Remove not valid data

# pesp_capif_backoffice_backend

This repo contains backoffice backend.

The purpose of this backoffice is to operate on the CAPIF resources (Invokers/ Provider and associated resources) being able to perform listing and deletion operations on them.

This repository contains the OpenCAPIF Backoffice Backend service.

Its purpose is to manage OpenCAPIF resources (Invokers, Providers, APIs, and Users), including listing, filtering, and deletion operations, plus authentication and configuration management endpoints.

## Prerequisites

You need to have a full CAPIF instance running (check this link https://github.com/Telefonica/CAPIF_Future_Network_Lab.git)

To execute operations on CAPIF it is necessary to have certificates issued by CAPIF. This certiticate is automaticatically generated when you start the application.

- A running OpenCAPIF environment. OpenCAPIF repository: https://labs.etsi.org/rep/ocf/capif

- Docker version with integrated Compose V2 support (docker compose command), Docker Engine 20.10+ recommended.

- An existing external Docker network named capif-network (or set CAPIF_NETWORK_NAME in your environment before running Compose).

- Connectivity from the backend container to OpenCAPIF core services (capifcore, register, vault).

Notes:

- The container publishes backend port 8080 as host port 8085.

- Certificates are generated/loaded at startup and stored in the newcerts folder inside the container.

- Even when deploying OpenCAPIF, you should ensure local name resolution for capifcore, register, and vault in /etc/hosts based on your OpenCAPIF deployment configuration. This is required both to reach the services and to avoid certificate validation issues.

- If you use the default local OpenCAPIF deployment, no value changes are usually needed.

- If any of those service names are changed in your OpenCAPIF deployment, you must update docker-compose.yml accordingly (for example CAPIF_HOSTNAME, REGISTER_HOSTNAME, VAULT_HOSTNAME, and extra_hosts). This will be improved in future versions.

Example /etc/hosts entries for a default local setup:

```text

127.0.0.1 capifcore

127.0.0.1 register

127.0.0.1 vault

```

## How to launch the backend

## Run and Deploy Locally

To run using docker and docker compose, version 2.10 or higher, you must ensure you have that tools installed at your machine.

Use the provided scripts from the repository root:

```bash

./run.sh

```

docker-compose up -d

What run.sh does:

- Sets DOCKER_DEFAULT_PLATFORM=linux/amd64.

- Executes docker compose up --build --detach.

- Builds the backend image if needed and starts the service in detached mode.

Default local base URL:

```text

http://localhost:8085/api

```

## Clean Local Deployment

To stop and clean the local deployment:

```bash

./clean.sh

```

## Endpoint routes

What clean.sh does:

- Sets DOCKER_DEFAULT_PLATFORM=linux/amd64.

- Executes docker compose down --rmi all.

- Stops containers and removes related images created by this Compose stack.

## Local Image Build and Tag (Work in Progress)

Script:

```bash

./local_build.sh

```

http://<hostname>:<port>/login

http://<hostname>:<port>/refresh

http://<hostname>:<port>/auth/me

http://<hostname>:<port>/resources/invokers

http://<hostname>:<port>/resources/numInvokers

http://<hostname>:<port>/resources/providers

http://<hostname>:<port>/resources/numProviders

http://<hostname>:<port>/resources/security/<invoker_id>

http://<hostname>:<port>/events/<invoker_id>

http://<hostname>:<port>/resources/providers/services/<id>

http://<hostname>:<port>/resources/users

http://<hostname>:<port>/resources/users/<user_id>

http://<hostname>:<port>/resources/users/numUsers

http://<hostname>:<port>/invokers/<invoker_id>

http://<hostname>:<port>/resources/<provider_id>

Current behavior:

- Builds the backend image with Docker Compose.

- Creates a version tag for the image:

    - Source image: labs.etsi.org:5050/ocf/capif/backoffice-backend

    - Target tag pattern: labs.etsi.org:5050/ocf/capif/backoffice-backend:v1.0.X

Important:

- This script is currently under development.

- Version discovery from remote registry is not active yet (LAST_VERSION is currently hardcoded).

- Push logic is commented out, so the script does not publish images to a registry.

## Authentication

- Login endpoint currently validates fixed credentials (superadmin/admin).

- POST /api/login returns access_token and refresh_token.

- Most endpoints require a Bearer access token in the Authorization header.

- POST /api/refresh requires a valid refresh token.

## API Endpoints

Base URL:

```text

http://<hostname>:8085/api

```

## Current state and work in progress

### Auth

- POST /api/login

- POST /api/refresh

- GET /api/auth/me

### Events and Monitoring

- GET /api/events/{id}

- GET /api/grafana

- GET /api/refreshgrafana

### Invokers

- GET /api/invokers/

- DELETE /api/invokers/

- GET /api/invokers/total

- GET /api/invokers/invokersTotal

- GET /api/invokers/alone?invoker_id={invoker_id}

- GET /api/invokers/security?invoker_id={invoker_id}

- GET /api/invokers/security/all

- GET /api/invokers/user?uuid={user_uuid}

- GET /api/invokers/numInvokers

### Providers

- GET /api/providers/

- DELETE /api/providers/

- GET /api/providers/alone?api_prov_dom_id={provider_id}

- GET /api/providers/user?uuid={user_uuid}

- GET /api/providers/providersTotal

- GET /api/providers/numProviders

### APIs

- GET /api/apis/

- DELETE /api/apis/

- GET /api/apis/alone?api_id={api_id}

- GET /api/apis/provider?apf_id={provider_id}

- GET /api/apis/apisTotal

- GET /api/apis/num

### Users

- GET /api/users/

- POST /api/users/

- DELETE /api/users/

- GET /api/users/info?uuid={user_uuid}

- GET /api/users/numUsers

- GET /api/users/users

### Configuration

- GET /api/configuration

- PATCH /api/configuration/update-param

- PUT /api/configuration/replace-config

- POST /api/configuration/add-category

- PATCH /api/configuration/add-config-setting

- DELETE /api/configuration/remove-config-param

- DELETE /api/configuration/remove-config-category

### Register Configuration

- GET /api/configuration/register

- PATCH /api/configuration/register/update-param

- PUT /api/configuration/register/replace-config

- POST /api/configuration/register/add-category-config

- PATCH /api/configuration/register/add-config-param-setting

- DELETE /api/configuration/register/remove-config-param

- DELETE /api/configuration/register/remove-config-category

## Current Status

1. Current Features

    - List of Invokers registered in CAPIF

    - List of Provider registered in CAPIF

    - List of Services registered in CAPIF by providers

    - Provide Tokens and Refresh Tokens

Implemented:

- Authentication with access and refresh JWT tokens.

- Resource management for Invokers, Providers, APIs, and Users.

- Configuration and Register configuration management endpoints.

2. Pending Features

    - Events Subscriptions

    - Manage security context

    - Refresh tokens

In progress:

- local_build.sh version automation and registry push flow.

- Hardening/improving authentication and credential management.

#!/bin/bash

set -e  # Detener la ejecución si ocurre un error

# Función para manejar errores

handle_error() {

    echo "Error en el script. Línea: $1"

    exit 1

}

# Capturar errores y llamar a la función handle_error

trap 'handle_error $LINENO' ERR

# Obtener la última versión desde ECR usando AWS CLI

LAST_VERSION=$(aws ecr-public describe-image-tags --repository-name opencapif/backoffice-backend --region us-east-1 --query 'imageTagDetails[*].imageTag' --output text | grep -Eo 'v3.1.[0-9]+' | sed 's/v3.1.//' | sort -n | tail -1)

if [ -z "$LAST_VERSION" ]; then

    echo "No se pudo obtener la última versión desde ECR. Verifica si el repositorio o las imágenes existen."

    exit 1

fi

# Incrementar la versión

NEW_VERSION=$((LAST_VERSION + 1))

echo "Nueva versión: v3.1.$NEW_VERSION"

# Establecer la plataforma y construir la imagen Docker

echo "Construyendo la imagen Docker..."

DOCKER_DEFAULT_PLATFORM=linux/amd64 docker-compose build || { echo "Error en la construcción de la imagen Docker."; exit 1; }

# Pedir al usuario el ARN de MFA

read -p "Introduce el ID de cuenta de AWS (ej. 230672794366): " AWS_ACCOUNT_ID

read -p "Introduce el nombre del dispositivo MFA (ej. google_authenticator_phone): " MFA_DEVICE

MFA_ARN="arn:aws:iam::$AWS_ACCOUNT_ID:mfa/$MFA_DEVICE"

# Autenticación MFA con AWS para obtener un token temporal

read -p "Introduce el código MFA de 6 dígitos: " MFA_CODE

# Obtener un token temporal usando MFA

echo "Autenticando con AWS usando MFA..."

TEMP_CREDS=$(aws sts get-session-token --serial-number "$MFA_ARN" --token-code "$MFA_CODE" --output json)

if [ -z "$TEMP_CREDS" ]; then

    echo "Error: No se pudo obtener el token temporal de AWS. Verifica el código MFA."

    exit 1

fi

# Exportar credenciales temporales

export AWS_ACCESS_KEY_ID=$(echo "$TEMP_CREDS" | jq -r '.Credentials.AccessKeyId')

export AWS_SECRET_ACCESS_KEY=$(echo "$TEMP_CREDS" | jq -r '.Credentials.SecretAccessKey')

export AWS_SESSION_TOKEN=$(echo "$TEMP_CREDS" | jq -r '.Credentials.SessionToken')

# Autenticar Docker con Amazon ECR Public

aws ecr-public get-login-password --region us-east-1 | docker login --username AWS --password-stdin public.ecr.aws/o2v4a8t6 || { echo "Error en la autenticación con Docker."; exit 1; }

# Taggear la imagen con la nueva versión

echo "Etiquetando la imagen Docker..."

docker tag pesp_capif_backoffice_backend-backoffice_microservice public.ecr.aws/o2v4a8t6/opencapif/backoffice-backend:v3.1.$NEW_VERSION || { echo "Error al etiquetar la imagen Docker."; exit 1; }

# Push de la imagen con la nueva versión

echo "Pushing la nueva imagen a ECR..."

docker push public.ecr.aws/o2v4a8t6/opencapif/backoffice-backend:v3.1.$NEW_VERSION || { echo "Error al hacer push de la imagen Docker."; exit 1; }

# Mostrar la nueva versión

echo "Nueva imagen subida correctamente: public.ecr.aws/o2v4a8t6/opencapif/backoffice-backend:v3.1.$NEW_VERSION"

# Mostrar la nueva versión

echo "Nueva imagen subida correctamente: public.ecr.aws/o2v4a8t6/opencapif/backoffice-backend:v3.1.$NEW_VERSION"

# Tag a desplegar

echo "Backend tag a desplegar: v3.1.$NEW_VERSION"

 No newline at end of file

WORKDIR /usr/src/app

COPY requirements.txt /usr/src/app/requirements.txt

# COPY backoffice_service/certs2/ca_root.crt /etc/ssl/certs/

# COPY backoffice_service/certs2/superadmin.crt /etc/ssl/certs/

# COPY backoffice_service/certs2/superadmin.key /etc/ssl/private/

RUN apk add -U --no-cache gcc build-base linux-headers ca-certificates libffi-dev libressl-dev libxslt-dev

RUN pip3 install --upgrade --no-cache-dir -r requirements.txt

RUN apk add curl

RUN apk add redis

# # Copiar el script generate_certs.py

# COPY backoffice_service/generate_certs.py /usr/src/app/generate_certs.py

COPY . /usr/src/app

EXPOSE 8080

-----BEGIN CERTIFICATE REQUEST-----

MIIC1DCCAbwCAQAwgY4xCzAJBgNVBAYTAkVTMQ8wDQYDVQQIDAZNYWRyaWQxDzAN

BgNVBAcMBk1hZHJpZDEXMBUGA1UECgwOVGVsZWZvbmljYSBJK0QxEzARBgNVBAsM

Cklubm92YXRpb24xEzARBgNVBAMMCnN1cGVyYWRtaW4xGjAYBgkqhkiG9w0BCQEW

C2lubm9AdGlkLmVzMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA0s8i

rsXx6DGmaEfRIZGQ+j6Ho0ZFzKi3qG6CCaEREWMnzbq9lBwCCK/poDyR0MHtgHXA

/4Wn4/NBZxdvG04ZWJ92ZZC4hl9fZjpDQgKWv85NrF5A/QtfUXfGbEOsKMQF/U4b

a36r1wvUvuH0jHXpz0OU18oVomJLUe8YXhbuLzg8aKmswLuq9c+KA1K3P6HbgIO0

YnwF2YpWce8O1BVhzetPT3SBFd1sb6qUQumT+hIk9VYVOLUmrwYrkdn4LV4SYVzx

V9LdDvpCYpnCjIBBwoFzPyMyLKE2QXKthT2ZH1D3jmrk9bR6KxXiEQs3fj5z5A/S

kRo6/l+JLfTaVtbT/wIDAQABoAAwDQYJKoZIhvcNAQELBQADggEBALaTOmzWdM1r

KDVU19VSYVqhu08FgmdSduwv+bUe/Ae1ktglQrzsYnA/YbAHG5llkmIhdPxQkipx

Bul27sbnpKtIcCCn8VY7S/JuCbjTqEIOxR4SgdaMNjVEYbGwsmHgH0dl1ykPmZNy

9uNz8Q5/jbZw9HGEBSPDefgzvzARaaqa4d3AS2lHSlKNFoAil9ioV9FHeL6xkhAl

TJr0ulf8JhwMBX9GfdIwxqCzLyZi2iYTY4X0J66Lf88BvLz4/7yl5Re79lCXkZ2Y

g9Kp29ES8iuOUiXMRqVq947R+1hCJ5JaqZZ7op3pX64vhKKBqIe/wbOgFocCDz+9

+e6rij51JoA=

-----END CERTIFICATE REQUEST-----

-----BEGIN CERTIFICATE-----

MIIDRzCCAi+gAwIBAgIUW3WwxdfTKGZRKdPPoiZmY/rVa+IwDQYJKoZIhvcNAQEL

BQAwMzETMBEGA1UEAwwKYmFja29mZmljZTELMAkGA1UEBhMCRVMxDzANBgNVBAcM

Bk1hZHJpZDAeFw0yMzEwMDkxMzU5NDZaFw0yNDA5MjkxMzU5NDZaMDMxEzARBgNV

BAMMCmJhY2tvZmZpY2UxCzAJBgNVBAYTAkVTMQ8wDQYDVQQHDAZNYWRyaWQwggEi

MA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQC8dv1UUdxUS2N5kycAkhEJdEZj

fmjmrIzd1bKLyaIRe3mFhab55RuvFv/rLEtPhB/VmZSPOzWNXHW4sMak/LYmNrny

shsjB9V9a9ER28P4EGv/4DxJy9OaZQcqYNZO9YWclZGL6/plWm+Ays3fNHOR9N3B

AzOFDzTlcnmFddLfkTMvg+rwsBmy8sBuZA0YVgRfZPJVVqBDq+/AsPuqreas/tSf

7K+kDhIqXpy+BTuh3GthW5Q1QS8w40hNOViICDkX+6DnnFudWc5PyQnmbdPlIWhD

26vIxCs/BzeKYAorinpcFisDz8ZW6OxA7dRLZafUwSs/C3XYEHuMp+fbUc3LAgMB

AAGjUzBRMB0GA1UdDgQWBBTIlNvVtIAGaC11c9aXZxxCi/w+9zAfBgNVHSMEGDAW

gBTIlNvVtIAGaC11c9aXZxxCi/w+9zAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3

DQEBCwUAA4IBAQB0Pzg5LLoe/LnCOjOYQAooUhPKvr2bwBiG5NjwX4Eghstv8hvN

rsEeS4P7ykEaFyB+t7ivXZsGWzE1M+F5IPtdl5o57T19n+5nvhQ3Kd7kd3X45UeG

b4UdXl+M4e1bIJJVs5dxYQntBtXkGue8bMmGSZILevSk/LBPNZ/OO/tc2O6RKqJt

4HcRDyTdGve1QNpAu/H343sFNr7ACLEu5CRRUE0RzdBvrHj3YuCkpkJ8XUskegXU

FfqZtgQJFHZVZFN7duXJ2eO1Vn9b93NYg8vX/NnevJPuDrRJSMLZFs7DQIzY/kh5

EI3oMNh5ghJSztwAVQPBZxX+VVTF6ulJxlJ8

-----END CERTIFICATE-----