ehoandClaude Sonnet 5
1e87997ea0
setup_configuration has no YAML field for granular autorisaties, so bigregister-test now starts at heeft_alle_autorisaties: false (dev + prod template) and bootstrap-catalogus.sh grants exactly the ztc/zrc scopes the harness needs via the Django ORM, sidestepping the zero-scope chicken-and-egg with the JWT-authenticated Autorisaties REST API. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
31 lines
1.3 KiB
YAML
31 lines
1.3 KiB
YAML
# Applied by web-init (RUN_SETUP_CONFIG=true → `manage.py setup_configuration`, upstream's
|
|
# documented CLI config mechanism — see docker-compose.openzaak.yml) instead of the Django
|
|
# admin. Creates the ONE application the bootstrap script + integration test authenticate as.
|
|
#
|
|
# heeft_alle_autorisaties is false (WP-57, least privilege) — but
|
|
# `ApplicatieConfigurationModel` (vng_api_common's setup_configuration step) has no field for
|
|
# granular `autorisaties` at all, only this boolean. So this client starts with ZERO scopes;
|
|
# bootstrap-catalogus.sh grants the exact ones it needs via `manage.py shell` (Django ORM,
|
|
# not the JWT-authenticated Autorisaties REST API — a zero-scope client can't grant itself
|
|
# anything over REST, so this sidesteps that bootstrap chicken-and-egg entirely).
|
|
sites_config_enable: true
|
|
sites_config:
|
|
items:
|
|
- domain: localhost:8000
|
|
name: OpenZaak (WP-54 harness)
|
|
|
|
vng_api_common_credentials_config_enable: true
|
|
vng_api_common_credentials:
|
|
items:
|
|
- identifier: bigregister-test
|
|
secret: bigregister-test-secret
|
|
|
|
vng_api_common_applicaties_config_enable: true
|
|
vng_api_common_applicaties:
|
|
items:
|
|
- uuid: 5a09b3c9-6a54-4b2b-8f3c-1f9b6b6a3a01
|
|
client_ids:
|
|
- bigregister-test
|
|
label: BIG-register BFF (WP-54 test harness)
|
|
heeft_alle_autorisaties: false
|