# Objecten API setup_configuration (S-18b). Streamed into the external rr-objecten-config volume by
# infra/seed-config.sh and applied by objecten-init (RUN_SETUP_CONFIG). Declarative + idempotent.
#
# Two things: (1) register the Objecttypen API (S-18a) as a trusted service so an object can
# reference its objecttype — authenticating with the dev static token Objecttypen provisioned; and
# (2) a dev static token so peers (the ACL, S-19) can write objects here. Dev-only, not for prod.

# (1) Trust the Objecttypen API. `orc` = overige RESTful component (how zgw_consumers classifies the
# Objecttypen API). The RegisterRecord objecttype (S-18c) will reference an objecttype under this
# service by uuid.
zgw_consumers_config_enable: true
zgw_consumers:
  services:
    - identifier: objecttypen
      label: Objecttypen API
      api_type: orc
      api_root: http://objecttypen:8000/api/v2/
      auth_type: api_key
      header_key: Authorization
      header_value: Token 0123456789abcdef0123456789abcdef01234567
    # (1b) The NRC Objecten publishes register-record events to (S-19b-1, ADR-0029). Same shape and
    # same big-reference-seed credential OpenZaak publishes with — NRC verifies the JWT and
    # authorizes it via OpenZaak's AC, which grants that client heeft_alle_autorisaties.
    - identifier: nrc
      label: Open Notificaties
      api_type: nrc
      api_root: http://nrc-web:8000/api/v1/
      auth_type: zgw
      client_id: big-reference-seed
      secret: insecure-dev-secret-change-me

# (2) Permit the RegisterRecord objecttype (S-19a). Objecten refuses to store an object whose
# objecttype it has not been configured with ("ObjectType with url=… is not configured"), and it
# identifies one by uuid — which is why infra/objecttypen-registerrecord/register.py pins that uuid
# instead of letting Objecttypen assign one. Keep the two in step.
objecttypes_config_enable: true
objecttypes:
  items:
    - uuid: 1f4b4e26-8b1f-4e2f-9d6c-6a1b7a2f0e01
      name: RegisterRecord
      service_identifier: objecttypen

# (3) Static API token peers use to write/read objects.
tokenauth_config_enable: true
tokenauth:
  items:
    - identifier: register-referentie
      token: 1234567890abcdef1234567890abcdef12345678
      contact_person: Register Referentie
      email: admin@localhost
      organization: Respellion
      is_superuser: true

# (4) Point Objecten's notifications at that NRC service (S-19b-1, ADR-0029). Requires
# NOTIFICATIONS_DISABLED=false plus a celery broker + worker — without the worker the message is
# queued and never sent, which is exactly the half-wired state S-19a refused to ship (ADR-0028).
notifications_config_enable: true
notifications_config:
  notifications_api_service_identifier: nrc