fix(infra): correlate the delivery on the object URL, not the record reference (refs #152)

The publish chain works — the sink received it:

  {"kanaal": "objecten", "resource": "object", "kenmerken": {"objectType": "…"},
   "hoofdObject": "http://objecten.local:8000/api/v2/objects/a68d4c46-…", …}

The check just looked for the wrong thing. An NRC notification carries hoofdObject /
resourceUrl and kenmerken — never the record data — so the `reference` inside the
RegisterRecord it wrote was never going to appear in the delivered message. Grep the sink
for the object URL instead, which is what identifies the write.

infra/objecten-notifications-check.py

@@ -4,7 +4,7 @@
 Registers an abonnement on the `objecten` kanaal pointing at the webhook sink, then writes a
 RegisterRecord object exactly as the ACL's ObjectenGateway does (S-19a). The caller
 (run-objecten-notifications-check.sh) watches the sink for the delivery — this only sets it up,
-and prints `REFERENCE <value>` for the caller to grep on.
+and prints `OBJECT_URL <url>` for the caller to grep on.
 
 Delivery exercises the whole chain: Objecten → its celery worker → NRC → nrc-beat → the callback.
 Anything missing (broker, worker, kanaal, notifications config) shows up as a non-delivery.
@@ -111,7 +111,9 @@ def main():
         },
     }, crs=True)
     print(f">> wrote RegisterRecord {created['url']}")
-    print(f"REFERENCE {reference}")
+    # An NRC notification carries no record data — only hoofdObject/resourceUrl — so the object
+    # URL, not the reference in its data, is what the caller can correlate the delivery on.
+    print(f"OBJECT_URL {created['url']}")
     return 0
 
 

infra/run-objecten-notifications-check.sh

@@ -58,22 +58,24 @@ drv="$(docker create --network "$net" --name rr-overify \
   python:3-slim python /driver.py)"
 docker cp "$here/objecten-notifications-check.py" "$drv:/driver.py" >/dev/null
 docker start -a "$drv"
-reference="$(docker logs rr-overify 2>/dev/null | sed -n 's/^REFERENCE //p' | head -1)"
+object_url="$(docker logs rr-overify 2>/dev/null | sed -n 's/^OBJECT_URL //p' | head -1)"
 docker rm -f rr-overify >/dev/null
-[ -n "$reference" ] || { echo "FAIL — the driver did not write a RegisterRecord" >&2; exit 1; }
+[ -n "$object_url" ] || { echo "FAIL — the driver did not write a RegisterRecord" >&2; exit 1; }
-echo ">> wrote reference $reference"
+echo ">> wrote $object_url"
 
+# Correlate on the object URL: a notification carries hoofdObject/resourceUrl, never the record
+# data, so the reference inside the record is not in the delivered message.
 echo ">> waiting for the notification to reach the sink"
 for _ in $(seq 1 "${NOTIFICATION_TRIES:-40}"); do
-  if docker logs rr-osink 2>&1 | grep -q "$reference"; then
+  if docker logs rr-osink 2>&1 | grep -qF "$object_url"; then
     echo "OK — Objecten published to NRC and the abonnement delivered it:"
-    docker logs rr-osink 2>&1 | grep "$reference" | tail -1 | cut -c1-500
+    docker logs rr-osink 2>&1 | grep -F "$object_url" | tail -1 | cut -c1-500
     exit 0
   fi
   sleep 2
 done
 
-echo "FAIL — no 'objecten' notification for $reference reached the sink." >&2
+echo "FAIL — no 'objecten' notification for $object_url reached the sink." >&2
 echo "       Objecten accepted the write, so the gap is downstream: the celery broker/worker," >&2
 echo "       the kanaal registration, or Objecten's notifications_config." >&2
 echo "--- sink log ---" >&2; docker logs rr-osink 2>&1 | tail -8 >&2