Release/0.1.0

.docker/app/Dockerfile

@@ -1,27 +1,37 @@
-# pull pyhton
-FROM python:3.11-bookworm
+# syntax=docker/dockerfile:1.7
 
-# Update PIP
-RUN apt update && \
-    pip install --no-cache-dir --upgrade pip
+FROM python:3.12-slim-bookworm
+
+# Pull the uv binary from the official image (pin to a release for reproducibility).
+COPY --from=ghcr.io/astral-sh/uv:0.5.11 /uv /uvx /usr/local/bin/
+
+# Place the project venv outside /app so the docker-compose bind-mount of ./:/app
+# does not shadow it at runtime.
+ENV UV_LINK_MODE=copy \
+    UV_COMPILE_BYTECODE=1 \
+    UV_PYTHON_DOWNLOADS=never \
+    UV_PROJECT_ENVIRONMENT=/opt/venv \
+    PATH="/opt/venv/bin:$PATH"
 
 WORKDIR /app
 
-# Install project and dependencies
-RUN pip install uv
-COPY pyproject.toml /app/pyproject.toml
-RUN uv pip install --system -r /app/pyproject.toml
+# Install dependencies first (without the project) for better layer caching.
+COPY pyproject.toml uv.lock /app/
+RUN --mount=type=cache,target=/root/.cache/uv \
+    uv sync --frozen --no-install-project --no-dev
+
+# Copy the project source and install the project itself.
 COPY src /app/src
-RUN uv pip install --system -e .
+COPY README.md /app/README.md
+RUN --mount=type=cache,target=/root/.cache/uv \
+    uv sync --frozen --no-dev
 
 COPY .env /app/.env
 
-# Add deploy use to match server.
+# Add deploy user to match server.
 RUN addgroup --gid 1042 deploy \
-    && useradd --gid 1042 --uid 1042 --home-dir /home/deploy --create-home --shell /bin/bash deploy
-
-# Ensure app is owned by deploy
-RUN chown deploy:deploy /app
+    && useradd --gid 1042 --uid 1042 --home-dir /home/deploy --create-home --shell /bin/bash deploy \
+    && chown -R deploy:deploy /app /opt/venv
 
 USER deploy
 

.env.example

@@ -2,6 +2,12 @@ nicegui_storage_secret=xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx # String used for s
 database_storage_secret=xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx # Generate using https://cryptography.io/en/latest/fernet/#cryptography.fernet.Fernet.generate_key
 
 auth_lifetime_seconds=43200
+shipment_lifetime_days=30
+registration_job_lifetime_days=14
+
+# API
+api_jwt_secret=xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx # String used for jwt signing. Can be anything.
+api_token_lifetime_seconds=3600
 
 # Worker seetings
 cvr=xxxxxxxx

.github/workflows/Changelog.yml

@@ -0,0 +1,21 @@
+name: Check Changelog
+
+on: pull_request
+
+jobs:
+  changelog:
+    runs-on: ubuntu-latest
+    name: Changelog should be updated
+    strategy:
+      fail-fast: false
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v2
+        with:
+          fetch-depth: 2
+
+      - name: Git fetch
+        run: git fetch
+
+      - name: Check that changelog has been updated.
+        run: git diff --exit-code origin/${{ github.base_ref }} -- CHANGELOG.md && exit 1 || exit 0

.github/workflows/Version_Check.yml

@@ -0,0 +1,39 @@
+name: Check pyproject.toml Version Change
+
+on:
+  pull_request:
+    branches:
+      - 'main'
+
+jobs:
+  check-version:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v3
+
+      - name: Get current version in PR branch
+        id: get-pr-version
+        run: |
+          PR_VERSION=$(sed -n -e 's/^version = "\(.*\)"/\1/p' pyproject.toml)
+          echo "PR_VERSION=$PR_VERSION" >> $GITHUB_ENV
+
+      - name: Get version in base branch
+        id: get-base-version
+        run: |
+          git fetch origin ${{ github.event.pull_request.base.ref }}
+          git checkout FETCH_HEAD
+          BASE_VERSION=$(sed -n -e 's/^version = "\(.*\)"/\1/p' pyproject.toml)
+          echo "BASE_VERSION=$BASE_VERSION" >> $GITHUB_ENV
+
+      - name: Compare versions
+        run: |
+          echo "PR version: ${{ env.PR_VERSION }}"
+          echo "Base branch version: ${{ env.BASE_VERSION }}"
+
+          if [ "${{ env.PR_VERSION }}" == "${{ env.BASE_VERSION }}" ]; then
+            echo "Version number has not been changed."
+            exit 1
+          else
+            echo "Version number has changed."
+          fi

.github/workflows/pr.yml → .github/workflows/linting.yml

@@ -7,31 +7,27 @@ jobs:
     runs-on: ubuntu-24.04
     strategy:
       matrix:
-        python-version: ["3.11"]
+        python-version: ["3.12"]
       fail-fast: false
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@v6
 
-    - name: Set up Python ${{ matrix.python-version }}
-      uses: actions/setup-python@v3
+    - name: Install uv
+      uses: astral-sh/setup-uv@v4
       with:
-        python-version: ${{ matrix.python-version }}
+        enable-cache: true
+
+    - name: Set up Python ${{ matrix.python-version }}
+      run: uv python install ${{ matrix.python-version }}
 
-    - name: Install dependencies
-      run: |
-        python -m pip install --upgrade pip
-        pip install pylint
-        pip install flake8
-        pip install .
-        pip install .[dev]
+    - name: Install project and dev dependencies
+      run: uv sync --frozen --extra dev
 
     - name: Analyzing the code with pylint
-      run: |
-        pylint $(git ls-files '*.py')
+      run: uv run pylint $(git ls-files '*.py')
 
     - name: Analyzing the code with flake8
-      run: |
-        flake8 --extend-ignore=E501,E251 $(git ls-files '*.py')
+      run: uv run flake8 --extend-ignore=E501,E251 $(git ls-files '*.py')
 
   markdown-coding-standards:
     name: Markdown coding standards

.gitignore

@@ -1,5 +1,7 @@
 *.db
+*.backup
 .certs/
+OpenPostbud_document_storage/
 
 # Byte-compiled / optimized / DLL files
 __pycache__/

CHANGELOG.md

@@ -0,0 +1,35 @@
+# Changelog
+
+All notable changes to this project will be documented in this file.
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
+and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+## [Unreleased]
+
+## [0.1.0]
+
+### Added
+
+- Changelog!
+- PR workflows.
+- Version number in UI.
+- Letters can now be sent to CVR-numbers.
+
+### Fixed
+
+- Refactored send_post.py and fixed minor issues.
+
+### Changed
+
+- Changed API auth flow to JWT based auth.
+- Updated docker file to use uv.lock.
+- Bumped dependencies.
+
+## [0.0.1]
+
+- Initial release
+
+[Unreleased]: https://github.com/itk-dev-rpa/OpenPostbud/compare/0.1.0...HEAD
+[0.1.0]: https://github.com/itk-dev-rpa/OpenPostbud/releases/tag/0.1.0
+[0.0.1]: https://github.com/itk-dev-rpa/OpenPostbud/releases/tag/0.0.1

README.md

@@ -28,43 +28,41 @@ This is automatically installed by Docker.
 
 OpenPostbud needs the following environment variables set:
 
-| Name                    | description                                         | Type                    |
-|-------------------------|-----------------------------------------------------|-------------------------|
-| nicegui_storage_secret  | The secret used to store user session tokens        | String                  |
-| database_storage_secret | The encryption key used to encrypt database columns | A valid 128-bit AES key |
-| auth_lifetime_seconds   | The number of seconds to keep a user logged in      | Integer                 |
-| client_id               | OIDC client id                                      | String                  |
-| client_secret           | OIDC client secret                                  | String                  |
-| discovery_url           | OIDC discovery url                                  | URL                     |
-| redirect_url            | OIDC redirect url                                   | URL                     |
-| ui_port                 | Port the application listens on                     | Integer                 |
-| ui_host                 | Host IP to listen on                                | string                  |
-| ui_reload               | Reload application when changes are detected        | boolean                 |
-| auth_lifetime_seconds   |                                                     | integer                 |
+| Name                           | description                                                                | Type                    | Default |
+| ------------------------------ | -------------------------------------------------------------------------- | ----------------------- | ------- |
+| nicegui_storage_secret         | The secret used to store user session tokens                               | String                  |         |
+| database_storage_secret        | The encryption key used to encrypt database columns                        | A valid 128-bit AES key |         |
+| client_id                      | OIDC client id                                                             | String                  |         |
+| client_secret                  | OIDC client secret                                                         | String                  |         |
+| discovery_url                  | OIDC discovery url                                                         | URL                     |         |
+| redirect_url                   | OIDC redirect url                                                          | URL                     |         |
+| auth_lifetime_seconds          | How long a user session is valid                                           | integer                 |         |
+| shipment_lifetime_days         | How long a shipment should be kept in the database after creation          | integer                 |         |
+| registration_job_lifetime_days | How long a registration task should be kept in the database after creation | integer                 |         |
+| app_reload                     | Whether the app should reload on code changes                              | boolean                 | False   |
 
 ### Workers
 
 The shipment, registration and message broker workers need the following environment variables set:
 
-| Name                             | description                                                               | Type        |
-| -------------------------------- | ------------------------------------------------------------------------- | ----------- |
-| cvr                              | The CVR number of the organisation                                        | String      |
-| kombit_cert_path                 | The absolute path to the certificate file used for Service Platformen     | Path string |
-| Kombit_test_env                  | Whether to use the test environment of Service Platformen                 | boolean     |
-| registration_worker_sleep_time   | The number of seconds for the registration worker to idle                 | Integer     |
-| shipment_worker_sleep_time       | The number of seconds for the shipment worker to idle                     | Integer     |
-| sender_label                     | The label to set on the sender of Digital Post                            | String      |
-| message_broker_queue_id          | The UUID of the message broker queue. Get this from the Kombit admin page | UUID        |
-| message_broker_worker_sleep_time | The number of seconds for the message broker worker to idle               | Integer     |
-
-### Development
-
-Under development it's possible to set some environment variables to help with testing.
-
-| Name         | Description                         | Type        |
-| ------------ | ----------------------------------- | ----------- |
-| ssl_certfile | Path to self signed ssl certificate | Path String |
-| ssl_keyfile  | Path to certificate key file        | Path String |
+| Name                             | description                                                               | Type        | Default |
+| -------------------------------- | ------------------------------------------------------------------------- | ----------- | ------- |
+| cvr                              | The CVR number of the organisation                                        | String      |         |
+| kombit_cert_path                 | The absolute path to the certificate file used for Service Platformen     | Path string |         |
+| Kombit_test_env                  | Whether to use the test environment of Service Platformen                 | boolean     |         |
+| registration_worker_sleep_time   | The number of seconds for the registration worker to idle                 | Integer     |         |
+| shipment_worker_sleep_time       | The number of seconds for the shipment worker to idle                     | Integer     |         |
+| shipment_worker_delay            | The number of seconds to wait before a new shipment is processed          | Integer     | 300     |
+| sender_label                     | The label to set on the sender of Digital Post                            | String      |         |
+| message_broker_queue_id          | The UUID of the message broker queue. Get this from the Kombit admin page | UUID        |         |
+| message_broker_worker_sleep_time | The number of seconds for the message broker worker to idle               | Integer     |         |
+
+### API
+
+| Name                       | description                                            | Type    | Default |
+| -------------------------- | ------------------------------------------------------ | ------- | ------- |
+| api_jwt_secret             | Secret for signing JWT auth tokens                     | String  |         |
+| api_token_lifetime_seconds | The number of seconds for a JWT auth token to be valid | Integer | 3600    |
 
 ## Commandline interface (CLI)
 
@@ -79,6 +77,20 @@ Some sensitive columns in the database are encrypted using AES.
 
 ## Authentication
 
-The OpenPostbud web app uses Microsoft OIDC to authenticate users. This needs to be set up in Microsoft Entra.
+The OpenPostbud web app uses OIDC to authenticate users.
 
 Admins can use the CLI command `OpenPostbud admin_access` to get a single-use login URL.
+
+## Development
+
+### Database migrations
+
+If you need to alter the database schema when developing a new feature you need to add a migration step to the automatic
+migration tool. Migration files are located in `src\OpenPostbud\database\migrations\sql`. Please name your new migration
+file `XXX_Descriptive_name.sql` where 'XXX' is replaced by the next number in the sequence.
+The migration file should only contain valid sql statements. Multiple statements are separated by two blank lines.
+
+Please don't change existing migration files as this will break existing server setups. The migration tool keeps
+a checksum of every migration file to avoid database drift.
+
+Migrations are automatically applied when the Docker compose file is run.

docker-compose.server.yml

@@ -35,14 +35,27 @@ services:
       - "traefik.http.routers.${COMPOSE_PROJECT_NAME}.rule=Host(`${COMPOSE_SERVER_DOMAIN}`)"
       - "traefik.http.routers.${COMPOSE_PROJECT_NAME}.entrypoints=websecure"
 
+  database_migration:
+    build:
+      context: .
+      dockerfile: .docker/app/Dockerfile
+    command: "OpenPostbud migrate_database"
+    volumes:
+      - ./:/app
+    environment:
+      TZ: Europe/Copenhagen
+
   app:
     build:
       context: .
       dockerfile: .docker/app/Dockerfile
     command: "python src/OpenPostbud/main.py"
     restart: unless-stopped
     depends_on:
-      - gotenberg
+      gotenberg:
+        condition: service_started
+      database_migration:
+        condition: service_completed_successfully
     networks:
       - app
     volumes:
@@ -67,6 +80,26 @@ services:
       - ./certs:/app/certs:ro
     environment:
       TZ: Europe/Copenhagen
+    deploy:
+      replicas: 5
+
+  nemsms_worker:
+    build:
+      context: .
+      dockerfile: .docker/app/Dockerfile
+    command: "python src/OpenPostbud/workers/nemsms_worker.py"
+    restart: unless-stopped
+    depends_on:
+      - app
+    networks:
+      - app
+    volumes:
+      - ./:/app
+      - ./certs:/app/certs:ro
+    environment:
+      TZ: Europe/Copenhagen
+    deploy:
+      replicas: 5
 
   registration_worker:
     build:
@@ -107,3 +140,5 @@ services:
       - app
     environment:
       TZ: Europe/Copenhagen
+    deploy:
+      replicas: 5