diff --git a/CHANGELOG.md b/CHANGELOG.md
index 7a9b8e0..b27a6a3 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,5 @@
# Changelog
-## Unreleased
+## 1.39.1 (2026-04-24)
- OP-3771: Adds labels for: EredienstBeroepen and TypeBetrokkenheid
- Bump to kbo-data-sync [OP-3765]
- Added administrativeUnits report with strekking [OP-3766]
@@ -8,11 +8,13 @@
- Query list change events of organisations in Dashboard [OP-3760]
- Disable SPARQL endpoint
- Prepare worship election period: backfill missing 2026-2029 governing bodies + mandates, seed fresh 2029-2032 period, and clean up `hhttp://` Secretaris typo from the 2022 central-worship migrations [OP-3776] and [DL-7294]
+- Cleanup local involvements for Sint Laureins [OP-3775]
+- sparql-parser [DL-6575]
### Deploy notes
```
-drc pull kbo-data-sync && drc up -d kbo-data-sync
-drc restart report-generation
+drc pull kbo-data-sync db resource && drc up -d kbo-data-sync db resource
+drc restart report-generation
drc restart migrations && drc logs -ft --tail=200 migrations
drc up -d delta-producer-publication-graph-maintainer
drc restart dispatcher
diff --git a/config/authorization/config.ex b/config/authorization/config.ex
deleted file mode 100644
index 0966921..0000000
--- a/config/authorization/config.ex
+++ /dev/null
@@ -1,311 +0,0 @@
-alias Acl.Accessibility.Always, as: AlwaysAccessible
-alias Acl.GraphSpec.Constraint.Resource, as: ResourceConstraint
-alias Acl.GraphSpec.Constraint.ResourceFormat, as: ResourceFormatConstraint
-alias Acl.Accessibility.ByQuery, as: AccessByQuery
-alias Acl.GraphSpec, as: GraphSpec
-alias Acl.GroupSpec, as: GroupSpec
-alias Acl.GroupSpec.GraphCleanup, as: GraphCleanup
-
-defmodule Acl.UserGroups.Config do
- @error_type [
- "https://docs.oasis-open-projects.org/oslc-op/core/v3.0/os/core-vocab.html#Error"
- ]
-
- @worship_type [
- "http://data.lblod.info/vocabularies/erediensten/EredienstMandataris",
- "http://data.lblod.info/vocabularies/erediensten/BestuurVanDeEredienst",
- "http://data.lblod.info/vocabularies/erediensten/EredienstBestuurseenheid",
- "http://data.lblod.info/vocabularies/erediensten/RolBedienaar",
- "http://data.lblod.info/vocabularies/erediensten/VoorwaardenBedienaar",
- "http://data.lblod.info/vocabularies/erediensten/PositieBedienaar",
- "http://data.lblod.info/vocabularies/erediensten/BetrokkenLokaleBesturen",
- "http://data.lblod.info/vocabularies/erediensten/VerbondenJuridischeStructuren",
- "http://data.lblod.info/vocabularies/erediensten/CentraalBestuurVanDeEredienst",
- "http://data.lblod.info/vocabularies/erediensten/RepresentatiefOrgaan"
- ]
-
- @public_type [
- "http://www.w3.org/ns/org#Role",
- "http://data.vlaanderen.be/ns/besluit#Bestuurseenheid",
- "http://xmlns.com/foaf/0.1/Person",
- "http://xmlns.com/foaf/0.1/OnlineAccount",
- "http://www.semanticdesktop.org/ontologies/2007/03/22/nfo#FileDataObject",
- "http://www.w3.org/ns/dcat#Dataset",
- "http://www.w3.org/ns/dcat#Distribution",
- "http://www.w3.org/ns/dcat#Catalog",
- "http://mu.semte.ch/vocabularies/ext/GeslachtCode",
- "http://data.lblod.info/vocabularies/leidinggevenden/FunctionarisStatusCode",
- "http://lblod.data.gift/vocabularies/organisatie/OrganisatieStatusCode",
- "http://lblod.data.gift/vocabularies/organisatie/BestuursfunctieCode",
- "http://lblod.data.gift/vocabularies/organisatie/BestuursorgaanClassificatieCode",
- "http://lblod.data.gift/vocabularies/organisatie/MandatarisStatusCode",
- "http://lblod.data.gift/vocabularies/organisatie/BestuurseenheidClassificatieCode",
- "http://mu.semte.ch/vocabularies/ext/GeregistreerdeOrganisatieClassificatieCode",
- "http://lblod.data.gift/vocabularies/organisatie/TypeEredienst",
- "http://www.w3.org/2004/02/skos/core#ConceptScheme",
- "http://lblod.data.gift/vocabularies/organisatie/BedienaarFinancieringCode",
- "http://www.w3.org/2004/02/skos/core#Concept",
- "http://publications.europa.eu/ontology/euvoc#Country",
- "http://lblod.data.gift/vocabularies/organisatie/TypeVestiging",
- "http://lblod.data.gift/vocabularies/organisatie/HelftVerkiezing",
- "http://lblod.data.gift/vocabularies/organisatie/Veranderingsgebeurtenis",
- "http://lblod.data.gift/vocabularies/organisatie/TypeBetrokkenheid",
- "http://lblod.data.gift/vocabularies/organisatie/VoorwaardenBedienaarCriterium",
- "http://lblod.data.gift/vocabularies/organisatie/BedienaarCriteriumBewijsstuk",
- "http://lblod.data.gift/vocabularies/organisatie/EredienstBeroepen",
- "http://lblod.data.gift/vocabularies/organisatie/Rechtsvormtype",
- "http://www.w3.org/ns/prov#Location"
- ]
-
- @org_type [
- "http://purl.org/dc/terms/Agent",
- "http://www.w3.org/ns/org#Organization",
- "http://www.w3.org/ns/regorg#RegisteredOrganization",
- "http://data.vlaanderen.be/ns/besluit#Besluit",
- "https://data.vlaanderen.be/ns/besluitvorming#Beslissingsactiviteit",
- "http://www.w3.org/ns/org#Site",
- "http://www.w3.org/ns/locn#Address",
- "http://www.w3.org/ns/person#Person",
- "http://schema.org/ContactPoint",
- "http://data.vlaanderen.be/ns/besluit#Bestuurseenheid",
- "http://data.vlaanderen.be/ns/besluit#Bestuursorgaan",
- "http://www.w3.org/ns/adms#Identifier",
- "https://data.vlaanderen.be/ns/generiek#GestructureerdeIdentificator",
- "http://data.vlaanderen.be/ns/mandaat#Mandaat",
- "http://data.vlaanderen.be/ns/mandaat#Mandataris",
- "http://data.lblod.info/vocabularies/leidinggevenden/Functionaris",
- "http://data.lblod.info/vocabularies/leidinggevenden/Bestuursfunctie",
- "http://lblod.data.gift/vocabularies/organisatie/VeranderingsgebeurtenisResultaat",
- "http://www.w3.org/ns/org#Post",
- "http://www.w3.org/ns/org#ChangeEvent",
- "http://data.lblod.info/vocabularies/contacthub/AgentInPositie",
- "http://mu.semte.ch/vocabularies/ext/KboOrganisatie",
- "http://www.w3.org/ns/org#Membership",
- "http://www.w3.org/2006/time#ProperInterval",
- ]
-
- @shared_protected_type [
- "http://xmlns.com/foaf/0.1/Image",
- "http://www.semanticdesktop.org/ontologies/2007/03/22/nfo#FileDataObject"
- ]
-
- @vendor_type [
- "http://mu.semte.ch/vocabularies/ext/Vendor"
- ]
-
-
- defp access_by_role(group_string) do
- %AccessByQuery{
- # vars: ["session_group","session_role"], todo we might have to create multiple graph depending on role
- vars: [],
- query: sparql_query_for_access_role(group_string)
- }
- end
-
- defp sparql_query_for_access_role(group_string) do
- "PREFIX ext:
- PREFIX mu:
- SELECT distinct ?session_group ?session_role WHERE {
- ext:sessionGroup/mu:uuid ?session_group;
- ext:activeSessionRole ?session_role.
- FILTER( ?session_role = \"#{group_string}\" )
- }"
- end
-
- defp can_access_dashboard() do
- %AccessByQuery{
- vars: [],
- query: "PREFIX ext:
- SELECT DISTINCT ?session WHERE {
- VALUES ?session { }
- ?session ext:sessionRole \"LoketLB-AdminDashboardOrganisatiePortaalGebruiker\" .
- }"
- }
- end
-
- def user_groups do
- [
- %GroupSpec{
- name: "acmidm-lezer",
- useage: [:read],
- access: access_by_role("ABBOrganisatiePortaalGebruiker-lezer"),
- graphs: [
- %GraphSpec{
- graph: "http://mu.semte.ch/graphs/administrative-unit",
- constraint: %ResourceConstraint{
- resource_types: @org_type
- }
- },
- %GraphSpec{
- graph: "http://mu.semte.ch/graphs/vendor-management-data",
- constraint: %ResourceConstraint{
- resource_types: @vendor_type
- }
- }
- ]
- },
- %GroupSpec{
- name: "acmidm-editeerder",
- useage: [:read, :write, :read_for_write],
- access: access_by_role("ABBOrganisatiePortaalGebruiker-editeerder"),
- graphs: [
- %GraphSpec{
- graph: "http://mu.semte.ch/graphs/administrative-unit",
- constraint: %ResourceConstraint{
- resource_types: @org_type ++ @error_type
- }
- },
- %GraphSpec{
- graph: "http://mu.semte.ch/graphs/vendor-management-data",
- constraint: %ResourceConstraint{
- resource_types: @vendor_type
- }
- }
- ]
- },
- %GroupSpec{
- name: "acmidm-beheerder",
- useage: [:read, :write, :read_for_write],
- access: access_by_role("ABBOrganisatiePortaalGebruiker-beheerder"),
- graphs: [
- %GraphSpec{
- graph: "http://mu.semte.ch/graphs/administrative-unit",
- constraint: %ResourceConstraint{
- resource_types: @org_type ++ @error_type
- }
- },
- %GraphSpec{
- graph: "http://mu.semte.ch/graphs/vendor-management-data",
- constraint: %ResourceConstraint{
- resource_types: @vendor_type
- }
- }
- ]
- },
- %GroupSpec{
- name: "acmidm-worship-lezer",
- useage: [:read],
- access: access_by_role("ABBOrganisatiePortaalErediensten-lezer"),
- graphs: [
- %GraphSpec{
- graph: "http://mu.semte.ch/graphs/worship-service",
- constraint: %ResourceConstraint{
- resource_types: @org_type ++ @worship_type
- }
- },
- %GraphSpec{
- graph: "http://mu.semte.ch/graphs/vendor-management-data",
- constraint: %ResourceConstraint{
- resource_types: @vendor_type
- }
- }
- ]
- },
- %GroupSpec{
- name: "acmidm-worship-editeerder",
- useage: [:read, :write, :read_for_write],
- access: access_by_role("ABBOrganisatiePortaalErediensten-editeerder"),
- graphs: [
- %GraphSpec{
- graph: "http://mu.semte.ch/graphs/worship-service",
- constraint: %ResourceConstraint{
- resource_types: @org_type ++ @error_type ++ @worship_type
- }
- },
- %GraphSpec{
- graph: "http://mu.semte.ch/graphs/vendor-management-data",
- constraint: %ResourceConstraint{
- resource_types: @vendor_type
- }
- }
- ]
- },
- %GroupSpec{
- name: "acmidm-worship-beheerder",
- useage: [:read, :write, :read_for_write],
- access: access_by_role("ABBOrganisatiePortaalErediensten-beheerder"),
- graphs: [
- %GraphSpec{
- graph: "http://mu.semte.ch/graphs/worship-service",
- constraint: %ResourceConstraint{
- resource_types: @org_type ++ @error_type ++ @worship_type
- }
- },
- %GraphSpec{
- graph: "http://mu.semte.ch/graphs/vendor-management-data",
- constraint: %ResourceConstraint{
- resource_types: @vendor_type
- }
- }
- ]
- },
- %GroupSpec{
- name: "public",
- useage: [:read],
- access: %AlwaysAccessible{},
- graphs: [
- %GraphSpec{
- graph: "http://mu.semte.ch/graphs/public",
- constraint: %ResourceConstraint{
- resource_types: @public_type
- }
- },
- %GraphSpec{
- graph: "http://mu.semte.ch/graphs/shared",
- constraint: %ResourceConstraint{
- resource_types: @shared_protected_type ++ @org_type
- }
- }
- ]
- },
- # // Dashboard admin
- %GroupSpec{
- name: "o-admin-rwf",
- useage: [:read, :write, :read_for_write],
- access: can_access_dashboard(),
- graphs: [
- %GraphSpec{
- graph: "http://mu.semte.ch/graphs/reports",
- constraint: %ResourceConstraint{
- resource_types: [
- "http://lblod.data.gift/vocabularies/reporting/Report",
- "http://open-services.net/ns/core#Error",
- "http://www.semanticdesktop.org/ontologies/2007/03/22/nfo#DataContainer",
- "http://www.semanticdesktop.org/ontologies/2007/03/22/nfo#FileDataObject"
- ]
- }
- },
- %GraphSpec{
- graph: "http://mu.semte.ch/graphs/system/jobs",
- constraint: %ResourceConstraint{
- resource_types: [
- "http://vocab.deri.ie/cogs#Job",
- "http://www.semanticdesktop.org/ontologies/2007/03/22/nfo#DataContainer",
- "http://www.semanticdesktop.org/ontologies/2007/03/22/nfo#FileDataObject"
- ]
- }
- },
- # OP stores jobs in multiple graphs, so we configure both until they are merged into one graph
- %GraphSpec{
- graph: "http://mu.semte.ch/graphs/jobs",
- constraint: %ResourceConstraint{
- resource_types: [
- "http://vocab.deri.ie/cogs#Job",
- "http://www.semanticdesktop.org/ontologies/2007/03/22/nfo#DataContainer",
- "http://www.semanticdesktop.org/ontologies/2007/03/22/nfo#FileDataObject"
- ]
- }
- }
- ]
- },
-
- # // CLEANUP
- #
- %GraphCleanup{
- originating_graph: "http://mu.semte.ch/application",
- useage: [:write],
- name: "clean"
- }
- ]
- end
-end
diff --git a/config/authorization/config.lisp b/config/authorization/config.lisp
new file mode 100644
index 0000000..45b0b2b
--- /dev/null
+++ b/config/authorization/config.lisp
@@ -0,0 +1,368 @@
+;;;;;;;;;;;;;;;;;;;
+;;; delta messenger
+(in-package :delta-messenger)
+
+(add-delta-logger)
+(add-delta-messenger "http://deltanotifier/")
+
+;;;;;;;;;;;;;;;;;
+;;; configuration
+(in-package :client)
+(setf *log-sparql-query-roundtrip* t)
+(setf *backend* "http://triplestore:8890/sparql")
+
+(in-package :server)
+(setf *log-incoming-requests-p* nil)
+
+;;;;;;;;;;;;;;;;;
+;;; access rights
+(in-package :acl)
+
+(defparameter *access-specifications* nil
+ "All known ACCESS specifications.")
+
+(defparameter *graphs* nil
+ "All known GRAPH-SPECIFICATION instances.")
+
+(defparameter *rights* nil
+ "All known GRANT instances connecting ACCESS-SPECIFICATION to GRAPH.")
+
+;; Prefixes used in the constraints below (not in the SPARQL queries)
+(define-prefixes
+ :org "http://www.w3.org/ns/org#"
+ :locn "http://www.w3.org/ns/locn#"
+ :schema "http://schema.org/"
+ :regorg "http://www.w3.org/ns/regorg#"
+ :person "http://www.w3.org/ns/person#"
+ :adms "http://www.w3.org/ns/adms#"
+ :prov "http://www.w3.org/ns/prov#"
+ :generiek "https://data.vlaanderen.be/ns/generiek#"
+ :mandaat "http://data.vlaanderen.be/ns/mandaat#"
+ :besluit "http://data.vlaanderen.be/ns/besluit#"
+ :lblodlg "http://data.lblod.info/vocabularies/leidinggevenden/"
+ :dc_terms "http://purl.org/dc/terms/"
+ :foaf "http://xmlns.com/foaf/0.1/"
+ :skos "http://www.w3.org/2004/02/skos/core#"
+ :euvoc "http://publications.europa.eu/ontology/euvoc#"
+ :ere "http://data.lblod.info/vocabularies/erediensten/"
+ :ch "http://data.lblod.info/vocabularies/contacthub/"
+ :code "http://lblod.data.gift/vocabularies/organisatie/"
+ :ext "http://mu.semte.ch/vocabularies/ext/"
+ :time "http://www.w3.org/2006/time#"
+ :oasis "https://docs.oasis-open-projects.org/oslc-op/core/v3.0/os/core-vocab.html#"
+ :nfo "http://www.semanticdesktop.org/ontologies/2007/03/22/nfo#"
+ :dcat "http://www.w3.org/ns/dcat#"
+ :besluitvorming "https://data.vlaanderen.be/ns/besluitvorming#"
+ :reporting "http://lblod.data.gift/vocabularies/reporting/"
+ :oslc "http://open-services.net/ns/core#"
+ :cogs "http://vocab.deri.ie/cogs#"
+ )
+
+(type-cache::add-type-for-prefix "http://mu.semte.ch/sessions/" "http://mu.semte.ch/vocabularies/session/Session")
+
+(define-graph acmidm-lezer ("http://mu.semte.ch/graphs/administrative-unit")
+ ("dc_terms:Agent" -> _)
+ ("org:Organization" -> _)
+ ("regorg:RegisteredOrganization" -> _)
+ ("besluit:Besluit" -> _)
+ ("besluitvorming:Beslissingsactiviteit" -> _)
+ ("org:Site" -> _)
+ ("locn:Address" -> _)
+ ("person:Person" -> _)
+ ("schema:ContactPoint" -> _)
+ ("besluit:Bestuurseenheid" -> _)
+ ("besluit:Bestuursorgaan" -> _)
+ ("adms:Identifier" -> _)
+ ("generiek:GestructureerdeIdentificator" -> _)
+ ("mandaat:Mandaat" -> _)
+ ("mandaat:Mandataris" -> _)
+ ("lblodlg:Functionaris" -> _)
+ ("lblodlg:Bestuursfunctie" -> _)
+ ("code:VeranderingsgebeurtenisResultaat" -> _)
+ ("org:Post" -> _)
+ ("org:ChangeEvent" -> _)
+ ("ch:AgentInPositie" -> _)
+ ("ext:KboOrganisatie" -> _)
+ ("org:Membership" -> _)
+ ("time:ProperInterval" -> _))
+
+(define-graph acmidm-vendor ("http://mu.semte.ch/graphs/vendor-management-data")
+ ("ext:Vendor" -> _))
+
+(define-graph acmidm-editeerder ("http://mu.semte.ch/graphs/administrative-unit")
+ ("oasis:Error" -> _)
+ ("dc_terms:Agent" -> _)
+ ("org:Organization" -> _)
+ ("regorg:RegisteredOrganization" -> _)
+ ("besluit:Besluit" -> _)
+ ("besluitvorming:Beslissingsactiviteit" -> _)
+ ("org:Site" -> _)
+ ("locn:Address" -> _)
+ ("person:Person" -> _)
+ ("schema:ContactPoint" -> _)
+ ("besluit:Bestuurseenheid" -> _)
+ ("besluit:Bestuursorgaan" -> _)
+ ("adms:Identifier" -> _)
+ ("generiek:GestructureerdeIdentificator" -> _)
+ ("mandaat:Mandaat" -> _)
+ ("mandaat:Mandataris" -> _)
+ ("lblodlg:Functionaris" -> _)
+ ("lblodlg:Bestuursfunctie" -> _)
+ ("code:VeranderingsgebeurtenisResultaat" -> _)
+ ("org:Post" -> _)
+ ("org:ChangeEvent" -> _)
+ ("ch:AgentInPositie" -> _)
+ ("ext:KboOrganisatie" -> _)
+ ("org:Membership" -> _)
+ ("time:ProperInterval" -> _))
+
+(define-graph acmidm-worship-lezer ("http://mu.semte.ch/graphs/worship-service")
+ ("ere:EredienstMandataris" -> _)
+ ("ere:BestuurVanDeEredienst" -> _)
+ ("ere:EredienstBestuurseenheid" -> _)
+ ("ere:RolBedienaar" -> _)
+ ("ere:VoorwaardenBedienaar" -> _)
+ ("ere:PositieBedienaar" -> _)
+ ("ere:BetrokkenLokaleBesturen" -> _)
+ ("ere:VerbondenJuridischeStructuren" -> _)
+ ("ere:CentraalBestuurVanDeEredienst" -> _)
+ ("ere:RepresentatiefOrgaan" -> _)
+ ("dc_terms:Agent" -> _)
+ ("org:Organization" -> _)
+ ("regorg:RegisteredOrganization" -> _)
+ ("besluit:Besluit" -> _)
+ ("besluitvorming:Beslissingsactiviteit" -> _)
+ ("org:Site" -> _)
+ ("locn:Address" -> _)
+ ("person:Person" -> _)
+ ("schema:ContactPoint" -> _)
+ ("besluit:Bestuurseenheid" -> _)
+ ("besluit:Bestuursorgaan" -> _)
+ ("adms:Identifier" -> _)
+ ("generiek:GestructureerdeIdentificator" -> _)
+ ("mandaat:Mandaat" -> _)
+ ("mandaat:Mandataris" -> _)
+ ("lblodlg:Functionaris" -> _)
+ ("lblodlg:Bestuursfunctie" -> _)
+ ("code:VeranderingsgebeurtenisResultaat" -> _)
+ ("org:Post" -> _)
+ ("org:ChangeEvent" -> _)
+ ("ch:AgentInPositie" -> _)
+ ("ext:KboOrganisatie" -> _)
+ ("org:Membership" -> _)
+ ("time:ProperInterval" -> _))
+
+(define-graph acmidm-worship-editeerder ("http://mu.semte.ch/graphs/worship-service")
+ ("oasis:Error" -> _)
+ ("ere:EredienstMandataris" -> _)
+ ("ere:BestuurVanDeEredienst" -> _)
+ ("ere:EredienstBestuurseenheid" -> _)
+ ("ere:RolBedienaar" -> _)
+ ("ere:VoorwaardenBedienaar" -> _)
+ ("ere:PositieBedienaar" -> _)
+ ("ere:BetrokkenLokaleBesturen" -> _)
+ ("ere:VerbondenJuridischeStructuren" -> _)
+ ("ere:CentraalBestuurVanDeEredienst" -> _)
+ ("ere:RepresentatiefOrgaan" -> _)
+ ("dc_terms:Agent" -> _)
+ ("org:Organization" -> _)
+ ("regorg:RegisteredOrganization" -> _)
+ ("besluit:Besluit" -> _)
+ ("besluitvorming:Beslissingsactiviteit" -> _)
+ ("org:Site" -> _)
+ ("locn:Address" -> _)
+ ("person:Person" -> _)
+ ("schema:ContactPoint" -> _)
+ ("besluit:Bestuurseenheid" -> _)
+ ("besluit:Bestuursorgaan" -> _)
+ ("adms:Identifier" -> _)
+ ("generiek:GestructureerdeIdentificator" -> _)
+ ("mandaat:Mandaat" -> _)
+ ("mandaat:Mandataris" -> _)
+ ("lblodlg:Functionaris" -> _)
+ ("lblodlg:Bestuursfunctie" -> _)
+ ("code:VeranderingsgebeurtenisResultaat" -> _)
+ ("org:Post" -> _)
+ ("org:ChangeEvent" -> _)
+ ("ch:AgentInPositie" -> _)
+ ("ext:KboOrganisatie" -> _)
+ ("org:Membership" -> _)
+ ("time:ProperInterval" -> _))
+
+(define-graph public ("http://mu.semte.ch/graphs/public")
+ ("org:Role" -> _)
+ ("besluit:Bestuurseenheid" -> _)
+ ("foaf:Person" -> _)
+ ("foaf:OnlineAccount" -> _)
+ ("nfo:FileDataObject" -> _)
+ ("dcat:Dataset" -> _)
+ ("dcat:Distribution" -> _)
+ ("dcat:Catalog" -> _)
+ ("ext:GeslachtCode" -> _)
+ ("lblodlg:FunctionarisStatusCode" -> _)
+ ("code:OrganisatieStatusCode" -> _)
+ ("code:BestuursfunctieCode" -> _)
+ ("code:BestuursorgaanClassificatieCode" -> _)
+ ("code:MandatarisStatusCode" -> _)
+ ("code:BestuurseenheidClassificatieCode" -> _)
+ ("ext:GeregistreerdeOrganisatieClassificatieCode" -> _)
+ ("code:TypeEredienst" -> _)
+ ("skos:ConceptScheme" -> _)
+ ("code:BedienaarFinancieringCode" -> _)
+ ("skos:Concept" -> _)
+ ("euvoc:Country" -> _)
+ ("code:TypeVestiging" -> _)
+ ("code:HelftVerkiezing" -> _)
+ ("code:Veranderingsgebeurtenis" -> _)
+ ("code:TypeBetrokkenheid" -> _)
+ ("code:VoorwaardenBedienaarCriterium" -> _)
+ ("code:BedienaarCriteriumBewijsstuk" -> _)
+ ("code:EredienstBeroepen" -> _)
+ ("code:Rechtsvormtype" -> _)
+ ("prov:Location" -> _))
+
+(define-graph shared ("http://mu.semte.ch/graphs/shared")
+ ("foaf:Image" -> _)
+ ("nfo:FileDataObject" -> _)
+ ("dc_terms:Agent" -> _)
+ ("org:Organization" -> _)
+ ("regorg:RegisteredOrganization" -> _)
+ ("besluit:Besluit" -> _)
+ ("besluitvorming:Beslissingsactiviteit" -> _)
+ ("org:Site" -> _)
+ ("locn:Address" -> _)
+ ("person:Person" -> _)
+ ("schema:ContactPoint" -> _)
+ ("besluit:Bestuurseenheid" -> _)
+ ("besluit:Bestuursorgaan" -> _)
+ ("adms:Identifier" -> _)
+ ("generiek:GestructureerdeIdentificator" -> _)
+ ("mandaat:Mandaat" -> _)
+ ("mandaat:Mandataris" -> _)
+ ("lblodlg:Functionaris" -> _)
+ ("lblodlg:Bestuursfunctie" -> _)
+ ("code:VeranderingsgebeurtenisResultaat" -> _)
+ ("org:Post" -> _)
+ ("org:ChangeEvent" -> _)
+ ("ch:AgentInPositie" -> _)
+ ("ext:KboOrganisatie" -> _)
+ ("org:Membership" -> _)
+ ("time:ProperInterval" -> _))
+
+(define-graph reports ("http://mu.semte.ch/graphs/reports")
+ ("reporting:Report" -> _)
+ ("oslc:Error" -> _)
+ ("nfo:DataContainer" -> _)
+ ("nfo:FileDataObject" -> _))
+
+(define-graph system-jobs ("http://mu.semte.ch/graphs/system/jobs")
+ ("cogs:Job" -> _)
+ ("nfo:DataContainer" -> _)
+ ("nfo:FileDataObject" -> _))
+
+(define-graph jobs ("http://mu.semte.ch/graphs/jobs")
+ ("cogs:Job" -> _)
+ ("nfo:DataContainer" -> _)
+ ("nfo:FileDataObject" -> _))
+
+(supply-allowed-group "public")
+
+(supply-allowed-group "o-admin-rwf"
+ :parameters ()
+ :query "PREFIX ext:
+ SELECT DISTINCT ?session WHERE {
+ ext:sessionRole \"LoketLB-AdminDashboardOrganisatiePortaalGebruiker\" .
+ }")
+
+(supply-allowed-group "ABBOrganisatiePortaalGebruiker-lezer"
+ :parameters ()
+ :query "PREFIX ext:
+ PREFIX mu:
+ SELECT DISTINCT ?session_group ?session_role WHERE {
+ ext:sessionGroup/mu:uuid ?session_group;
+ ext:activeSessionRole ?session_role.
+ FILTER( ?session_role = \"ABBOrganisatiePortaalGebruiker-lezer\" )
+ }")
+
+(supply-allowed-group "ABBOrganisatiePortaalGebruiker-editeerder"
+ :parameters ()
+ :query "PREFIX ext:
+ PREFIX mu:
+ SELECT DISTINCT ?session_group ?session_role WHERE {
+ ext:sessionGroup/mu:uuid ?session_group;
+ ext:activeSessionRole ?session_role.
+ FILTER( ?session_role = \"ABBOrganisatiePortaalGebruiker-editeerder\" )
+ }")
+
+(supply-allowed-group "ABBOrganisatiePortaalGebruiker-beheerder"
+ :parameters ()
+ :query "PREFIX ext:
+ PREFIX mu:
+ SELECT DISTINCT ?session_group ?session_role WHERE {
+ ext:sessionGroup/mu:uuid ?session_group;
+ ext:activeSessionRole ?session_role.
+ FILTER( ?session_role = \"ABBOrganisatiePortaalGebruiker-beheerder\" )
+ }")
+
+
+(supply-allowed-group "ABBOrganisatiePortaalErediensten-lezer"
+ :parameters ()
+ :query "PREFIX ext:
+ PREFIX mu:
+ SELECT DISTINCT ?session_group ?session_role WHERE {
+ ext:sessionGroup/mu:uuid ?session_group;
+ ext:activeSessionRole ?session_role.
+ FILTER( ?session_role = \"ABBOrganisatiePortaalErediensten-lezer\" )
+ }")
+
+(supply-allowed-group "ABBOrganisatiePortaalErediensten-editeerder"
+ :parameters ()
+ :query "PREFIX ext:
+ PREFIX mu:
+ SELECT DISTINCT ?session_group ?session_role WHERE {
+ ext:sessionGroup/mu:uuid ?session_group;
+ ext:activeSessionRole ?session_role.
+ FILTER( ?session_role = \"ABBOrganisatiePortaalErediensten-editeerder\" )
+ }")
+
+(supply-allowed-group "ABBOrganisatiePortaalErediensten-beheerder"
+ :parameters ()
+ :query "PREFIX ext:
+ PREFIX mu:
+ SELECT DISTINCT ?session_group ?session_role WHERE {
+ ext:sessionGroup/mu:uuid ?session_group;
+ ext:activeSessionRole ?session_role.
+ FILTER( ?session_role = \"ABBOrganisatiePortaalErediensten-beheerder\" )
+ }")
+
+(grant (read)
+ :to-graph (acmidm-lezer acmidm-vendor)
+ :for-allowed-group "ABBOrganisatiePortaalGebruiker-lezer")
+
+(grant (read write)
+ :to-graph (acmidm-editeerder acmidm-vendor)
+ :for-allowed-group "ABBOrganisatiePortaalGebruiker-editeerder")
+
+(grant (read write)
+ :to-graph (acmidm-editeerder acmidm-vendor)
+ :for-allowed-group "ABBOrganisatiePortaalGebruiker-beheerder")
+
+(grant (read)
+ :to-graph (acmidm-worship-lezer acmidm-vendor)
+ :for-allowed-group "ABBOrganisatiePortaalErediensten-lezer")
+
+(grant (read write)
+ :to-graph (acmidm-worship-editeerder acmidm-vendor)
+ :for-allowed-group "ABBOrganisatiePortaalErediensten-editeerder")
+
+(grant (read write)
+ :to-graph (acmidm-worship-editeerder acmidm-vendor)
+ :for-allowed-group "ABBOrganisatiePortaalErediensten-beheerder")
+
+(grant (read)
+ :to-graph (public shared)
+ :for-allowed-group "public")
+
+(grant (read write)
+ :to-graph (reports jobs system-jobs)
+ :for-allowed-group "o-admin-rwf")
\ No newline at end of file
diff --git a/config/authorization/delta.ex b/config/authorization/delta.ex
deleted file mode 100644
index 0c0e26c..0000000
--- a/config/authorization/delta.ex
+++ /dev/null
@@ -1,5 +0,0 @@
-defmodule Delta.Config do
- def targets do
- [ "http://deltanotifier" ]
- end
-end
\ No newline at end of file
diff --git a/config/migrations/2026/20260421133705-delete-local-involvement-sint-laureins.sparql b/config/migrations/2026/20260421133705-delete-local-involvement-sint-laureins.sparql
new file mode 100644
index 0000000..42cb257
--- /dev/null
+++ b/config/migrations/2026/20260421133705-delete-local-involvement-sint-laureins.sparql
@@ -0,0 +1,51 @@
+DELETE WHERE {
+ graph {
+ ?p ?o.
+ }
+}
+
+;
+
+DELETE WHERE {
+ graph {
+ .
+ }
+}
+
+;
+
+DELETE WHERE {
+ graph {
+ ?p ?o.
+ }
+}
+
+;
+
+DELETE WHERE {
+ graph {
+ .
+ }
+}
+
+;
+
+DELETE {
+ GRAPH ?g {
+ ?localInvolvementSintLaureins ?percentage.
+ }
+}
+INSERT {
+ GRAPH ?g {
+ ?localInvolvementSintLaureins 100.
+ }
+}
+WHERE {
+ BIND( AS ?g)
+ GRAPH ?g {
+ ?localInvolvementSintLaureins ?percentage.
+ }
+ VALUES ?localInvolvementSintLaureins {
+
+ }
+}
diff --git a/docker-compose.yml b/docker-compose.yml
index 804b634..f092d22 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -33,8 +33,9 @@ services:
restart: always
logging: *default-logging
db:
- image: semtech/mu-authorization:feature-service-roam-r1.1
+ image: semtech/sparql-parser:0.0.15
environment:
+ LISP_DYNAMIC_SPACE_SIZE: 8192
MU_SPARQL_ENDPOINT: "http://triplestore:8890/sparql"
LOG_OUTGOING_SPARQL_QUERIES: "true"
LOG_INCOMING_SPARQL_QUERIES: "true"
@@ -45,6 +46,7 @@ services:
QUERY_MAX_EXECUTION_TIME: "300000"
volumes:
- ./config/authorization:/config
+ - ./data/authorization:/data
labels:
- "logging=true"
restart: always
@@ -89,9 +91,10 @@ services:
restart: always
logging: *default-logging
resource:
- image: semtech/mu-cl-resources:1.24.0
+ image: semtech/mu-cl-resources:1.27.2
environment:
CACHE_CLEAR_PATH: "http://cache/.mu/clear-keys"
+ LISP_DYNAMIC_SPACE_SIZE: "8192" # 1GB by default, increase to 8GB on systems with a lot of data
links:
- db:database
volumes: