Niek Otten
4d07285dcd
make verify-notifications brings the stack up, seeds a published BIG zaaktype, and asserts a zaak-create notification is delivered to a webhook-sink abonnement. The sink + driver run as containers inside the compose network and reach OpenZaak/NRC by container IP (the runner can't reach published ports, and a single-label host isn't URL-valid). The sink enforces a bearer token because NRC refuses an unauthenticated callback. New 'notifications' Gitea Actions job runs it (Docker-only). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
94 lines
4.0 KiB
Bash
Executable File
94 lines
4.0 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
#
|
|
# Verify the OpenZaak → Open Notificaties (NRC) notification path end to end (S-01-c,
|
|
# #56): a zaak created in OpenZaak is published to NRC and delivered to a subscriber.
|
|
#
|
|
# Everything that talks to OpenZaak/NRC runs *inside* the compose network and reaches
|
|
# them by container IP — the hosted CI runner can't reach published ports (sibling
|
|
# containers, gitea-actions-gotchas.md §5) and OpenZaak/NRC reject a single-label host
|
|
# in URLs (Django URLValidator). Plain docker primitives only (docker/podman-portable),
|
|
# like infra/seed-config.sh and infra/run-integration.sh. See ADR-0007.
|
|
set -euo pipefail
|
|
|
|
here="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
|
OZ_COMPOSE="$here/openzaak/docker-compose.yml"
|
|
NRC_COMPOSE="$here/opennotificaties/docker-compose.yml"
|
|
SINK_AUTH="Bearer notification-sink-token"
|
|
|
|
cleanup() {
|
|
docker rm -f rr-nsink rr-nverify >/dev/null 2>&1 || true
|
|
docker compose -f "$OZ_COMPOSE" -f "$NRC_COMPOSE" down --volumes >/dev/null 2>&1 || true
|
|
docker volume rm -f rr-oz-config rr-nrc-config >/dev/null 2>&1 || true
|
|
}
|
|
trap cleanup EXIT
|
|
|
|
ip() { docker inspect -f '{{range .NetworkSettings.Networks}}{{.IPAddress}}{{end}}' "$1"; }
|
|
|
|
wait_healthy() { # name-regex -> echoes container id
|
|
local re="$1" cid status
|
|
for _ in $(seq 1 140); do
|
|
cid="$(docker ps -q --filter "name=$re" | head -1)"
|
|
if [ -n "$cid" ]; then
|
|
status="$(docker inspect -f '{{if .State.Health}}{{.State.Health.Status}}{{end}}' "$cid" 2>/dev/null || true)"
|
|
[ "$status" = healthy ] && { echo "$cid"; return 0; }
|
|
fi
|
|
sleep 3
|
|
done
|
|
return 1
|
|
}
|
|
|
|
echo ">> bringing up OpenZaak + Open Notificaties (notifications enabled)"
|
|
bash "$here/seed-config.sh" oz nrc
|
|
OZ_NOTIFICATIONS_DISABLED=false docker compose -f "$OZ_COMPOSE" -f "$NRC_COMPOSE" up -d
|
|
|
|
echo ">> waiting for OpenZaak + NRC to be healthy"
|
|
oz="$(wait_healthy 'openzaak[-_]openzaak')" || { echo "ERROR: OpenZaak not healthy" >&2; exit 1; }
|
|
nrc="$(wait_healthy 'nrc-web')" || { echo "ERROR: NRC not healthy" >&2; exit 1; }
|
|
net="$(docker inspect -f '{{range $k,$_ := .NetworkSettings.Networks}}{{$k}}{{"\n"}}{{end}}' "$oz" | head -1)"
|
|
oz_ip="$(ip "$oz")"; nrc_ip="$(ip "$nrc")"
|
|
echo ">> network=$net openzaak=$oz_ip nrc=$nrc_ip"
|
|
|
|
echo ">> seeding a published BIG zaaktype"
|
|
sid="$(docker create --network "$net" -e "OZ_BASE=http://$oz_ip:8000" -e OZ_PUBLISH=1 \
|
|
python:3-slim python /seed.py)"
|
|
docker cp "$here/openzaak/seed_catalogus.py" "$sid:/seed.py" >/dev/null
|
|
docker start -a "$sid"
|
|
docker rm -f "$sid" >/dev/null
|
|
|
|
echo ">> starting the webhook sink"
|
|
docker rm -f rr-nsink >/dev/null 2>&1 || true
|
|
sink="$(docker create --network "$net" --name rr-nsink -e "EXPECTED_AUTH=$SINK_AUTH" \
|
|
python:3-slim python /sink.py)"
|
|
docker cp "$here/notification-sink.py" "$sink:/sink.py" >/dev/null
|
|
docker start "$sink" >/dev/null
|
|
sleep 1
|
|
sink_ip="$(ip rr-nsink)"
|
|
echo ">> sink at $sink_ip:9000"
|
|
|
|
echo ">> registering abonnement + creating a zaak"
|
|
docker rm -f rr-nverify >/dev/null 2>&1 || true
|
|
drv="$(docker create --network "$net" --name rr-nverify \
|
|
-e "OZ_BASE=http://$oz_ip:8000" -e "NRC_BASE=http://$nrc_ip:8000" \
|
|
-e "SINK_CALLBACK=http://$sink_ip:9000/" -e "SINK_AUTH=$SINK_AUTH" \
|
|
python:3-slim python /driver.py)"
|
|
docker cp "$here/verify-notification-driver.py" "$drv:/driver.py" >/dev/null
|
|
docker start -a "$drv"
|
|
zaak_url="$(docker logs rr-nverify 2>/dev/null | sed -n 's/^ZAAK_CREATED //p' | head -1)"
|
|
docker rm -f rr-nverify >/dev/null
|
|
[ -n "$zaak_url" ] || { echo "ERROR: driver did not create a zaak" >&2; exit 1; }
|
|
zaak_uuid="${zaak_url##*/}"
|
|
echo ">> zaak created: $zaak_url"
|
|
|
|
echo ">> waiting for the notification to reach the sink"
|
|
for _ in $(seq 1 30); do
|
|
if docker logs rr-nsink 2>&1 | grep -q "$zaak_uuid"; then
|
|
echo "OK — NRC delivered the zaken notification for zaak $zaak_uuid to the sink"
|
|
docker logs rr-nsink 2>&1 | grep "$zaak_uuid" | tail -1 | cut -c1-300
|
|
exit 0
|
|
fi
|
|
sleep 2
|
|
done
|
|
echo "FAIL — the sink never received a notification for zaak $zaak_uuid" >&2
|
|
echo "--- sink log ---" >&2; docker logs rr-nsink 2>&1 | tail -8 >&2
|
|
exit 1
|