not
0cd70ae8c3
Closes #149. **Outcome:** approving a registration now writes the canonical register record to the **Objecten** API as a `RegisterRecord` object, alongside the ZGW eindstatus. OpenZaak holds the process, Objecten holds the register (ADR-0028). The write goes through the ACL (§8.1) and is idempotent on the zaak id, so a replayed approval updates the existing object rather than creating a second one. S-19 (#20) was split first (CLAUDE.md §13) — it bundled this with re-sourcing the read projection, which is now #150. ### What landed - `IRegisterRecordGateway` + `RegisterRecord` in `Acl.Application`; `ObjectenGateway` in `Acl.Infrastructure` (static Token auth, CRS headers, objecttype resolved by name to its highest **published** version). - `AclService.ApproveZaakAsync` writes the record after the eindstatus, keyed on the zaak UUID with the zaak's identificatie as reference. - Compose wiring for both stacks; `ADR-0028`; demo note; PRD §15 out-of-scope line retired. ### Three things only a live stack found Running the gateway against a real Objecten + Objecttypen pair while writing this turned up blockers CI would have hit after the fact: 1. **Objecten rejects an objecttype it has not been configured with**, by UUID — assigned at seed time by a one-shot that runs *after* Objecten's static setup_configuration. The UUID is now pinned on both sides. 2. **Objecten 500s on every write when its Notificaties config is absent** (`notifications_api_common` raises rather than skipping). Objecten → NRC has no broker, worker, kanaal or abonnement, so notifications are **disabled** rather than wired to drop every message; #150 turns them on for real. 3. **Objecttypen echoes the request Host into the objecttype `url`**, and Objecten only accepts the one matching its configured `api_root` — so the ACL must read Objecttypen at `http://objecttypen:8000`. This is why the new integration test only passes inside the compose network. All three are recorded in ADR-0028. ### Verification - `ObjectenGatewayIntegrationTests` (verify-acl, in-network): two writes for one id leave exactly one object with the second write's status. **Passing locally against live Objecten.** - The **Playwright happy path** asserts, after the behandelaar approves, that Objecten holds exactly one `RegisterRecord` for *that* reference — missing, duplicated, or non-public-safe all fail. - ACL mutation score **92.23%** (baseline 91.37%, break 90). - `make lint` / `make unit` green locally; full-stack `make verify` runs in CI. ## Definition of Done - [x] A linked Gitea issue exists (#149). - [x] Failing test written and committed first. - [x] Implementation makes the test pass. - [x] Refactor commit follows if structure improved. - [x] Conventional Commit messages referencing the issue (`refs #149`). - [x] All Gitea Actions CI jobs green (run 684). - [x] `docker compose up` from a fresh clone reaches green health checks within 3 minutes (verify-stack step 1). - [x] Docs touched — ADR-0028, demo note, PRD §15, BACKLOG. - [x] ADR added: `docs/architecture/adr-0028-objecten-holds-the-register.md`. - [x] Demo note appended to `docs/demo-script.md`. - [x] Closed by the merging PR (`closes #149`). 🤖 Generated with [Claude Code](https://claude.com/claude-code)Reviewed-on: #151
43 lines
1.8 KiB
YAML
43 lines
1.8 KiB
YAML
# Objecten API setup_configuration (S-18b). Streamed into the external rr-objecten-config volume by
|
|
# infra/seed-config.sh and applied by objecten-init (RUN_SETUP_CONFIG). Declarative + idempotent.
|
|
#
|
|
# Two things: (1) register the Objecttypen API (S-18a) as a trusted service so an object can
|
|
# reference its objecttype — authenticating with the dev static token Objecttypen provisioned; and
|
|
# (2) a dev static token so peers (the ACL, S-19) can write objects here. Dev-only, not for prod.
|
|
|
|
# (1) Trust the Objecttypen API. `orc` = overige RESTful component (how zgw_consumers classifies the
|
|
# Objecttypen API). The RegisterRecord objecttype (S-18c) will reference an objecttype under this
|
|
# service by uuid.
|
|
zgw_consumers_config_enable: true
|
|
zgw_consumers:
|
|
services:
|
|
- identifier: objecttypen
|
|
label: Objecttypen API
|
|
api_type: orc
|
|
api_root: http://objecttypen:8000/api/v2/
|
|
auth_type: api_key
|
|
header_key: Authorization
|
|
header_value: Token 0123456789abcdef0123456789abcdef01234567
|
|
|
|
# (2) Permit the RegisterRecord objecttype (S-19a). Objecten refuses to store an object whose
|
|
# objecttype it has not been configured with ("ObjectType with url=… is not configured"), and it
|
|
# identifies one by uuid — which is why infra/objecttypen-registerrecord/register.py pins that uuid
|
|
# instead of letting Objecttypen assign one. Keep the two in step.
|
|
objecttypes_config_enable: true
|
|
objecttypes:
|
|
items:
|
|
- uuid: 1f4b4e26-8b1f-4e2f-9d6c-6a1b7a2f0e01
|
|
name: RegisterRecord
|
|
service_identifier: objecttypen
|
|
|
|
# (3) Static API token peers use to write/read objects.
|
|
tokenauth_config_enable: true
|
|
tokenauth:
|
|
items:
|
|
- identifier: register-referentie
|
|
token: 1234567890abcdef1234567890abcdef12345678
|
|
contact_person: Register Referentie
|
|
email: admin@localhost
|
|
organization: Respellion
|
|
is_superuser: true
|