Release v1.35.2

CHANGELOG.md

@@ -1,52 +1,10 @@
 # Changelog
-
-## 1.36.0 (2025-10-03)
-### Dashboard
-- Enable ACM/IDM for the dashboard [OP-3674]
-
-#### QA
-Configure the environment variables for the QA ACM/IDM environment:
-
-```yml
-  frontend-dashboard:
-    environment:
-      EMBER_ACMIDM_CLIENT_ID: "03382bf4-4886-4fb6-8602-945ad3080a7a"
-      EMBER_ACMIDM_BASE_URL: "https://authenticatie-ti.vlaanderen.be/op/v1/auth"
-      EMBER_ACMIDM_REDIRECT_URL: "https://dashboard.organisaties.abb.lblod.info/authorization/callback"
-      EMBER_ACMIDM_LOGOUT_URL: "https://authenticatie-ti.vlaanderen.be/op/v1/logout"
-      EMBER_ACMIDM_SCOPE: "openid vo profile abb_organisatieportaal"
-
-  login-dashboard:
-    environment:
-      MU_APPLICATION_AUTH_DISCOVERY_URL: "https://authenticatie-ti.vlaanderen.be/op"
-      MU_APPLICATION_AUTH_CLIENT_ID: "03382bf4-4886-4fb6-8602-945ad3080a7a"
-      MU_APPLICATION_AUTH_REDIRECT_URI: "https://dashboard.organisaties.abb.lblod.info/authorization/callback"
-      MU_APPLICATION_AUTH_CLIENT_SECRET: "snip" # see ticket for secret
-
-```
-
-Link the new domain name to QA (and remove from dev)
-
-#### PROD
-Configure the environment variables for the PROD ACM/IDM environment once the values are known.
-
-Link the new domain name to PROD + DNS config to the server
-
-#### CLI
-```
-drc restart migrations
-drc restart dispatcher database
-drc up -d --remove-orphans
-```
-
-### Frontend
-- Bump to [v1.34.1](https://github.com/lblod/frontend-organization-portal/releases/tag/v1.34.1) [OP-3638]
-- Remove province for addresses in the Brussels area [OP-3638] & [OP-3648]
-
+## v1.35.2 (2025-11-04)
+### Backend
+- Fix camel case name of municipality Heist-op-den-Berg in addresses [OP-3694]
 ### Deploy notes
 ```
-drc pull frontend; drc up -d frontend
-drc restart migrations-triggering-indexing; drc logs -ft --tail=200 migrations-triggering-indexing
+drc restart migrations-triggering-indexing
 ```
 
 ## v1.35.1 (2025-09-15)
@@ -69,7 +27,6 @@ drc restart delta-producer-publication-graph-maintainer
 - datafix: cleanup of duplicate memberships [OP-3634]
 - Fix KBO organizations' date formats [OP-3560]
 
-
 ### Deploy notes
 ```
 drc pull scope-of-operation; drc up -d scope-of-operation

README.md

@@ -185,3 +185,26 @@ To make sure the app can share data, producers need to be set up. There is an in
        )
      }
 ```
+
+## Configuring the dashboard
+### Accessing the dashboard from your local machine
+
+Since we use dispatcher v2, which dispatches on hostname, we'll have to update `/etc/hosts`.
+Add an entry similar to the following. Ensure the first part of the domain starts with `dashboard`.:
+
+```
+127.0.0.1 dashboard.localhost
+```
+
+### Creating new users
+For now, we use specific logins for the dashboard users. Each environment has its own passwords.
+
+To add a user, make sure to have [mu-cli](https://github.com/mu-semtech/mu-cli) installed first.
+Then in `docker-compose.override.yml`
+```
+  dashboard-login:
+    environment:
+      MU_APPLICATION_SALT: 'a_random_string_with_sufficient_entropy_hence_not_this_one'
+```
+You can now generate a user by running `mu script project-scripts generate-dashboard-login` and following the steps.
+Restart `migrations` and it should insert the new user into the database.

config/authorization/config.ex

@@ -111,9 +111,11 @@ defmodule Acl.UserGroups.Config do
     %AccessByQuery{
       vars: [],
       query: "PREFIX ext: <http://mu.semte.ch/vocabularies/ext/>
-        SELECT DISTINCT ?session WHERE {
-          VALUES ?session { <SESSION_ID> }
-          ?session ext:sessionRole \"LoketLB-AdminDashboardOrganisatiePortaalGebruiker\" .
+        PREFIX mu: <http://mu.semte.ch/vocabularies/core/>
+        SELECT DISTINCT ?account WHERE {
+          <SESSION_ID> <http://mu.semte.ch/vocabularies/session/account> ?account.
+          ?account <http://mu.semte.ch/vocabularies/ext/sessionRole> ?session_role.
+          FILTER( ?session_role = \"dashboard-user\" )
         }"
     }
   end
@@ -217,10 +219,10 @@ defmodule Acl.UserGroups.Config do
           }
         ]
       },
-      # // Dashboard admin
+      # // dashboard users
       %GroupSpec{
-        name: "o-admin-rwf",
-        useage: [:read, :write, :read_for_write],
+        name: "dashboard-users",
+        useage: [:read],
         access: can_access_dashboard(),
         graphs: [
           %GraphSpec{

config/dispatcher/dispatcher.ex

@@ -306,7 +306,7 @@ defmodule Dispatcher do
   end
 
   match "/sessions/*path", %{ reverse_host: ["dashboard" | _rest] } do
-    Proxy.forward conn, path, "http://login-dashboard/sessions/"
+    Proxy.forward conn, path, "http://dashboard-login/sessions/"
   end
 
   match "/sessions/*path", %{accept: [:any], layer: :api} do

config/migrations-triggering-indexing/2025/20250703095300-remove-province-for-addresses-in-brussels-gewest.sparql

@@ -1,38 +0,0 @@
-DELETE {
-  GRAPH <http://mu.semte.ch/graphs/worship-service> {
-    ?s <http://www.w3.org/ns/locn#adminUnitL2> ?province ;
-      <https://data.vlaanderen.be/ns/adres#adresIsGelegenIn> ?werkingsgebied .
-  }
-} WHERE {
-  GRAPH <http://mu.semte.ch/graphs/worship-service> {
-    VALUES ?postCode {
-      "1070"
-      "1000"
-      "1020"
-      "1120"
-      "1130"
-      "1050"
-      "1040"
-      "1140"
-      "1083"
-      "1090"
-      "1081"
-      "1160"
-      "1030"
-      "1082"
-      "1060"
-      "1080"
-      "1210"
-      "1200"
-      "1150"
-      "1180"
-      "1190"
-      "1170"
-    }
-
-    ?s a <http://www.w3.org/ns/locn#Address> ;
-      <http://www.w3.org/ns/locn#postCode> ?postCode ;
-      <http://www.w3.org/ns/locn#adminUnitL2> ?province ;
-      <https://data.vlaanderen.be/ns/adres#adresIsGelegenIn> ?werkingsgebied .
-  }
-}

config/migrations-triggering-indexing/2025/20251103152500-fix-camel-case-municipality-in-addresses.sparql

@@ -0,0 +1,16 @@
+DELETE {
+  GRAPH <http://mu.semte.ch/graphs/worship-service> {
+    ?s a <http://www.w3.org/ns/locn#Address> ;
+      <https://data.vlaanderen.be/ns/adres#gemeentenaam> "Heist-Op-Den-Berg" .
+  }
+} INSERT {
+  GRAPH <http://mu.semte.ch/graphs/worship-service> {
+    ?s a <http://www.w3.org/ns/locn#Address> ;
+      <https://data.vlaanderen.be/ns/adres#gemeentenaam> "Heist-op-den-Berg" .
+  }
+} WHERE {
+  GRAPH <http://mu.semte.ch/graphs/worship-service> {
+    ?s a <http://www.w3.org/ns/locn#Address> ;
+      <https://data.vlaanderen.be/ns/adres#gemeentenaam> "Heist-Op-Den-Berg" .
+  }
+}

config/migrations/2025/20250904115406-add-dashboard-admin-role-to-mock-abb-user.sparql

@@ -1,17 +0,0 @@
-PREFIX foaf: <http://xmlns.com/foaf/0.1/>
-PREFIX ext:<http://mu.semte.ch/vocabularies/ext/>
-
-INSERT {
-  GRAPH ?g {
-    ?account ext:sessionRole "LoketLB-AdminDashboardOrganisatiePortaalGebruiker" .
-  }
-}
-WHERE {
-  VALUES ?account {
-    <http://data.lblod.info/id/account/3a91ff60-07c1-4136-ac5e-55cf401e0956>
-  }
-
-  GRAPH ?g {
-    ?account ext:sessionRole ?role .
-  }
-}

config/tlsproxy-mock/Caddyfile

@@ -1,4 +1,4 @@
-https://{$APPLICATION_ADDRESS} {
+https://{$OP_ADDRESS} {
   reverse_proxy identifier:80
   tls internal
 }

docker-compose.dev.yml

@@ -40,8 +40,6 @@ services:
     restart: "no"
   login:
     restart: "no"
-  login-dashboard:
-    restart: "no"
   accountdetail:
     restart: "no"
   privacy-unit:
@@ -52,10 +50,6 @@ services:
     restart: "no"
   frontend:
     restart: "no"
-  frontend-dashboard:
-    environment:
-      EMBER_LOGIN_ROUTE: "mock-login"
-    restart: "no"
   uri-info:
     restart: "no"
   delta-producer-background-jobs-initiator:

docker-compose.yml

@@ -122,7 +122,7 @@ services:
     restart: always
     logging: *default-logging
   sink:
-    image: nginx:1.25.1
+    image: nginx:1.15.2
     volumes:
       - ./config/sink/sink.conf:/etc/nginx/conf.d/default.conf
     labels:
@@ -130,7 +130,7 @@ services:
     restart: always
     logging: *default-logging
   login:
-    image: lblod/acmidm-login-service:0.12.0
+    image: lblod/acmidm-login-service:0.9.2
     environment:
       MU_APPLICATION_AUTH_USERID_CLAIM: "vo_id"
       MU_APPLICATION_GRAPH: "http://mu.semte.ch/graphs/contacthub/accounts"
@@ -145,22 +145,14 @@ services:
     logging: *default-logging
     links:
       - db:database
-  login-dashboard:
-    image: lblod/acmidm-login-service:0.12.0
-    environment:
-      LOG_SINK_URL: "http://sink"
-      MU_APPLICATION_AUTH_ROLE_CLAIM: "abb_organisatieportaal_rol_2d"
-      MU_APPLICATION_AUTH_USERID_CLAIM: "vo_id"
-      MU_APPLICATION_AUTH_DISCOVERY_URL: "<ACM_IDM_AUTH_DISCOVERY_URL>"
-      MU_APPLICATION_AUTH_CLIENT_ID: "<ACM_IDM_AUTH_CLIENT_ID>"
-      MU_APPLICATION_AUTH_REDIRECT_URI: "<ACMIDM_AUTH_REDIRECT_URI>"
-      MU_APPLICATION_AUTH_CLIENT_SECRET: "<ACMIDM_AUTH_CLIENT_SECRET>"
+  dashboard-login:
+    image: semtech/mu-login-service:3.0.0
+    links:
+      - db:database
     labels:
       - "logging=true"
     restart: always
     logging: *default-logging
-    links:
-      - db:database
   accountdetail:
     image: lblod/account-detail-service:0.1.0
     labels:
@@ -202,7 +194,7 @@ services:
     restart: always
     logging: *default-logging
   frontend:
-    image: lblod/frontend-organization-portal:1.34.1
+    image: lblod/frontend-organization-portal:1.34.0
     volumes:
       - ./config/frontend/add-x-frame-options-header.conf:/config/add-x-frame-options.conf
     environment:
@@ -217,15 +209,7 @@ services:
     restart: always
     logging: *default-logging
   frontend-dashboard:
-    image: lblod/frontend-dashboard:1.10.0
-    environment:
-      EMBER_LOGIN_ROUTE: "acmidm-login"
-      EMBER_ACMIDM_CLIENT_ID: "<CLIENT_ID>"
-      EMBER_ACMIDM_BASE_URL: "<BASE_URL>"
-      EMBER_ACMIDM_REDIRECT_URL: "<REDIRECT_URL>"
-      EMBER_ACMIDM_LOGOUT_URL: "<LOGOUT_URL>"
-      EMBER_ACMIDM_SCOPE: "openid vo profile abb_organisatieportaal"
-      EMBER_ENGLISH_ACCOUNTS_MODEL: true
+    image: lblod/frontend-dashboard:1.7.0
     labels:
       - "logging=true"
     restart: always

scripts/project/config.json

@@ -48,6 +48,21 @@
       "mounts": {
         "app": "/data/app/"
       }
+    },
+    {
+      "documentation": {
+        "command": "generate-dashboard-login",
+        "description": "generate a login account for the jobs dashboard",
+        "arguments": []
+      },
+      "environment": {
+        "image": "ruby",
+        "interactive": true,
+        "script": "generate-dashboard-login/run.sh"
+      },
+      "mounts": {
+        "app": "/project/"
+      }
     }
   ]
-}
+}

scripts/project/generate-dashboard-login/run.sh

@@ -0,0 +1,80 @@
+#!/usr/bin/env ruby
+require 'bundler/inline'
+require 'yaml'
+require 'securerandom'
+require 'date'
+
+$stdout.sync = true
+print "installing dependencies..."
+gemfile do
+  source 'https://rubygems.org'
+  gem 'bcrypt'
+end
+puts "done"
+
+salt = ""
+begin
+  File.open("/project/docker-compose.override.yml") do |file|
+    config = YAML.load(file)
+    salt = config.dig("services", "dashboard-login", "environment", "MU_APPLICATION_SALT")
+    throw "invalid salt" unless salt
+   end
+rescue
+  puts "Tried to locate login salt in docker-compose.override.yml, but couldn't find it."
+  puts "Please make sure a salt is configured:"
+  puts <<EOF
+  login:
+    restart: "no"
+    environment:
+      MU_APPLICATION_SALT: "#{SecureRandom.hex}"
+EOF
+end
+
+puts "this script will generate a new user account"
+print "username: "
+STDOUT.flush
+account_name = STDIN.gets.chomp
+
+print "password: "
+STDOUT.flush
+password = STDIN.gets.chomp
+
+account_salt = SecureRandom.hex
+person_uuid = SecureRandom.uuid
+account_uuid = SecureRandom.uuid
+domain = "data.gift"
+hashed_password = BCrypt::Password.create(password + salt + account_salt)
+now = DateTime.now.xmlschema
+query = %(
+PREFIX foaf: <http://xmlns.com/foaf/0.1/>
+PREFIX people: <http://#{domain}/people/>
+PREFIX accounts: <http://#{domain}/accounts/>
+PREFIX dcterms: <http://purl.org/dc/terms/>
+PREFIX mu:      <http://mu.semte.ch/vocabularies/core/>
+PREFIX ext:      <http://mu.semte.ch/vocabularies/ext/>
+PREFIX account: <http://mu.semte.ch/vocabularies/account/>
+PREFIX xsd: <http://www.w3.org/2001/XMLSchema#>
+INSERT DATA {
+   GRAPH <http://mu.semte.ch/application> {
+     people:#{person_uuid} a foaf:Person ;
+                   foaf:name "#{account_name}";
+                   foaf:account accounts:#{account_uuid};
+                   mu:uuid "#{person_uuid}";
+                   dcterms:created "#{now}"^^xsd:datetime;
+                   dcterms:modified "#{now}"^^xsd:datetime.
+     accounts:#{account_uuid} a foaf:OnlineAccount;
+                                                   foaf:accountName "#{account_name}";
+                                                   mu:uuid "#{account_uuid}";
+                                                   account:password """#{hashed_password}""";
+                                                   account:salt "#{account_salt}";
+                                                   account:status <http://mu.semte.ch/vocabularies/account/status/active>;
+                                                   dcterms:created "#{now}"^^xsd:datetime;
+                                                   ext:sessionRole "dashboard-user";
+                                                   dcterms:modified "#{now}"^^xsd:datetime.
+}}
+)
+
+timestamp = DateTime.now.strftime("%Y%m%d%H%M%L")
+filename = "#{timestamp}-create-user-#{account_name.gsub(" ", "-")}.sparql"
+File.write("/project/config/migrations/local/#{filename}", query)
+puts "generated migration ./config/migrations/local/#{filename} for #{account_name.inspect} : #{password.inspect}"