tasks.md#task-1
@@ -252,7 +249,6 @@ public function getKoppelingenGebruikByUuid(string $uuid): JSONResponse
      *
      * @return JSONResponse All gebruiks objects in standard searchObjectsPaginated format
      *
-     * @NoAdminRequired
      * @NoCSRFRequired
      * @PublicPage
      * @spec            openspec/changes/retrofit-2026-05-26-aangeboden-gebruik-api/tasks.md#task-1
@@ -357,10 +353,8 @@ public function getAllGebruiksForAmbtenaar(): JSONResponse
      *
      * @return JSONResponse Single gebruik object in standard searchObjectsPaginated format
      *
-     * @NoAdminRequired
      * @NoCSRFRequired
      * @PublicPage
-     * @PublicPage
      *
      * @SuppressWarnings(PHPMD.ExcessiveMethodLength)
      * @spec                                          openspec/changes/retrofit-2026-05-26-aangeboden-gebruik-api/tasks.md#task-1
@@ -531,10 +525,8 @@ private function isUserInGroup(string $groupName): bool
      *
      * @return JSONResponse JSON response with gebruiks array where org is in deelnemers
      *
-     * @NoAdminRequired
      * @NoCSRFRequired
      * @PublicPage
-     * @PublicPage
      * @spec            openspec/changes/retrofit-2026-05-26-aangeboden-gebruik-api/tasks.md#task-1
      */
     public function getGebruiksWhereDeelnemers(): JSONResponse
@@ -610,10 +602,8 @@ public function getGebruiksWhereDeelnemers(): JSONResponse
      *
      * @return JSONResponse JSON response with success status and updated object
      *
-     * @NoAdminRequired
      * @NoCSRFRequired
      * @PublicPage
-     * @PublicPage
      * @spec            openspec/changes/retrofit-2026-05-26-aangeboden-gebruik-api/tasks.md#task-2
      */
     public function setGebruikSelfToActiveOrg(string $gebruikId): JSONResponse
@@ -718,10 +708,8 @@ function ($key) {
      *
      * @return JSONResponse JSON response with success status and deletion details
      *
-     * @NoAdminRequired
      * @NoCSRFRequired
      * @PublicPage
-     * @PublicPage
      * @spec            openspec/changes/retrofit-2026-05-26-aangeboden-gebruik-api/tasks.md#task-2
      */
     public function deleteGebruikAsAfnemer(string $gebruikId): JSONResponse
@@ -817,10 +805,8 @@ function ($key) {
      *
      * @return JSONResponse JSON response with API documentation
      *
-     * @NoAdminRequired
      * @NoCSRFRequired
      * @PublicPage
-     * @PublicPage
      *
      * @SuppressWarnings(PHPMD.ExcessiveMethodLength)
      * @spec                                          openspec/changes/retrofit-2026-05-26-aangeboden-gebruik-api/tasks.md#task-3

lib/Controller/ContactpersonenController.php

@@ -23,6 +23,7 @@
 use OCA\SoftwareCatalog\Service\SoftwareCatalogue\ContactPersonHandler;
 use OCA\SoftwareCatalog\Service\ContactpersoonService;
 use OCP\AppFramework\Controller;
+use OCP\AppFramework\Http;
 use OCP\AppFramework\Http\JSONResponse;
 use OCP\IRequest;
 use OCP\IUserManager;
@@ -173,6 +174,10 @@ public function __construct(
      */
     public function getContactpersonen(string $organisationId): JSONResponse
     {
+        if ($this->userSession->getUser() === null) {
+            return new JSONResponse(['message' => 'Not authenticated'], Http::STATUS_UNAUTHORIZED);
+        }
+
         try {
             // Get object service.
             $objectService = \OC::$server->get('OCA\OpenRegister\Service\ObjectService');
@@ -269,6 +274,10 @@ function ($group) {
      */
     public function convertToUser(string $contactpersoonId): JSONResponse
     {
+        if ($this->userSession->getUser() === null) {
+            return new JSONResponse(['message' => 'Not authenticated'], Http::STATUS_UNAUTHORIZED);
+        }
+
         try {
             // Get object service.
             $objectService = \OC::$server->get('OCA\OpenRegister\Service\ObjectService');
@@ -495,6 +504,10 @@ public function convertToUser(string $contactpersoonId): JSONResponse
      */
     public function changePassword(string $username, string $newPassword): JSONResponse
     {
+        if ($this->userSession->getUser() === null) {
+            return new JSONResponse(['message' => 'Not authenticated'], Http::STATUS_UNAUTHORIZED);
+        }
+
         try {
             $user = $this->userManager->get($username);
 
@@ -584,6 +597,10 @@ public function changePassword(string $username, string $newPassword): JSONRespo
      */
     public function updateUserGroups(string $username, array $groups=[]): JSONResponse
     {
+        if ($this->userSession->getUser() === null) {
+            return new JSONResponse(['message' => 'Not authenticated'], Http::STATUS_UNAUTHORIZED);
+        }
+
         try {
             $user = $this->userManager->get($username);
 
@@ -708,6 +725,10 @@ function ($group) {
      */
     public function getContactPersonsWithUserDetailsForOrganization(string $organizationUuid): JSONResponse
     {
+        if ($this->userSession->getUser() === null) {
+            return new JSONResponse(['message' => 'Not authenticated'], Http::STATUS_UNAUTHORIZED);
+        }
+
         try {
             $this->logger->info(
                     'ContactpersonenController: Getting contact persons with user details for organization',
@@ -800,6 +821,10 @@ public function getContactPersonsWithUserDetailsForOrganization(string $organiza
      */
     public function getUserInfo(string $contactpersoonId): JSONResponse
     {
+        if ($this->userSession->getUser() === null) {
+            return new JSONResponse(['message' => 'Not authenticated'], Http::STATUS_UNAUTHORIZED);
+        }
+
         try {
             $this->logger->info(
                     'ContactpersonenController: Getting user info for contactpersoon',
@@ -927,6 +952,10 @@ public function getUserInfo(string $contactpersoonId): JSONResponse
      */
     public function getAvailableGroups(): JSONResponse
     {
+        if ($this->userSession->getUser() === null) {
+            return new JSONResponse(['message' => 'Not authenticated'], Http::STATUS_UNAUTHORIZED);
+        }
+
         try {
             $availableGroups = [
                 [
@@ -992,6 +1021,10 @@ public function getAvailableGroups(): JSONResponse
      */
     public function disableUser(string $contactpersoonId): JSONResponse
     {
+        if ($this->userSession->getUser() === null) {
+            return new JSONResponse(['message' => 'Not authenticated'], Http::STATUS_UNAUTHORIZED);
+        }
+
         try {
             // Delegate to service.
             $this->contactSvc->disableUserForContactpersoon($contactpersoonId);
@@ -1000,7 +1033,7 @@ public function disableUser(string $contactpersoonId): JSONResponse
                     'User account disabled',
                     [
                         'contactpersoonId' => $contactpersoonId,
-                        'disabled_by'      => $this->userSession->getUser()?->getUID(),
+                        'disabled_by'      => $this->userSession->getUser()->getUID(),
                     ]
                     );
             return new JSONResponse(
@@ -1040,6 +1073,10 @@ public function disableUser(string $contactpersoonId): JSONResponse
      */
     public function enableUser(string $contactpersoonId): JSONResponse
     {
+        if ($this->userSession->getUser() === null) {
+            return new JSONResponse(['message' => 'Not authenticated'], Http::STATUS_UNAUTHORIZED);
+        }
+
         try {
             // Delegate to service.
             $this->contactSvc->enableUserForContactpersoon($contactpersoonId);
@@ -1048,7 +1085,7 @@ public function enableUser(string $contactpersoonId): JSONResponse
                     'User account enabled',
                     [
                         'contactpersoonId' => $contactpersoonId,
-                        'enabled_by'       => $this->userSession->getUser()?->getUID(),
+                        'enabled_by'       => $this->userSession->getUser()->getUID(),
                     ]
                     );
             return new JSONResponse(
@@ -1086,6 +1123,10 @@ public function enableUser(string $contactpersoonId): JSONResponse
      */
     public function testBulkUserInfo(): JSONResponse
     {
+        if ($this->userSession->getUser() === null) {
+            return new JSONResponse(['message' => 'Not authenticated'], Http::STATUS_UNAUTHORIZED);
+        }
+
         try {
                 $objectServiceAvail = 'null';
             if ($this->contactSvc !== null) {
@@ -1147,6 +1188,10 @@ public function testBulkUserInfo(): JSONResponse
      */
     public function getBulkUserInfo(): JSONResponse
     {
+        if ($this->userSession->getUser() === null) {
+            return new JSONResponse(['message' => 'Not authenticated'], Http::STATUS_UNAUTHORIZED);
+        }
+
         try {
             $input = json_decode(file_get_contents('php://input'), true);
             $contactpersoonIds = $input['contactpersoonIds'] ?? [];
@@ -1213,18 +1258,13 @@ public function getBulkUserInfo(): JSONResponse
      */
     public function getMe(): JSONResponse
     {
+        if ($this->userSession->getUser() === null) {
+            return new JSONResponse(['message' => 'Not authenticated'], Http::STATUS_UNAUTHORIZED);
+        }
+
         try {
             // Get current user from session.
             $user = $this->userSession->getUser();
-            if ($user === null) {
-                return new JSONResponse(
-                        [
-                            'success' => false,
-                            'message' => 'Not authenticated',
-                        ],
-                        401
-                        );
-            }
 
             $userId    = $user->getUID();
             $userEmail = $user->getEMailAddress() ?? $userId;