not
ceb65991de
Completes the re-source (ADR-0030): the Event Subscriber's abonnement moves from `zaken` to `objecten`, in both the local stack's `nrc-subscribe` and the CI projection check. The OpenZaak → NRC check keeps its own `zaken` abonnement — OpenZaak still publishes, nothing in the product listens. - register-abonnement.py subscribes to `objecten`, and now treats the kanaal as part of "already current" — an abonnement left from before this slice points at the right callback but the wrong kanaal, and would never have been replaced on IP alone. - run-projection-check.sh opens its zaak *through the ACL* instead of straight against OpenZaak, because the ACL is what writes the register record the projection is now derived from. A zaak created behind the ACL's back produces no row — which is the re-source working. - The acceptance scenario is restated in register terms and gains the approval case: the same row moving INGEDIEND → INGESCHREVEN is now one registration's record being updated, not two unrelated ZGW events.
84 lines
3.9 KiB
Python
Executable File
84 lines
3.9 KiB
Python
Executable File
#!/usr/bin/env python3
|
|
"""Local-stack bootstrap (S-B04, #110, ADR-0020) — register the NRC abonnement.
|
|
|
|
Runs as the `nrc-subscribe` init container of infra/docker-compose.local.yml. Registers an
|
|
abonnement on the `objecten` kanaal pointing at the event-subscriber's /notifications callback, so
|
|
the register writes the ACL makes (INGEDIEND on submit, INGESCHREVEN on approval) reach the
|
|
projection — without this the openbaar (public) register stays empty. Since S-19b-2 the projection
|
|
is sourced from the register in Objecten, not from ZGW zaak events (ADR-0030).
|
|
|
|
The callback host is the event-subscriber's resolved **container IP**, not `event-subscriber`, because
|
|
NRC validates callbackUrl with Django's URLValidator (a single-label host is rejected — same reason the
|
|
zaaktype seed uses OpenZaak's IP). Idempotent + restart-safe: it removes any stale /notifications
|
|
abonnement first, then registers one for the current IP. Stdlib only.
|
|
|
|
Env: NRC_BASE, SINK_HOST, SINK_PORT, SINK_AUTH, OZ_CLIENT_ID, OZ_SECRET.
|
|
"""
|
|
import base64, hashlib, hmac, json, os, socket, sys, time, urllib.error, urllib.request
|
|
|
|
NRC = os.environ.get("NRC_BASE", "http://nrc-web:8000").rstrip("/")
|
|
SINK_HOST = os.environ.get("SINK_HOST", "event-subscriber")
|
|
SINK_PORT = os.environ.get("SINK_PORT", "8080")
|
|
SINK_AUTH = os.environ.get("SINK_AUTH", "Bearer big-reference-notifications")
|
|
CID = os.environ.get("OZ_CLIENT_ID", "big-reference-seed")
|
|
SECRET = os.environ.get("OZ_SECRET", "insecure-dev-secret-change-me")
|
|
# The projection is sourced from the register in Objecten, not from ZGW zaak events (S-19b-2).
|
|
KANAAL = "objecten"
|
|
|
|
|
|
def token():
|
|
b64 = lambda b: base64.urlsafe_b64encode(b).rstrip(b"=")
|
|
seg = (
|
|
b64(json.dumps({"alg": "HS256", "typ": "JWT"}, separators=(",", ":")).encode())
|
|
+ b"."
|
|
+ b64(json.dumps(
|
|
{"iss": CID, "iat": int(time.time()), "client_id": CID,
|
|
"user_id": "local-seed", "user_representation": "local-seed"},
|
|
separators=(",", ":")).encode())
|
|
)
|
|
return (seg + b"." + b64(hmac.new(SECRET.encode(), seg, hashlib.sha256).digest())).decode()
|
|
|
|
|
|
def call(method, url, body=None):
|
|
data = json.dumps(body).encode() if body is not None else None
|
|
req = urllib.request.Request(url, data=data, method=method, headers={
|
|
"Authorization": "Bearer " + token(),
|
|
"Content-Type": "application/json", "Accept": "application/json"})
|
|
try:
|
|
with urllib.request.urlopen(req, timeout=30) as r:
|
|
raw = r.read()
|
|
return r.status, (json.loads(raw) if raw else None)
|
|
except urllib.error.HTTPError as e:
|
|
raw = e.read()
|
|
return e.code, (json.loads(raw) if raw else None)
|
|
|
|
|
|
def main():
|
|
ip = socket.gethostbyname(SINK_HOST)
|
|
callback = f"http://{ip}:{SINK_PORT}/notifications"
|
|
|
|
# Restart-safe: drop any prior /notifications abonnement (its IP may be stale) before creating a
|
|
# fresh one for the current event-subscriber IP.
|
|
status, body = call("GET", f"{NRC}/api/v1/abonnement")
|
|
for ab in (body or []) if status == 200 else []:
|
|
if str(ab.get("callbackUrl", "")).endswith("/notifications"):
|
|
# The kanaal is part of "current": an abonnement left over from before S-19b-2 points at
|
|
# the right callback but listens on `zaken`, and would never be replaced on IP alone.
|
|
kanalen = [k.get("naam") for k in ab.get("kanalen", [])]
|
|
if ab.get("callbackUrl") == callback and kanalen == [KANAAL]:
|
|
print(f"abonnement already current: {ab['url']}")
|
|
return
|
|
call("DELETE", ab["url"])
|
|
print(f"removed stale abonnement {ab['url']}")
|
|
|
|
status, ab = call("POST", f"{NRC}/api/v1/abonnement", {
|
|
"callbackUrl": callback, "auth": SINK_AUTH,
|
|
"kanalen": [{"naam": KANAAL, "filters": {}}]})
|
|
if status != 201:
|
|
sys.exit(f"create abonnement -> {status}: {json.dumps(ab)}")
|
|
print(f"abonnement registered: {ab['url']} -> {callback}")
|
|
|
|
|
|
if __name__ == "__main__":
|
|
main()
|