Merge branch 'develop' into 'main' (3791fb06) · Commits · OOP / code / federation-manager

Dockerfile

+3 −2

Changes for Dockerfile: 3 added lines, 2 removed lines.
Original line number	Diff line number	Diff line
		@@ -32,5 +32,6 @@ FROM python:3.12-slim
		COPY --from=build /install /usr/local
		RUN useradd --create-home --uid 10001 fm
		USER fm
		EXPOSE 8082
		ENTRYPOINT ["uvicorn", "federation_manager.main:app", "--host", "0.0.0.0", "--port", "8082"]
		# 8082 is the EWBI partners reach; 8083 serves /internal/* and must stay inside the cluster.
		EXPOSE 8082 8083
		ENTRYPOINT ["python", "-m", "federation_manager.server"]

README.md

+6 −1

Changes for README.md: 6 added lines, 1 removed line.
Original line number	Diff line number	Diff line
		@@ -57,6 +57,8 @@ docker compose up --build
		```

		That starts Federation Manager on :8082, plus PostgreSQL, NATS JetStream and Keycloak.
		Partners reach the EWBI on 8082. The internal API (`/internal/*`) answers only on 8083,
		so publishing 8082 never publishes it (`FM_PORT`, `FM_INTERNAL_PORT`).

		```bash
		curl http://localhost:8082/healthz
		@@ -68,7 +70,7 @@ curl http://localhost:8082/healthz
		python -m venv .venv && . .venv/bin/activate
		pip install -e ".[dev]"
		docker compose -f docker-compose.dev.yaml up -d postgres nats keycloak
		uvicorn federation_manager.main:app --reload --port 8082
		python -m federation_manager.server # EWBI on :8082, /internal/* on :8083
		```

		### Tests
		@@ -91,12 +93,15 @@ Settings are environment variables with the `FM_` prefix, read by `federation_ma
		\| `FM_POSTGRES_URL` \| `postgresql+asyncpg://fm:fm@localhost:5433/fm_db` \| `fm_db` connection \|
		\| `FM_NATS_URL` \| `nats://localhost:4222` \| DataBus \|
		\| `FM_KEYCLOAK_ISSUER` \| `http://localhost:8090/realms/federation` \| Inbound token issuer \|
		\| `FM_KEYCLOAK_JWKS_URL` \| issuer + `/protocol/openid-connect/certs` \| Where FM fetches the signing keys, when it can't reach Keycloak on the issuer URL \|
		\| `FM_FEDERATION_ID`, `FM_COUNTRY_CODE`, `FM_MCC`, `FM_MNCS` \| — \| Our OPG.04 identity, sent on outbound `CreateFederation` \|
		\| `FM_PARTNER_STATUS_LINK` \| — \| Callback URL advertised to partners \|
		\| `FM_PLATFORM_CAPS` \| `["serviceAPIs"]` \| Capabilities advertised on federation setup \|
		\| `FM_BOOTSTRAP_FEDERATION` \| `false` \| Federate with every active partner at startup (ADR-0043) \|
		\| `FM_ZONE_OFFER_SWEEP_SECONDS` \| `600` \| How often each federated partner's zone offer is re-checked and missed `ZONES` callbacks resent; agreement writes and `valid_from`/`valid_until` trigger a check on their own \|
		\| `FM_EVENT_CONSUMER_DURABLE` \| `fm-event-worker` \| JetStream durable name; must differ per deployment \|
		\| `FM_ALLOW_INSECURE_PARTNER_ENDPOINTS` \| `false` \| Permit plain-HTTP partner endpoints. Development only \|
		\| `FM_PARTNER_SECRET_KEY` \| unset \| Base64url 32-byte key that encrypts partner secrets sent as `our_client_secret`. Unset: such requests get 501 and partners use `our_client_secret_ref` files. Changing it makes stored secrets unreadable \|

		## API

docker-compose.yaml

+2 −0

Changes for docker-compose.yaml: 2 added lines, 0 removed lines.
Original line number	Diff line number	Diff line
		@@ -7,6 +7,8 @@ services:
		restart: unless-stopped
		ports:
		- "8082:8082"
		# /internal/*, kept to this machine
		- "127.0.0.1:8083:8083"
		environment:
		FM_POSTGRES_URL: postgresql+asyncpg://fm:fm@postgres:5432/fm_db
		FM_NATS_URL: nats://nats:4222

keycloak/realm-import.json

+28 −0

Changes for keycloak/realm-import.json: 28 added lines, 0 removed lines.
Original line number	Diff line number	Diff line
		@@ -39,6 +39,20 @@
		],
		"optionalClientScopes": [
		"fed-mgmt-notif"
		],
		"protocolMappers": [
		{
		"name": "audience-federation-manager",
		"protocol": "openid-connect",
		"protocolMapper": "oidc-audience-mapper",
		"consentRequired": false,
		"config": {
		"included.custom.audience": "federation-manager",
		"access.token.claim": "true",
		"introspection.token.claim": "true",
		"id.token.claim": "false"
		}
		}
		]
		},
		{
		@@ -60,6 +74,20 @@
		],
		"optionalClientScopes": [
		"fed-mgmt-notif"
		],
		"protocolMappers": [
		{
		"name": "audience-federation-manager",
		"protocol": "openid-connect",
		"protocolMapper": "oidc-audience-mapper",
		"consentRequired": false,
		"config": {
		"included.custom.audience": "federation-manager",
		"access.token.claim": "true",
		"introspection.token.claim": "true",
		"id.token.claim": "false"
		}
		}
		]
		}
		]

pyproject.toml

+2 −1

Changes for pyproject.toml: 2 added lines, 1 removed line.
Original line number	Diff line number	Diff line
		@@ -11,11 +11,13 @@ requires-python = ">=3.12"
		dependencies = [
		"alembic>=1.13",
		"asyncpg>=0.30",
		"cryptography>=43",
		"fastapi[standard]>=0.115",
		"httpx>=0.27",
		"nats-py>=2.6",
		"pydantic-settings>=2.4",
		"pyjwt[crypto]>=2.9",
		"pyyaml>=6.0",
		"sqlalchemy[asyncio]>=2.0",
		"structlog>=25.1",
		]
		@@ -27,7 +29,6 @@ dev = [
		"pytest>=8.0",
		"pytest-asyncio>=0.24",
		"pytest-cov>=6.0",
		"pyyaml>=6.0",
		"ruff>=0.6",
		]