Release v1.36.0

[OP-3674]: use acmidm for dashboard

CHANGELOG.md

@@ -1,5 +1,90 @@
 # Changelog
-## Unreleased
+
+## 1.36.0 (2025-10-03)
+### Dashboard
+- Enable ACM/IDM for the dashboard [OP-3674]
+
+#### QA
+Configure the environment variables for the QA ACM/IDM environment:
+
+```yml
+  frontend-dashboard:
+    environment:
+      EMBER_ACMIDM_CLIENT_ID: "03382bf4-4886-4fb6-8602-945ad3080a7a"
+      EMBER_ACMIDM_BASE_URL: "https://authenticatie-ti.vlaanderen.be/op/v1/auth"
+      EMBER_ACMIDM_REDIRECT_URL: "https://dashboard.organisaties.abb.lblod.info/authorization/callback"
+      EMBER_ACMIDM_LOGOUT_URL: "https://authenticatie-ti.vlaanderen.be/op/v1/logout"
+      EMBER_ACMIDM_SCOPE: "openid vo profile abb_organisatieportaal"
+
+  login-dashboard:
+    environment:
+      MU_APPLICATION_AUTH_DISCOVERY_URL: "https://authenticatie-ti.vlaanderen.be/op"
+      MU_APPLICATION_AUTH_CLIENT_ID: "03382bf4-4886-4fb6-8602-945ad3080a7a"
+      MU_APPLICATION_AUTH_REDIRECT_URI: "https://dashboard.organisaties.abb.lblod.info/authorization/callback"
+      MU_APPLICATION_AUTH_CLIENT_SECRET: "snip" # see ticket for secret
+
+```
+
+Link the new domain name to QA (and remove from dev)
+
+#### PROD
+Configure the environment variables for the PROD ACM/IDM environment once the values are known.
+
+Link the new domain name to PROD + DNS config to the server
+
+#### CLI
+```
+drc restart migrations
+drc restart dispatcher database
+drc up -d --remove-orphans
+```
+
+### Frontend
+- Bump to [v1.34.1](https://github.com/lblod/frontend-organization-portal/releases/tag/v1.34.1) [OP-3638]
+- Remove province for addresses in the Brussels area [OP-3638] & [OP-3648]
+
+### Deploy notes
+```
+drc pull frontend; drc up -d frontend
+drc restart migrations-triggering-indexing; drc logs -ft --tail=200 migrations-triggering-indexing
+```
+
+## v1.35.1 (2025-09-15)
+### Backend
+- Produce memberships and their roles in organizations and public producers [OP-3658] & [OP-3661]
+### Deploy notes
+```
+drc restart delta-producer-publication-graph-maintainer
+```
+
+## v1.35.0 (2025-08-04)
+### Frontend
+- Bump to [v1.34.0](https://github.com/lblod/frontend-organization-portal/releases/tag/v1.34.0)
+### Backend
+- Add a service to manage organisation's their scope of operation [OP-3205]
+- datamodel: Allow a location to be within multiple other locations [OP-3205]
+- datafix: set scope of operation for worship administrative units [OP-3626]
+- Clean addresses linked to both sites and contact points of mandatarissen and addresses that are in the wrong graph (admin unit graph but linked to a contact point in the worship graph) [DL-6701]
+- datafix: cleanup of general memberships if specific ones exist [OP-3640]
+- datafix: cleanup of duplicate memberships [OP-3634]
+- Fix KBO organizations' date formats [OP-3560]
+
+
+### Deploy notes
+```
+drc pull scope-of-operation; drc up -d scope-of-operation
+drc restart db resource dispatcher
+drc pull frontend; drc up -d frontend
+drc restart migrations; drc logs -ft --tail=200 migrations
+drc up -d kbo-data-sync
+```
+
+The labels for new location resources created when setting the scope of operation for worship services are not necessarily alphabetically sorted. To correct this run the `correct-location-labels` project script using [mu-cli](https://github.com/mu-semtech/mu-cli) and restart the migrations service once more to execute the generated local migrations.
+
+```
+mu script project-scripts correct-location-labels
+drc restart migrations; drc logs -ft --tail=200 migrations
+```
 
 ## v1.34.0 (2025-07-11)
 ### Frontend

README.md

@@ -185,26 +185,3 @@ To make sure the app can share data, producers need to be set up. There is an in
        )
      }
 ```
-
-## Configuring the dashboard
-### Accessing the dashboard from your local machine
-
-Since we use dispatcher v2, which dispatches on hostname, we'll have to update `/etc/hosts`.
-Add an entry similar to the following. Ensure the first part of the domain starts with `dashboard`.:
-
-```
-127.0.0.1 dashboard.localhost
-```
-
-### Creating new users
-For now, we use specific logins for the dashboard users. Each environment has its own passwords.
-
-To add a user, make sure to have [mu-cli](https://github.com/mu-semtech/mu-cli) installed first.
-Then in `docker-compose.override.yml`
-```
-  dashboard-login:
-    environment:
-      MU_APPLICATION_SALT: 'a_random_string_with_sufficient_entropy_hence_not_this_one'
-```
-You can now generate a user by running `mu script project-scripts generate-dashboard-login` and following the steps.
-Restart `migrations` and it should insert the new user into the database.

config/authorization/config.ex

@@ -53,7 +53,8 @@ defmodule Acl.UserGroups.Config do
     "http://lblod.data.gift/vocabularies/organisatie/VoorwaardenBedienaarCriterium",
     "http://lblod.data.gift/vocabularies/organisatie/BedienaarCriteriumBewijsstuk",
     "http://lblod.data.gift/vocabularies/organisatie/EredienstBeroepen",
-    "http://lblod.data.gift/vocabularies/organisatie/Rechtsvormtype"
+    "http://lblod.data.gift/vocabularies/organisatie/Rechtsvormtype",
+    "http://www.w3.org/ns/prov#Location"
   ]
 
   @org_type [
@@ -80,11 +81,10 @@ defmodule Acl.UserGroups.Config do
     "http://data.lblod.info/vocabularies/contacthub/AgentInPositie",
     "http://mu.semte.ch/vocabularies/ext/KboOrganisatie",
     "http://www.w3.org/ns/org#Membership",
-    "http://www.w3.org/2006/time#ProperInterval"
+    "http://www.w3.org/2006/time#ProperInterval",
   ]
 
   @shared_protected_type [
-    "http://www.w3.org/ns/prov#Location",
     "http://xmlns.com/foaf/0.1/Image",
     "http://www.semanticdesktop.org/ontologies/2007/03/22/nfo#FileDataObject"
   ]
@@ -111,13 +111,11 @@ defmodule Acl.UserGroups.Config do
     %AccessByQuery{
       vars: [],
       query: "PREFIX ext: <http://mu.semte.ch/vocabularies/ext/>
-        PREFIX mu: <http://mu.semte.ch/vocabularies/core/>
-        SELECT DISTINCT ?account WHERE {
-          <SESSION_ID> <http://mu.semte.ch/vocabularies/session/account> ?account.
-          ?account <http://mu.semte.ch/vocabularies/ext/sessionRole> ?session_role.
-          FILTER( ?session_role = \"dashboard-user\" )
+        SELECT DISTINCT ?session WHERE {
+          VALUES ?session { <SESSION_ID> }
+          ?session ext:sessionRole \"LoketLB-AdminDashboardOrganisatiePortaalGebruiker\" .
         }"
-      }
+    }
   end
 
   def user_groups do
@@ -219,10 +217,10 @@ defmodule Acl.UserGroups.Config do
           }
         ]
       },
-      # // dashboard users
+      # // Dashboard admin
       %GroupSpec{
-        name: "dashboard-users",
-        useage: [:read],
+        name: "o-admin-rwf",
+        useage: [:read, :write, :read_for_write],
         access: can_access_dashboard(),
         graphs: [
           %GraphSpec{
@@ -256,7 +254,7 @@ defmodule Acl.UserGroups.Config do
                 "http://www.semanticdesktop.org/ontologies/2007/03/22/nfo#FileDataObject"
               ]
             }
-          },
+          }
         ]
       },
 

config/delta-producer/organizations/export.json

@@ -512,6 +512,32 @@
       "properties": [
         "http://www.w3.org/2004/02/skos/core#prefLabel"
       ]
+    },
+    {
+      "type": "http://www.w3.org/ns/org#Membership",
+      "graphsFilter": [
+        "http://mu.semte.ch/graphs/worship-service",
+        "http://mu.semte.ch/graphs/shared",
+        "http://mu.semte.ch/graphs/administrative-unit"
+      ],
+      "properties": [
+        "http://mu.semte.ch/vocabularies/core/uuid",
+        "http://www.w3.org/ns/org#organization",
+        "http://www.w3.org/ns/org#member",
+        "http://www.w3.org/ns/org#role"
+      ]
+    },
+    {
+      "type": "http://www.w3.org/ns/org#Role",
+      "graphsFilter": [
+        "http://mu.semte.ch/graphs/public"
+      ],
+      "properties": [
+        "http://mu.semte.ch/vocabularies/core/uuid",
+        "http://www.w3.org/2004/02/skos/core#prefLabel",
+        "http://www.w3.org/2004/02/skos/core#broader",
+        "http://www.w3.org/2004/02/skos/core#topConceptOf"
+      ]
     }
   ]
 }

config/delta-producer/public/export.json

@@ -675,6 +675,32 @@
         "http://www.w3.org/2004/02/skos/core#prefLabel",
         "http://www.w3.org/2000/01/rdf-schema#label"
       ]
+    },
+    {
+      "type": "http://www.w3.org/ns/org#Membership",
+      "graphsFilter": [
+        "http://mu.semte.ch/graphs/worship-service",
+        "http://mu.semte.ch/graphs/shared",
+        "http://mu.semte.ch/graphs/administrative-unit"
+      ],
+      "properties": [
+        "http://mu.semte.ch/vocabularies/core/uuid",
+        "http://www.w3.org/ns/org#organization",
+        "http://www.w3.org/ns/org#member",
+        "http://www.w3.org/ns/org#role"
+      ]
+    },
+    {
+      "type": "http://www.w3.org/ns/org#Role",
+      "graphsFilter": [
+        "http://mu.semte.ch/graphs/public"
+      ],
+      "properties": [
+        "http://mu.semte.ch/vocabularies/core/uuid",
+        "http://www.w3.org/2004/02/skos/core#prefLabel",
+        "http://www.w3.org/2004/02/skos/core#broader",
+        "http://www.w3.org/2004/02/skos/core#topConceptOf"
+      ]
     }
   ]
 }

config/dispatcher/dispatcher.ex

@@ -306,7 +306,7 @@ defmodule Dispatcher do
   end
 
   match "/sessions/*path", %{ reverse_host: ["dashboard" | _rest] } do
-    Proxy.forward conn, path, "http://dashboard-login/sessions/"
+    Proxy.forward conn, path, "http://login-dashboard/sessions/"
   end
 
   match "/sessions/*path", %{accept: [:any], layer: :api} do
@@ -393,6 +393,10 @@ defmodule Dispatcher do
     forward(conn, path, "http://kbo-data-sync/sync-kbo-data/")
   end
 
+  match "/scope-of-operation/*path", %{layer: api_services, accept: %{json: true}} do
+    forward(conn, path, "http://scope-of-operation/")
+  end
+
   get "/ldes/*path", %{layer: :api_services} do
     forward(conn, path, "http://ldes-backend/")
   end

config/migrations-triggering-indexing/2025/20250703095300-remove-province-for-addresses-in-brussels-gewest.sparql

@@ -0,0 +1,38 @@
+DELETE {
+  GRAPH <http://mu.semte.ch/graphs/worship-service> {
+    ?s <http://www.w3.org/ns/locn#adminUnitL2> ?province ;
+      <https://data.vlaanderen.be/ns/adres#adresIsGelegenIn> ?werkingsgebied .
+  }
+} WHERE {
+  GRAPH <http://mu.semte.ch/graphs/worship-service> {
+    VALUES ?postCode {
+      "1070"
+      "1000"
+      "1020"
+      "1120"
+      "1130"
+      "1050"
+      "1040"
+      "1140"
+      "1083"
+      "1090"
+      "1081"
+      "1160"
+      "1030"
+      "1082"
+      "1060"
+      "1080"
+      "1210"
+      "1200"
+      "1150"
+      "1180"
+      "1190"
+      "1170"
+    }
+
+    ?s a <http://www.w3.org/ns/locn#Address> ;
+      <http://www.w3.org/ns/locn#postCode> ?postCode ;
+      <http://www.w3.org/ns/locn#adminUnitL2> ?province ;
+      <https://data.vlaanderen.be/ns/adres#adresIsGelegenIn> ?werkingsgebied .
+  }
+}

config/migrations/2025/20250707132349-feat--add-scope-for-operation-worship-organisations/20250707132349-chore--extract-scopes-for-worship-organisations.sparql

@@ -0,0 +1,112 @@
+PREFIX ere: <http://data.lblod.info/vocabularies/erediensten/>
+PREFIX org: <http://www.w3.org/ns/org#>
+PREFIX besluit: <http://data.vlaanderen.be/ns/besluit#>
+
+# This migration extracts the relations between (central) worship services and
+# their locations according to the rules provided by business. These links are
+# inserted into a temporary graph for further processing.
+
+# Worship services
+## Municipality organised
+INSERT {
+  GRAPH <http://mu.semte.ch/graphs/temp-for-worship-organizations-scope> {
+    ?ws besluit:werkingsgebied ?scope .
+  }
+} WHERE {
+  GRAPH <http://mu.semte.ch/graphs/worship-service> {
+    ?ws a ere:BestuurVanDeEredienst ;
+        ere:typeEredienst ?worshipType .
+    VALUES ?worshipType {
+      <http://lblod.data.gift/concepts/99536dd6eb0d2ef38a89efafb17e7389> # Anglicaans
+      <http://lblod.data.gift/concepts/1a1abeafc973d27cebcb2d7a15b2d823> # Israëlitisch
+      <http://lblod.data.gift/concepts/e8cba1540b35a32e9cb45126c38c03c6> # Protestants
+      <http://lblod.data.gift/concepts/b13d1d623626bc1ee75c7d20bc60e3c0> # Rooms-Katholiek
+    }
+
+    ?involvement a ere:BetrokkenLokaleBesturen ;
+                 org:organization ?ws ;
+                 ere:typebetrokkenheid ?involvementType .
+    VALUES ?involvementType {
+      <http://lblod.data.gift/concepts/86fcbbbff764f1cba4c7e10dbbae578e> # Mede-financierend
+      <http://lblod.data.gift/concepts/ac400cc9f135ac7873fb3e551ec738c1> # Toezichthoudend
+    }
+    ?org ere:betrokkenBestuur ?involvement .
+  }
+  GRAPH <http://mu.semte.ch/graphs/administrative-unit> {
+    ?org besluit:werkingsgebied ?scope .
+  }
+}
+;
+## Province organised
+INSERT {
+  GRAPH <http://mu.semte.ch/graphs/temp-for-worship-organizations-scope> {
+    ?ws besluit:werkingsgebied ?scope .
+  }
+} WHERE {
+  GRAPH <http://mu.semte.ch/graphs/worship-service> {
+    ?ws a ere:BestuurVanDeEredienst ;
+        ere:typeEredienst ?worshipType .
+    VALUES ?worshipType {
+      <http://lblod.data.gift/concepts/9d8bd472a00bf0a5c7b7186606365a52> # Islamitisch
+      <http://lblod.data.gift/concepts/84bcd6896f575bae4857ff8d2764bed8> # Orthodox
+    }
+
+    ?involvement a ere:BetrokkenLokaleBesturen ;
+                 org:organization ?ws ;
+                 ere:typebetrokkenheid ?involvementType .
+    VALUES ?involvementType {
+      <http://lblod.data.gift/concepts/0f845f00ee76099c89518cbaf6a7b77f> # Adviserend
+    }
+    ?org ere:betrokkenBestuur ?involvement .
+  }
+  GRAPH <http://mu.semte.ch/graphs/administrative-unit> {
+    ?org besluit:werkingsgebied ?scope .
+  }
+}
+;
+# Central worship services
+## Municipality organised
+INSERT {
+  GRAPH <http://mu.semte.ch/graphs/temp-for-worship-organizations-scope> {
+    ?ws besluit:werkingsgebied ?scope .
+  }
+} WHERE {
+  GRAPH <http://mu.semte.ch/graphs/worship-service> {
+    ?ws a ere:CentraalBestuurVanDeEredienst ;
+        ere:typeEredienst ?worshipType .
+    VALUES ?worshipType {
+      <http://lblod.data.gift/concepts/b13d1d623626bc1ee75c7d20bc60e3c0> # Rooms-Katholiek
+    }
+
+    ?involvement a ere:BetrokkenLokaleBesturen ;
+                 org:organization ?ws ;
+                 ere:typebetrokkenheid ?involvementType .
+    VALUES ?involvementType {
+      <http://lblod.data.gift/concepts/ac400cc9f135ac7873fb3e551ec738c1> # Toezichthoudend
+    }
+    ?org ere:betrokkenBestuur ?involvement .
+  }
+  GRAPH <http://mu.semte.ch/graphs/administrative-unit> {
+    ?org besluit:werkingsgebied ?scope .
+  }
+}
+;
+## Province organised
+## Note: Business requested to use the location for the municipality of Ghent as
+## default value. They will update it manually afterwards.
+INSERT {
+  GRAPH <http://mu.semte.ch/graphs/temp-for-worship-organizations-scope> {
+    ?ws besluit:werkingsgebied ?locationGhent .
+  }
+} WHERE {
+  GRAPH <http://mu.semte.ch/graphs/worship-service> {
+    ?ws a ere:CentraalBestuurVanDeEredienst ;
+        ere:typeEredienst ?worshipType .
+    VALUES ?worshipType {
+      <http://lblod.data.gift/concepts/9d8bd472a00bf0a5c7b7186606365a52> # Islamitisch
+      <http://lblod.data.gift/concepts/84bcd6896f575bae4857ff8d2764bed8> # Orthodox
+    }
+
+    BIND(URI("http://data.lblod.info/id/werkingsgebieden/ce94eeae827cdc5c00f3f2f4276ff628580edefb3aa5861e4669b0c5d93adc57") AS ?locationGhent)
+  }
+}

config/migrations/2025/20250707132349-feat--add-scope-for-operation-worship-organisations/20250709140704-feat--set-scope-for-worship-organisations-with-single-location.sparql

@@ -0,0 +1,24 @@
+PREFIX besluit: <http://data.vlaanderen.be/ns/besluit#>
+
+# This migration sets the scope of operation for worship organisations that have
+# single, already existing, location as scope. This migration depends on
+# `20250707132349-chore--extract-scopes-for-worship-organisations` being
+# executed first, as it uses the data created by the migration.
+INSERT {
+  GRAPH <http://mu.semte.ch/graphs/worship-service> {
+    ?ws besluit:werkingsgebied ?scope .
+  }
+} WHERE {
+  {
+    SELECT DISTINCT ?ws (count(DISTINCT ?scope) as ?count)
+    WHERE {
+      GRAPH <http://mu.semte.ch/graphs/temp-for-worship-organizations-scope> {
+        ?ws besluit:werkingsgebied ?scope .
+      }
+    }
+  }
+  FILTER (?count = 1)
+  GRAPH <http://mu.semte.ch/graphs/temp-for-worship-organizations-scope> {
+    ?ws besluit:werkingsgebied ?scope .
+  }
+}

config/migrations/2025/20250707132349-feat--add-scope-for-operation-worship-organisations/20250709160017-feat--set-scope-for-worship-organisations-with-multiple-locations.sparql

@@ -0,0 +1,49 @@
+PREFIX prov: <http://www.w3.org/ns/prov#>
+PREFIX mu: <http://mu.semte.ch/vocabularies/core/>
+PREFIX ext: <http://mu.semte.ch/vocabularies/ext/>
+PREFIX geo: <http://www.opengis.net/ont/geosparql#>
+PREFIX besluit: <http://data.vlaanderen.be/ns/besluit#>
+PREFIX rdfs: <http://www.w3.org/2000/01/rdf-schema#>
+
+# This migration sets the scope of operation for worship organisations that have
+# multiple location as scope. It creates new aggregate locations to contain the
+# already existing municipality/province level ones.  This migration depends on
+# `20250707132349-chore--extract-scopes-for-worship-organisations` being
+# executed first, as it uses the data created by the migration.
+INSERT {
+  GRAPH <http://mu.semte.ch/graphs/public> {
+    ?location a prov:Location ;
+              mu:uuid ?locationUuid ;
+              rdfs:label ?scopeLabel ;
+              ext:werkingsgebiedNiveau """Samengesteld werkingsgebied""" .
+    ?scope geo:sfWithin ?location .
+  }
+  GRAPH <http://mu.semte.ch/graphs/worship-service> {
+    ?ws besluit:werkingsgebied ?location .
+  }
+} WHERE {
+  {
+    SELECT DISTINCT ?ws (count(DISTINCT ?scope) AS ?count) (GROUP_CONCAT(?uuid," ") AS ?scopeUuids) (GROUP_CONCAT(?label,", ") AS ?scopeLabel)
+    WHERE {
+      GRAPH <http://mu.semte.ch/graphs/temp-for-worship-organizations-scope> {
+        ?ws besluit:werkingsgebied ?scope .
+      }
+      GRAPH <http://mu.semte.ch/graphs/public> {
+        ?scope mu:uuid ?uuid ;
+               rdfs:label ?label .
+      }
+    }
+  }
+  FILTER (?count > 1)
+  GRAPH <http://mu.semte.ch/graphs/temp-for-worship-organizations-scope> {
+    ?ws besluit:werkingsgebied ?scope .
+  }
+  # NOTE (10/07/2025): The SPARQL specification does not specify any order for
+  # `GROUP_CONCAT`. But virtuoso does seem to concatenate elements always in the
+  # same order. Therefore, this way of generating a UUID is a bit of a hack to
+  # ensure that new locations that contain the same locations will receive the
+  # same UUUID, which results in the same location resource being inserted
+  # twice.
+  BIND (STR(SHA256(?scopeUuids)) AS ?locationUuid)
+  BIND (URI(CONCAT("http://data.lblod.info/id/werkingsgebieden/", ?locationUuid)) AS ?location)
+}

config/migrations/2025/20250707132349-feat--add-scope-for-operation-worship-organisations/20250710095207-chore--clear-temp-graph-worship-scopes.sparql

@@ -0,0 +1 @@
+CLEAR GRAPH <http://mu.semte.ch/graphs/temp-for-worship-organizations-scope>

config/migrations/2025/20250708142100-fix-same-address-linked-to-both-site-and-contact-point.sparql

@@ -0,0 +1,30 @@
+DELETE {
+  GRAPH ?h {
+    ?site <https://data.vlaanderen.be/ns/organisatie#bestaatUit> ?oldAddressUri .
+  }
+} INSERT {
+  GRAPH ?g {
+    ?newAddressUri a <http://www.w3.org/ns/locn#Address> ;
+      <http://mu.semte.ch/vocabularies/core/uuid> ?newAddressUuid ;
+      ?p ?o .
+
+    ?site <https://data.vlaanderen.be/ns/organisatie#bestaatUit> ?newAddressUri .
+  }
+} WHERE {
+  GRAPH ?g {
+    ?oldAddressUri a <http://www.w3.org/ns/locn#Address> ;
+      ?p ?o .
+
+    FILTER (?p NOT IN (<http://mu.semte.ch/vocabularies/core/uuid>))
+  }
+
+  ?mandatarisContact <http://www.w3.org/ns/locn#address> ?oldAddressUri .
+
+  GRAPH ?h {
+    ?site a <http://www.w3.org/ns/org#Site>;
+     <https://data.vlaanderen.be/ns/organisatie#bestaatUit> ?oldAddressUri .
+  }
+
+  BIND(MD5(CONCAT(?oldAddressUri,"NEW_ADDRESS")) AS ?newAddressUuid) .
+  BIND(IRI(CONCAT("http://data.lblod.info/id/adressen/", STR(?newAddressUuid))) AS ?newAddressUri) .
+}

config/migrations/2025/20250718132455-remove-general-memberships-if-specifics-exists.sparql

@@ -0,0 +1,33 @@
+PREFIX org: <http://www.w3.org/ns/org#>
+PREFIX mu: <http://mu.semte.ch/vocabularies/core/>
+PREFIX skos: <http://www.w3.org/2004/02/skos/core#>
+
+DELETE {
+  GRAPH ?g {
+    ?membership ?p ?o .
+  }
+}
+WHERE {
+  GRAPH ?g {
+    # Find memberships that use the general 'gerelateerd' role
+    ?membership a org:Membership ;
+                org:role <http://data.lblod.info/id/rollen/4ec7d5c39bdc4e84b4174379b9e22ad8> ;
+                org:member ?orgMember ;
+                org:organization ?organization .
+
+    # Only delete if there's a specific role for the inverse membership
+    FILTER EXISTS {
+      ?specific_membership a org:Membership ;
+                           org:member ?organization ;
+                           org:organization ?orgMember ;
+                           org:role ?specificRole .
+
+      VALUES ?specificRole {
+        <http://data.lblod.info/id/rollen/2152eb830b1143bfb97a7dd9596d6c63> # participant
+        <http://data.lblod.info/id/rollen/73d5e1cf250d42fab15926771f07505a> # stichtend lid
+      }
+    }
+
+    ?membership ?p ?o .
+  }
+}

config/migrations/2025/20250722114200-fix-contact-addresses-being-in-wrong-graph.sparql

@@ -0,0 +1,18 @@
+DELETE {
+  GRAPH <http://mu.semte.ch/graphs/administrative-unit> {
+    ?address ?p ?o .
+  }
+} INSERT {
+  GRAPH <http://mu.semte.ch/graphs/worship-service> {
+    ?address ?p ?o .
+  }
+} WHERE {
+  GRAPH <http://mu.semte.ch/graphs/worship-service> {
+    ?contactPoint a <http://schema.org/ContactPoint> ;
+      <http://www.w3.org/ns/locn#address> ?address .
+  }
+
+  GRAPH <http://mu.semte.ch/graphs/administrative-unit> {
+    ?address ?p ?o .
+  }
+}

config/migrations/2025/20250725120411-fix-reversed-memberships-ocmw-municipality.sparql

@@ -0,0 +1,40 @@
+PREFIX org: <http://www.w3.org/ns/org#>
+PREFIX mu: <http://mu.semte.ch/vocabularies/core/>
+
+DELETE {
+  GRAPH <http://mu.semte.ch/graphs/administrative-unit> {
+    ?membership org:organization ?ocmw ;
+                org:member ?municipality .
+  }
+}
+INSERT {
+  GRAPH <http://mu.semte.ch/graphs/administrative-unit> {
+    ?membership org:organization ?municipality ;
+                org:member ?ocmw .
+  }
+}
+WHERE {
+  GRAPH <http://mu.semte.ch/graphs/administrative-unit> {
+    ?membership a org:Membership ;
+      org:organization ?ocmw ;
+      org:member ?municipality ;
+      org:role <http://data.lblod.info/id/rollen/4ec7d5c39bdc4e84b4174379b9e22ad8> .
+  }
+
+  GRAPH ?graphMunicipality {
+    ?municipality org:classification <http://data.vlaanderen.be/id/concept/BestuurseenheidClassificatieCode/5ab0e9b8a3b2ca7c5e000001> .
+  }
+
+  GRAPH ?graphOCMW {
+    ?ocmw org:classification <http://data.vlaanderen.be/id/concept/BestuurseenheidClassificatieCode/5ab0e9b8a3b2ca7c5e000002> .
+  }
+
+  FILTER NOT EXISTS {
+    GRAPH <http://mu.semte.ch/graphs/administrative-unit> {
+      ?correctMembership a org:Membership ;
+        org:organization ?municipality ;
+        org:member ?ocmw ;
+        org:role <http://data.lblod.info/id/rollen/4ec7d5c39bdc4e84b4174379b9e22ad8> .
+    }
+  }
+}

config/migrations/2025/20250725120522-remove-duplicate-memberships-ocmw-municipality.sparql

@@ -0,0 +1,33 @@
+PREFIX org: <http://www.w3.org/ns/org#>
+PREFIX mu: <http://mu.semte.ch/vocabularies/core/>
+
+DELETE {
+  GRAPH <http://mu.semte.ch/graphs/administrative-unit> {
+    ?duplicateMembership ?p ?o .
+  }
+} WHERE {
+  GRAPH <http://mu.semte.ch/graphs/administrative-unit> {
+    ?duplicateMembership a org:Membership ;
+      org:organization ?ocmw ;
+      org:member ?municipality ;
+      org:role <http://data.lblod.info/id/rollen/4ec7d5c39bdc4e84b4174379b9e22ad8> ;
+      ?p ?o .
+
+    # Find the other memberships with swapped organizations
+    ?correctMembership a org:Membership ;
+      org:organization ?municipality ;
+      org:member ?ocmw ;
+      org:role <http://data.lblod.info/id/rollen/4ec7d5c39bdc4e84b4174379b9e22ad8> .
+  }
+
+  GRAPH <http://mu.semte.ch/graphs/shared> {
+    ?municipality org:classification ?municipalityClassification .
+  }
+
+  GRAPH <http://mu.semte.ch/graphs/administrative-unit> {
+    ?ocmw org:classification ?ocmwClassification .
+  }
+
+  FILTER(?municipalityClassification = <http://data.vlaanderen.be/id/concept/BestuurseenheidClassificatieCode/5ab0e9b8a3b2ca7c5e000001>)
+  FILTER(?ocmwClassification = <http://data.vlaanderen.be/id/concept/BestuurseenheidClassificatieCode/5ab0e9b8a3b2ca7c5e000002>)
+}

config/migrations/2025/20250729143008-kbo-startDate-modified-date-to-dateTime.sparql

@@ -0,0 +1,28 @@
+DELETE {
+  GRAPH ?g {
+    ?s ?p ?date .
+  }
+}
+INSERT {
+  GRAPH ?g {
+    ?s ?p ?dateTime .
+  }
+}
+WHERE {
+  VALUES ?g {
+    <http://mu.semte.ch/graphs/administrative-unit>
+    <http://mu.semte.ch/graphs/worship-service>
+  }
+
+  GRAPH ?g {
+    ?s a <http://mu.semte.ch/vocabularies/ext/KboOrganisatie> ;
+       ?p ?date .
+
+    VALUES ?p {
+      <http://purl.org/dc/terms/modified>
+      <http://mu.semte.ch/vocabularies/ext/startDate>
+    }
+
+    BIND(STRDT(CONCAT(STR(?date), "T02:00:00"), xsd:dateTime) AS ?dateTime)
+  }
+}

config/migrations/2025/20250904115406-add-dashboard-admin-role-to-mock-abb-user.sparql

@@ -0,0 +1,17 @@
+PREFIX foaf: <http://xmlns.com/foaf/0.1/>
+PREFIX ext:<http://mu.semte.ch/vocabularies/ext/>
+
+INSERT {
+  GRAPH ?g {
+    ?account ext:sessionRole "LoketLB-AdminDashboardOrganisatiePortaalGebruiker" .
+  }
+}
+WHERE {
+  VALUES ?account {
+    <http://data.lblod.info/id/account/3a91ff60-07c1-4136-ac5e-55cf401e0956>
+  }
+
+  GRAPH ?g {
+    ?account ext:sessionRole ?role .
+  }
+}

config/resources/domain.json

@@ -945,7 +945,7 @@
         "located-within": {
           "predicate": "geo:sfWithin",
           "target": "locations",
-          "cardinality": "one"
+          "cardinality": "many"
         },
         "locations": {
           "predicate": "geo:sfWithin",

config/tlsproxy-mock/Caddyfile

@@ -1,4 +1,4 @@
-https://{$OP_ADDRESS} {
+https://{$APPLICATION_ADDRESS} {
   reverse_proxy identifier:80
   tls internal
 }

docker-compose.dev.yml

@@ -40,6 +40,8 @@ services:
     restart: "no"
   login:
     restart: "no"
+  login-dashboard:
+    restart: "no"
   accountdetail:
     restart: "no"
   privacy-unit:
@@ -50,6 +52,10 @@ services:
     restart: "no"
   frontend:
     restart: "no"
+  frontend-dashboard:
+    environment:
+      EMBER_LOGIN_ROUTE: "mock-login"
+    restart: "no"
   uri-info:
     restart: "no"
   delta-producer-background-jobs-initiator:
@@ -74,6 +80,8 @@ services:
     restart: "no"
   construct-organization-relationships:
     restart: "no"
+  scope-of-operation:
+    restart: "no"
   mandatarissen-consumer:
     restart: "no"
   leidinggevenden-consumer:

docker-compose.yml

@@ -122,7 +122,7 @@ services:
     restart: always
     logging: *default-logging
   sink:
-    image: nginx:1.15.2
+    image: nginx:1.25.1
     volumes:
       - ./config/sink/sink.conf:/etc/nginx/conf.d/default.conf
     labels:
@@ -130,7 +130,7 @@ services:
     restart: always
     logging: *default-logging
   login:
-    image: lblod/acmidm-login-service:0.9.2
+    image: lblod/acmidm-login-service:0.12.0
     environment:
       MU_APPLICATION_AUTH_USERID_CLAIM: "vo_id"
       MU_APPLICATION_GRAPH: "http://mu.semte.ch/graphs/contacthub/accounts"
@@ -145,14 +145,22 @@ services:
     logging: *default-logging
     links:
       - db:database
-  dashboard-login:
-    image: semtech/mu-login-service:3.0.0
-    links:
-      - db:database
+  login-dashboard:
+    image: lblod/acmidm-login-service:0.12.0
+    environment:
+      LOG_SINK_URL: "http://sink"
+      MU_APPLICATION_AUTH_ROLE_CLAIM: "abb_organisatieportaal_rol_2d"
+      MU_APPLICATION_AUTH_USERID_CLAIM: "vo_id"
+      MU_APPLICATION_AUTH_DISCOVERY_URL: "<ACM_IDM_AUTH_DISCOVERY_URL>"
+      MU_APPLICATION_AUTH_CLIENT_ID: "<ACM_IDM_AUTH_CLIENT_ID>"
+      MU_APPLICATION_AUTH_REDIRECT_URI: "<ACMIDM_AUTH_REDIRECT_URI>"
+      MU_APPLICATION_AUTH_CLIENT_SECRET: "<ACMIDM_AUTH_CLIENT_SECRET>"
     labels:
       - "logging=true"
     restart: always
     logging: *default-logging
+    links:
+      - db:database
   accountdetail:
     image: lblod/account-detail-service:0.1.0
     labels:
@@ -194,7 +202,7 @@ services:
     restart: always
     logging: *default-logging
   frontend:
-    image: lblod/frontend-organization-portal:1.33.0
+    image: lblod/frontend-organization-portal:1.34.1
     volumes:
       - ./config/frontend/add-x-frame-options-header.conf:/config/add-x-frame-options.conf
     environment:
@@ -209,7 +217,15 @@ services:
     restart: always
     logging: *default-logging
   frontend-dashboard:
-    image: lblod/frontend-dashboard:1.7.0
+    image: lblod/frontend-dashboard:1.10.0
+    environment:
+      EMBER_LOGIN_ROUTE: "acmidm-login"
+      EMBER_ACMIDM_CLIENT_ID: "<CLIENT_ID>"
+      EMBER_ACMIDM_BASE_URL: "<BASE_URL>"
+      EMBER_ACMIDM_REDIRECT_URL: "<REDIRECT_URL>"
+      EMBER_ACMIDM_LOGOUT_URL: "<LOGOUT_URL>"
+      EMBER_ACMIDM_SCOPE: "openid vo profile abb_organisatieportaal"
+      EMBER_ENGLISH_ACCOUNTS_MODEL: true
     labels:
       - "logging=true"
     restart: always
@@ -285,6 +301,14 @@ services:
       - "logging=true"
     restart: always
     logging: *default-logging
+  scope-of-operation:
+    image: lblod/scope-of-operation-service:0.1.1
+    links:
+      - db:database
+    labels:
+      - "logging=true"
+    restart: always
+    logging: *default-logging
   report-generation:
     image: lblod/loket-report-generation-service:0.8.3
     environment:
@@ -310,7 +334,7 @@ services:
     restart: always
     logging: *default-logging
   kbo-data-sync:
-    image: lblod/sync-wegwijs-organization-service:2.0.3
+    image: lblod/sync-wegwijs-organization-service:2.0.4
     links:
       - db:database
     labels:

scripts/project/config.json

@@ -17,6 +17,22 @@
         "app": "/app/"
       }
     },
+    {
+      "documentation": {
+        "command": "correct-location-labels",
+        "description": "generate migrations to correct the labels of aggregated locations",
+        "arguments": []
+      },
+      "environment": {
+        "image": "nvdk/ruby-semantic-works-cli",
+        "interactive": true,
+        "script": "correct-location-labels/run.rb",
+        "join_networks": true
+      },
+      "mounts": {
+        "app": "/app/"
+      }
+    },
     {
       "documentation": {
         "command": "mu-search-delta",
@@ -32,21 +48,6 @@
       "mounts": {
         "app": "/data/app/"
       }
-    },
-    {
-      "documentation": {
-        "command": "generate-dashboard-login",
-        "description": "generate a login account for the jobs dashboard",
-        "arguments": []
-      },
-      "environment": {
-        "image": "ruby",
-        "interactive": true,
-        "script": "generate-dashboard-login/run.sh"
-      },
-      "mounts": {
-        "app": "/project/"
-      }
     }
   ]
-}
+}

scripts/project/correct-location-labels/run.rb

@@ -0,0 +1,106 @@
+#!/usr/bin/env ruby
+require 'date'
+require 'rdf/turtle'
+require 'fileutils'
+
+$stdout.sync = true
+ENV['LOG_SPARQL_ALL']='false'
+ENV['MU_SPARQL_ENDPOINT']='http://triplestore:8890/sparql'
+ENV['MU_SPARQL_TIMEOUT']='180'
+require 'mu/auth-sudo'
+
+def ensure_dir(path)
+ unless Dir.exist?(path)
+   FileUtils.mkdir_p(path)
+ end
+end
+
+def sparql_escape_uri(value)
+  '<' + value.to_s.gsub(/[\\"<>]/) { |s| '\\' + s } + '>'
+end
+
+def sparql_escape_string(str)
+  '"""' + str.gsub(/[\\"]/) { |s| '\\' + s } + '"""'
+end
+
+def get_locations()
+  query = <<~EOF
+PREFIX prov: <http://www.w3.org/ns/prov#>
+PREFIX rdfs: <http://www.w3.org/2000/01/rdf-schema#>
+PREFIX ext: <http://mu.semte.ch/vocabularies/ext/>
+
+SELECT DISTINCT ?location ?label
+WHERE {
+  GRAPH <http://mu.semte.ch/graphs/public> {
+    ?location a prov:Location ;
+              rdfs:label ?label ;
+              ext:werkingsgebiedNiveau """Samengesteld werkingsgebied""" .
+  }
+}
+EOF
+  Mu::AuthSudo.query(query)
+end
+
+def sort_literal(literal)
+  literal
+    .humanize
+    .split(", ")
+    .sort
+    .join(", ")
+end
+
+# Create output directory
+timestamp=`date +%Y%0m%0d%0H%0M%0S`.strip.to_i
+output_dir = "/app/config/migrations/local/2025/#{timestamp}-correct-labels-aggregate-locations/"
+ensure_dir(output_dir)
+
+
+# Generate SPARQL migration to remove existing labels
+path = File.join(output_dir, "#{timestamp}-remove-labels-aggregate-locations.sparql")
+File.open(path, 'w') do |file|
+  file.write <<EOF
+PREFIX prov: <http://www.w3.org/ns/prov#>
+PREFIX rdfs: <http://www.w3.org/2000/01/rdf-schema#>
+PREFIX ext: <http://mu.semte.ch/vocabularies/ext/>
+
+DELETE {
+  GRAPH <http://mu.semte.ch/graphs/public> {
+    ?location rdfs:label ?label
+  }
+} WHERE {
+  GRAPH <http://mu.semte.ch/graphs/public> {
+    ?location a prov:Location ;
+              rdfs:label ?label ;
+              ext:werkingsgebiedNiveau """Samengesteld werkingsgebied""" .
+  }
+}
+EOF
+end
+
+
+# Generate TTL migration to insert alphabetically sorted labels
+timestamp += 1
+filename = "#{timestamp}-insert-labels-aggregate-locations"
+
+path = File.join(output_dir, "#{filename}.graph")
+File.open(path, 'w') do |file|
+  file.write <<EOF
+http://mu.semte.ch/graphs/public
+EOF
+end
+
+path = File.join(output_dir, "#{filename}.ttl")
+File.open(path, 'w') do |file|
+  file.write <<EOF
+@prefix rdfs: <http://www.w3.org/2000/01/rdf-schema#> .
+EOF
+end
+
+locations = get_locations()
+locations.each do |location|
+  File.open(path, 'a') do |file|
+    file.write <<EOF
+    #{sparql_escape_uri(location[:location])} rdfs:label "#{(sort_literal(location[:label]))}" .
+EOF
+  end
+end

scripts/project/generate-dashboard-login/run.sh

@@ -1,80 +0,0 @@
-#!/usr/bin/env ruby
-require 'bundler/inline'
-require 'yaml'
-require 'securerandom'
-require 'date'
-
-$stdout.sync = true
-print "installing dependencies..."
-gemfile do
-  source 'https://rubygems.org'
-  gem 'bcrypt'
-end
-puts "done"
-
-salt = ""
-begin
-  File.open("/project/docker-compose.override.yml") do |file|
-    config = YAML.load(file)
-    salt = config.dig("services", "dashboard-login", "environment", "MU_APPLICATION_SALT")
-    throw "invalid salt" unless salt
-   end
-rescue
-  puts "Tried to locate login salt in docker-compose.override.yml, but couldn't find it."
-  puts "Please make sure a salt is configured:"
-  puts <<EOF
-  login:
-    restart: "no"
-    environment:
-      MU_APPLICATION_SALT: "#{SecureRandom.hex}"
-EOF
-end
-
-puts "this script will generate a new user account"
-print "username: "
-STDOUT.flush
-account_name = STDIN.gets.chomp
-
-print "password: "
-STDOUT.flush
-password = STDIN.gets.chomp
-
-account_salt = SecureRandom.hex
-person_uuid = SecureRandom.uuid
-account_uuid = SecureRandom.uuid
-domain = "data.gift"
-hashed_password = BCrypt::Password.create(password + salt + account_salt)
-now = DateTime.now.xmlschema
-query = %(
-PREFIX foaf: <http://xmlns.com/foaf/0.1/>
-PREFIX people: <http://#{domain}/people/>
-PREFIX accounts: <http://#{domain}/accounts/>
-PREFIX dcterms: <http://purl.org/dc/terms/>
-PREFIX mu:      <http://mu.semte.ch/vocabularies/core/>
-PREFIX ext:      <http://mu.semte.ch/vocabularies/ext/>
-PREFIX account: <http://mu.semte.ch/vocabularies/account/>
-PREFIX xsd: <http://www.w3.org/2001/XMLSchema#>
-INSERT DATA {
-   GRAPH <http://mu.semte.ch/application> {
-     people:#{person_uuid} a foaf:Person ;
-                   foaf:name "#{account_name}";
-                   foaf:account accounts:#{account_uuid};
-                   mu:uuid "#{person_uuid}";
-                   dcterms:created "#{now}"^^xsd:datetime;
-                   dcterms:modified "#{now}"^^xsd:datetime.
-     accounts:#{account_uuid} a foaf:OnlineAccount;
-                                                   foaf:accountName "#{account_name}";
-                                                   mu:uuid "#{account_uuid}";
-                                                   account:password """#{hashed_password}""";
-                                                   account:salt "#{account_salt}";
-                                                   account:status <http://mu.semte.ch/vocabularies/account/status/active>;
-                                                   dcterms:created "#{now}"^^xsd:datetime;
-                                                   ext:sessionRole "dashboard-user";
-                                                   dcterms:modified "#{now}"^^xsd:datetime.
-}}
-)
-
-timestamp = DateTime.now.strftime("%Y%m%d%H%M%L")
-filename = "#{timestamp}-create-user-#{account_name.gsub(" ", "-")}.sparql"
-File.write("/project/config/migrations/local/#{filename}", query)
-puts "generated migration ./config/migrations/local/#{filename} for #{account_name.inspect} : #{password.inspect}"