From 10b784cc052e3e09fcc2de0c5db7839cc2041189 Mon Sep 17 00:00:00 2001
From: Niek Otten <not@respellion.nl>
Date: Fri, 14 Aug 2026 10:20:26 +0200
Subject: [PATCH] fix(infra): reach Objecten by service name in the
 register-record check (refs #149)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

CI caught my own check falling into the constraint ADR-0028 documents: it looked
Objecttypen up by container IP, so the objecttype URL came back IP-addressed and
Objecten rejected it as "not one of the available choices". Reach both by
service name — compose DNS resolves them, and neither request has OpenZaak's
URL-validity constraint that made IPs necessary elsewhere in this script.

The 400 also spent the full 60s timeout disguised as "transport:" because
HTTPError is a URLError subclass. Handle it separately: a 4xx now fails
immediately with the response body, which is where the real reason was.

Verified both ways against a live Objecten: absent record → exit 1 with the
reason, present record → exit 0.
---
 infra/register-record-check.py |  8 ++++++++
 infra/run-domain-check.sh      | 10 ++++++++--
 2 files changed, 16 insertions(+), 2 deletions(-)

diff --git a/infra/register-record-check.py b/infra/register-record-check.py
index e8e16fd..538bec9 100644
--- a/infra/register-record-check.py
+++ b/infra/register-record-check.py
@@ -77,6 +77,14 @@ def main():
             if ok:
                 print(f"OK — approval wrote the register record to Objecten: {detail}")
                 return 0
+        except urllib.error.HTTPError as e:
+            # A 4xx is us, not a cold start — retrying just hides the reason until the deadline.
+            # (A rejected objecttype URL shows up here as a 400 with a very specific body.)
+            body = e.read().decode(errors="replace")[:400]
+            if e.code < 500:
+                print(f"FAIL — HTTP {e.code} from {e.url}: {body}", file=sys.stderr)
+                return 1
+            detail = f"HTTP {e.code}: {body}"
         except (urllib.error.URLError, ConnectionError, TimeoutError) as e:
             detail = f"transport: {e}"
         time.sleep(3)
diff --git a/infra/run-domain-check.sh b/infra/run-domain-check.sh
index 9f12b75..3d0cbb2 100755
--- a/infra/run-domain-check.sh
+++ b/infra/run-domain-check.sh
@@ -146,15 +146,21 @@ echo "OK — behandelaar claimed and completed the Beoordelen task; the registra
 # Assert it for THIS registration (matched on its reference) rather than "some INGESCHREVEN record":
 # the shared verify stack carries records from earlier runs. The container-name filters are anchored
 # on the compose replica suffix so they don't also match objecten-db / objecttypen-db.
+#
+# Unlike every other check here, these two are reached by SERVICE NAME, not container IP. Objecttypen
+# echoes the request Host into the objecttype `url`, and Objecten only accepts the objecttype URL that
+# matches its configured api_root (http://objecttypen:8000/api/v2/) — an IP-addressed lookup yields a
+# URL Objecten rejects with 400 (ADR-0028). Compose DNS resolves both names on this network, and
+# neither request has OpenZaak's URL-validity constraint.
 echo ">> asserting the approval wrote the register record to Objecten (S-19a)"
 obj="$(docker ps -q --filter 'name=objecten[-_][0-9]+$' | head -1)"
 objt="$(docker ps -q --filter 'name=objecttypen[-_][0-9]+$' | head -1)"
 [ -n "$obj" ] || { echo "FAIL — no running objecten container" >&2; exit 1; }
 [ -n "$objt" ] || { echo "FAIL — no running objecttypen container" >&2; exit 1; }
 rr="$(docker create --network "$net" \
-  -e "OBJECTEN=http://$(ip "$obj"):8000" \
+  -e "OBJECTEN=http://objecten:8000" \
   -e "OBJECTEN_TOKEN=${OBJECTEN_TOKEN:-1234567890abcdef1234567890abcdef12345678}" \
-  -e "OBJECTTYPEN=http://$(ip "$objt"):8000" \
+  -e "OBJECTTYPEN=http://objecttypen:8000" \
   -e "OBJECTTYPEN_TOKEN=${OBJECTTYPEN_TOKEN:-0123456789abcdef0123456789abcdef01234567}" \
   -e "REGISTRATION_REFERENCE=$reg_id" \
   python:3-slim python /register-record-check.py)"