notandClaude Opus 4.8
a940a6c9ce
A fresh `make local` now completes the whole flow with no manual seeding, closing the three S-B04 gaps in the host-browser stack: - flowable-init also deploys diploma-eligibility.dmn (was BPMN-only), so completing WachtOpDocumenten routes through the DMN to Beoordelen instead of 404ing. - a local-seed one-shot seeds + publishes the BIG zaaktype (server-assigned URL) and writes it to seed-env:/acl.env; the ACL sources it on startup (entrypoint override), since the UUID isn't knowable at compose-write time. - an nrc-subscribe one-shot registers the `zaken` abonnement at the event-subscriber callback, so notifications reach the projection and the openbaar register. Both one-shots reach OpenZaak/NRC by container IP (a single-label host fails their Django URLValidator), mirroring the CI verify scripts. Asserted by `make verify-local`. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
79 lines
3.5 KiB
Python
Executable File
79 lines
3.5 KiB
Python
Executable File
#!/usr/bin/env python3
|
|
"""Local-stack bootstrap (S-B04, #110, ADR-0020) — register the NRC abonnement.
|
|
|
|
Runs as the `nrc-subscribe` init container of infra/docker-compose.local.yml. Registers an
|
|
abonnement on the `zaken` kanaal pointing at the event-subscriber's /notifications callback, so
|
|
OpenZaak's notifications (zaak create + status set) reach the projection — without this the openbaar
|
|
(public) register stays empty. This is what infra/verify-notification-driver.py does for CI (minus
|
|
the test zaak it also creates).
|
|
|
|
The callback host is the event-subscriber's resolved **container IP**, not `event-subscriber`, because
|
|
NRC validates callbackUrl with Django's URLValidator (a single-label host is rejected — same reason the
|
|
zaaktype seed uses OpenZaak's IP). Idempotent + restart-safe: it removes any stale /notifications
|
|
abonnement first, then registers one for the current IP. Stdlib only.
|
|
|
|
Env: NRC_BASE, SINK_HOST, SINK_PORT, SINK_AUTH, OZ_CLIENT_ID, OZ_SECRET.
|
|
"""
|
|
import base64, hashlib, hmac, json, os, socket, sys, time, urllib.error, urllib.request
|
|
|
|
NRC = os.environ.get("NRC_BASE", "http://nrc-web:8000").rstrip("/")
|
|
SINK_HOST = os.environ.get("SINK_HOST", "event-subscriber")
|
|
SINK_PORT = os.environ.get("SINK_PORT", "8080")
|
|
SINK_AUTH = os.environ.get("SINK_AUTH", "Bearer big-reference-notifications")
|
|
CID = os.environ.get("OZ_CLIENT_ID", "big-reference-seed")
|
|
SECRET = os.environ.get("OZ_SECRET", "insecure-dev-secret-change-me")
|
|
|
|
|
|
def token():
|
|
b64 = lambda b: base64.urlsafe_b64encode(b).rstrip(b"=")
|
|
seg = (
|
|
b64(json.dumps({"alg": "HS256", "typ": "JWT"}, separators=(",", ":")).encode())
|
|
+ b"."
|
|
+ b64(json.dumps(
|
|
{"iss": CID, "iat": int(time.time()), "client_id": CID,
|
|
"user_id": "local-seed", "user_representation": "local-seed"},
|
|
separators=(",", ":")).encode())
|
|
)
|
|
return (seg + b"." + b64(hmac.new(SECRET.encode(), seg, hashlib.sha256).digest())).decode()
|
|
|
|
|
|
def call(method, url, body=None):
|
|
data = json.dumps(body).encode() if body is not None else None
|
|
req = urllib.request.Request(url, data=data, method=method, headers={
|
|
"Authorization": "Bearer " + token(),
|
|
"Content-Type": "application/json", "Accept": "application/json"})
|
|
try:
|
|
with urllib.request.urlopen(req, timeout=30) as r:
|
|
raw = r.read()
|
|
return r.status, (json.loads(raw) if raw else None)
|
|
except urllib.error.HTTPError as e:
|
|
raw = e.read()
|
|
return e.code, (json.loads(raw) if raw else None)
|
|
|
|
|
|
def main():
|
|
ip = socket.gethostbyname(SINK_HOST)
|
|
callback = f"http://{ip}:{SINK_PORT}/notifications"
|
|
|
|
# Restart-safe: drop any prior /notifications abonnement (its IP may be stale) before creating a
|
|
# fresh one for the current event-subscriber IP.
|
|
status, body = call("GET", f"{NRC}/api/v1/abonnement")
|
|
for ab in (body or []) if status == 200 else []:
|
|
if str(ab.get("callbackUrl", "")).endswith("/notifications"):
|
|
if ab.get("callbackUrl") == callback:
|
|
print(f"abonnement already current: {ab['url']}")
|
|
return
|
|
call("DELETE", ab["url"])
|
|
print(f"removed stale abonnement {ab['url']}")
|
|
|
|
status, ab = call("POST", f"{NRC}/api/v1/abonnement", {
|
|
"callbackUrl": callback, "auth": SINK_AUTH,
|
|
"kanalen": [{"naam": "zaken", "filters": {}}]})
|
|
if status != 201:
|
|
sys.exit(f"create abonnement -> {status}: {json.dumps(ab)}")
|
|
print(f"abonnement registered: {ab['url']} -> {callback}")
|
|
|
|
|
|
if __name__ == "__main__":
|
|
main()
|