register-referentie/services/event-subscriber/EventSubscriber.Api/Program.cs

using System.Text.Json;
using EventSubscriber.Application;
using OpenTelemetry.Metrics;
using OpenTelemetry.Resources;
using OpenTelemetry.Trace;
using Projection.ReadModel;

var builder = WebApplication.CreateBuilder(args);

// OpenTelemetry tracing (S-16b, ADR-0023): auto-instrument the incoming NRC notification callback and
// the outgoing ACL enrichment call, exported over OTLP to Tempo. Service name + OTLP endpoint come
// from OTEL_* env (compose); the exporter no-ops when Tempo is unreachable.
builder.Services.AddOpenTelemetry()
    .ConfigureResource(r => r.AddService(
        builder.Configuration["OTEL_SERVICE_NAME"] ?? builder.Environment.ApplicationName))
    .WithTracing(tracing => tracing
        .AddAspNetCoreInstrumentation(o => o.Filter = ctx => ctx.Request.Path != "/health")
        .AddHttpClientInstrumentation()
        .AddOtlpExporter())
    // OpenTelemetry metrics (S-16c, ADR-0023): golden signals for the request path —
    // http.server.request.duration (traffic/errors/latency) + http.client.* for downstream hops, plus
    // the built-in System.Runtime meter for saturation (GC, CPU, thread pool). Prometheus scrapes these
    // from /metrics (mapped below); metrics aren't pushed over OTLP, so no collector hop (ADR-0023).
    .WithMetrics(metrics => metrics
        .AddAspNetCoreInstrumentation()
        .AddHttpClientInstrumentation()
        .AddMeter("System.Runtime")
        .AddPrometheusExporter());

var connectionString = builder.Configuration.GetConnectionString("Projection")
    ?? throw new InvalidOperationException("Missing connection string 'ConnectionStrings:Projection'");
// The exact Authorization header value Open Notificaties sends on each abonnement callback.
// NRC probes the callback during registration and refuses it unless it returns 401 without
// this value (ADR-0007), so the webhook enforces it.
var webhookToken = builder.Configuration["EventSubscriber:Webhook:AuthToken"]
    ?? throw new InvalidOperationException("Missing configuration 'EventSubscriber:Webhook:AuthToken'");
// The ACL is the only code that may read ZGW (§8.1); the subscriber enriches the projection with the
// zaak reference through it (adr-proposal #78).
var aclBaseUrl = builder.Configuration["Acl:BaseUrl"]
    ?? throw new InvalidOperationException("Missing configuration 'Acl:BaseUrl'");

builder.Services.AddProjectionReadModel(connectionString);
builder.Services.AddProjectionWriteSide();
builder.Services.AddHttpClient<EventSubscriber.Application.IAclClient, EventSubscriber.Api.AclHttpClient>(
    c => c.BaseAddress = new Uri(aclBaseUrl));

var app = builder.Build();

// Apply migrations on start so a fresh stack reaches a usable schema unattended.
await app.Services.MigrateProjectionAsync();

app.MapGet("/health", () => "Healthy");

// Prometheus scrape endpoint (S-16c): exposes the OTel metrics above in Prometheus text format.
app.MapPrometheusScrapingEndpoint();

// The NRC abonnement callback. Open Notificaties POSTs a notification here; we project it.
// Auth-on-callback is mandatory: the auth check runs *before* the body is read, so NRC's
// registration probe (a POST without the configured Authorization, and without a valid
// notification body) gets the 401 it requires rather than a 400 (ADR-0007).
app.MapPost("/notifications", async (
    HttpRequest request,
    NotificationProjector projector,
    CancellationToken ct) =>
{
    if (request.Headers.Authorization != webhookToken)
        return Results.Unauthorized();

    var dto = await JsonSerializer.DeserializeAsync<NotificationDto>(
        request.Body, SerializerOptions, ct);
    if (dto is null)
        return Results.BadRequest();

    await projector.HandleAsync(dto.ToNotification(), ct);
    return Results.NoContent();
});

// Admin: rebuild the projection from the durable notification log (PRD §8.4 — rebuildable).
app.MapPost("/admin/rebuild", async (NotificationProjector projector, CancellationToken ct) =>
{
    await projector.RebuildAsync(ct);
    return Results.NoContent();
});

await app.RunAsync();

/// <summary>The NRC notification body, as Open Notificaties POSTs it. Only the fields the projector
/// needs are bound; <c>aanmaakdatum</c>, <c>kenmerken</c> and <c>hoofdObject</c> are ignored — for a
/// register write hoofdObject is the same object as resourceUrl (ADR-0030).</summary>
public sealed record NotificationDto(string Kanaal, string Resource, string Actie, Uri ResourceUrl)
{
    public Notification ToNotification() => new(Kanaal, Resource, Actie, ResourceUrl);
}

public partial class Program
{
    // NRC sends camelCase JSON; match it case-insensitively.
    private static readonly JsonSerializerOptions SerializerOptions = new(JsonSerializerDefaults.Web);
}