[#867] TVS authentication

[marlonbaeten]

Closes #867

Closes #409

Note: this code was co-authored by Claude Opus 4.8
This code should be reviewed and tested by at least 2 other developers.

DOD checklist

For PR maintainer

Perform these checks before marking the PR as ready:

• I have linked the PR to at least one issue.
• I assigned the PR to myself.
• I have added a description how to test this PR (see "Review Instructions").
• I have added documentation where necessary.

For reviewer

• I have read all code changes.
• I have audited the code quality.
• I have tested the changes either or both:
  • locally
  • on the test environment (preferred)
• I have validated that the PR is functionally correct (use-cases, figma designs, etc.)

Review instructions

Login locally with the TVS mock service. Validate that picking a different BSN gives different data and vice-versa.

[github-actions]

Sigrid maintainability feedback

---

🔒Enable security insights in your CI pipeline to detect vulnerabilities early.
Start using Sigrid CI for Security today. Learn more.

---

↗️ You improved your code towards your objective of 3.5 stars.

Show details

Sigrid compared your code against the baseline of 2026-08-05.

👍 What went well?

You fixed or improved 0 refactoring candidates.

👎 What could be better?

Unfortunately, 133 refactoring candidates were introduced or got worse.

Risk	System property	Location
🔴	Module Coupling (Introduced)	auth-service/src/saml/xml_parser.rs
🔴	Component Independence (Introduced)	auth-service/src/state/mod.rs mod.rs
🟠	Unit Interfacing (Introduced)	auth-service/src/handlers/acs.rs handle_login_error(LoginErrorPath,State<S>,CookieJar,HeaderMap,Query<HashMap<String, String>>)
🟠	Unit Interfacing (Introduced)	auth-service/src/handlers/acs.rs confirm_pending_request(S,AuthServiceState,Claims,CookieJar,HeaderMap)
🟠	Unit Interfacing (Introduced)	auth-service/src/handlers/acs.rs handle_acs(SamlAcsPath,State<S>,State<AuthServiceState>,CookieJar,HeaderMap,Query<HashMap<String, String>>)
🟠	Module Coupling (Introduced)	auth-service/src/saml/validation/helpers.rs
🟠	Module Coupling (Introduced)	auth-service/src/state/mod.rs
🟠	Component Independence (Introduced)	auth-service/src/handlers/logout/mod.rs mod.rs
⚪️		+ 125 more

📚 Remaining technical debt

0 refactoring candidates didn't get better or worse, but are still present in the code you touched.

View this system in Sigrid to explore your technical debt

⭐️ Sigrid ratings

System property	System on 2026-08-05	Before changes	New/changed code
Volume	N/A	N/A	N/A
Duplication	5.3	N/A	5.5
Unit Size	3.1	N/A	2.8
Unit Complexity	4.5	N/A	5.1
Unit Interfacing	2.3	N/A	2.2
Module Coupling	3.1	N/A	2.2
Component Independence	1.9	N/A	2.9
Component Entanglement	1.6	N/A	N/A
Maintainability	3.1	N/A	3.3

💬 Did you find this feedback helpful?

We would like to know your thoughts to make Sigrid better.
Your username will remain confidential throughout the process.

• ✅ Yes, these findings are useful
• 🔸 The findings are false positives
• 🔹 These findings are not important to me

---

View this system in Sigrid

[github-actions]

PDF diff summary

Template	Input	Status
model-h1	model-h1-example-1.pdf	🔵 identical
model-h1	model-h1-example-2.pdf	🔵 identical
model-h1	model-h1-example-3.pdf	🔵 identical
model-h3-1	model-h3-1-example-1.pdf	🔵 identical
model-h3-1	model-h3-1-example-2.pdf	🔵 identical
model-h3-1	model-h3-1-example-3.pdf	🔵 identical
model-h3-2	model-h3-2-example-1.pdf	🔵 identical
model-h3-2	model-h3-2-example-2.pdf	🔵 identical
model-h3-2	model-h3-2-example-3.pdf	🔵 identical
model-h4	model-h4-example-1.pdf	🔵 identical
model-h4	model-h4-example-2.pdf	🔵 identical
model-h4	model-h4-example-3.pdf	🔵 identical
model-h9	model-h9-example-1.pdf	🔵 identical
model-h9	model-h9-example-2.pdf	🔵 identical
model-h9	model-h9-example-3.pdf	🔵 identical
model-i4	model-i4-example-1.pdf	🔵 identical
model-i4	model-i4-example-2.pdf	🔵 identical

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
97.6% Coverage on New Code
1.2% Duplication on New Code

See analysis details on SonarQube Cloud

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
89.6% Coverage on New Code
0.2% Duplication on New Code

See analysis details on SonarQube Cloud