[{"_1":2,"_132":-5,"_133":-5},"loaderData",{"_3":4,"_13":14,"_21":22,"_126":127},"root",{"_5":-5,"_6":-7,"_7":8,"_9":-7,"_10":11,"_12":-7},"currentUser","primaryEmail","siteVerification","6LeIxAcTAAAAAJcZVRqyHh71UMIEGNQ_MXjiZKhI","toast","enableDev",false,"incidentStatus","routes/_layout",{"_15":-5,"_16":17,"_18":17,"_19":11,"_20":11},"username","isAskGordonEnabled",true,"isUsingNewTemplate","showMinimalLanding","showHoneypotTrap","routes/_layout.layers.$namespace.$reponame.$tag.(images).($imageUrlDigest)",{"_23":24,"_25":26,"_55":56,"_57":-7,"_58":-7,"_59":-7,"_60":-7,"_61":-5,"_62":-5,"_63":11,"_64":11,"_48":65,"_117":11,"_86":43,"_118":85,"_119":47,"_31":32,"_120":11,"_121":17,"_122":123,"_124":-5,"_125":11},"scanningType","none","tagData",{"_27":28,"_29":30,"_31":32,"_33":34,"_35":36,"_37":38,"_39":40,"_41":30,"_42":43,"_44":45,"_46":47,"_48":49,"_50":-5,"_51":40,"_52":53,"_54":17},"content_type","image","creator",29277714,"digest","sha256:9655c2270d24d11fa169241dd75e69c6e30e6e2451ce399d43b608072076586c","full_size",10983,"id",960643367,"images",[],"last_updated","2025-08-25T13:08:13.23848Z","last_updater","last_updater_username","eirikhaughom","media_type","application/vnd.oci.image.index.v1+json","name","sha256-f6a3795523db6ac2476d804a8024f7771cf4b366fb055da0ddd2686f63839a54","repository",28382955,"tag_last_pulled","tag_last_pushed","tag_status","inactive","v2","tagImages",[],"layerOrdinals","packageName","cveId","sbom","scoutSummary","staticSummary","isScoutPaymentRequired","canSeeVulnerabilities",{"_66":67,"_72":73,"_74":75,"_76":77,"_78":11,"_39":79,"_80":81,"_82":83,"_46":85,"_86":43,"_87":88,"_89":28,"_90":91,"_92":93,"_94":95,"_96":-5,"_97":91,"_98":99,"_100":11,"_101":43,"_102":103,"_108":11,"_109":110,"_114":43,"_115":116},"categories",[68],{"_46":69,"_70":71},"Message queues","slug","message-queues","content_types",[28],"date_registered","2025-08-25T11:31:09.81102Z","description","Handles incoming events from OSDU/Azure Data Manager for Energy and relays them to Azure Event Grid.","is_private","2025-08-25T16:17:59.959235Z","last_modified","2025-08-25T13:14:51.200541Z","media_types",[84,45],"application/vnd.docker.container.image.v1+json","adme-notification-relay","namespace","pull_count",4291,"repository_type","star_count",0,"status",1,"status_description","active","source","collaborator_count","full_description","# OSDU Notification Broker (Azure Functions) – Container Image\n\nSmall Azure Functions relay that accepts OSDU notifications, validates HMAC signatures (incl. OSDU challenge/handshake), optionally translates OSDU DataNotification payloads into Azure Event Grid events, and forwards them to an Event Grid topic.\n\n- HTTP endpoint: `/api/osdu-relay`\n- Exposed container port: `80` (map to your host, e.g., `-p 7071:80`)\n- Base image: `mcr.microsoft.com/azure-functions/python:4-python3.12`\n\n
\nFor more information, see [GitHub Repo](https://github.com/EirikHaughom/adme-notification-relay).\n\n---\n\n## Quick start\n\nPull and run with required environment variables:\n\n```powershell\n# PowerShell\n$IMAGE = \"docker pull eirikhaughom/adme-notification-relay:main\"\n\ndocker pull $IMAGE\n\ndocker run --rm --name adme-notification-relay `\n -p 7071:80 `\n -e EVENT_GRID_ENDPOINT=\"https://..eventgrid.azure.net/api/events\" `\n -e EVENT_GRID_AUTH=\"key\" `\n -e EVENT_GRID_KEY=\"\" `\n -e HMAC_SECRET=\"\" `\n $IMAGE\n```\n\nThen call the function:\n\n- Readiness: `GET http://localhost:7071/api/osdu-relay`\n- Handshake: `GET http://localhost:7071/api/osdu-relay?crc=...&hmac=...`\n- Post events: `POST http://localhost:7071/api/osdu-relay`\n\nFor local dev with Azurite, use docker compose so the function can reach a local Storage emulator. See the repo’s `docker-compose.yml` for an example.\n\n---\n\n## What this image does\n\n- Verifies incoming HMAC signatures from header/query (supports raw HMAC or OSDU token format).\n- Handles OSDU challenge handshake and returns the `responseHash` expected by clients.\n- Detects payload schema:\n - If already Event Grid schema, forwards as-is.\n - If OSDU DataNotification array, translates each item into Event Grid events and forwards the batch.\n- Publishes to Azure Event Grid using either Managed Identity/AAD, Service Principal, or Access Key.\n\n---\n\n## Configuration (environment variables)\n\nMinimum to run:\n\n- `EVENT_GRID_ENDPOINT` (required): Event Grid publish endpoint.\n - Basic Topic/Domain: `https://..eventgrid.azure.net/api/events`\n - Namespace: the Namespace endpoint host or URL.\n- `HMAC_SECRET` or Key Vault settings (one of): HMAC secret to validate signatures.\n - `HMAC_SECRET` (simple local/dev), OR one of the Key Vault options below.\n\nAuth modes for Event Grid (set `EVENT_GRID_AUTH`):\n\n- `managed` (default): Managed Identity/AAD using environment credentials\n - Recommended in Azure Container Apps/AKS with a managed identity and RBAC role \"Event Grid Data Sender\" on the target.\n- `sp`: Service Principal (Client ID/Secret)\n - Provide `AZURE_TENANT_ID`, `AZURE_CLIENT_ID`, `AZURE_CLIENT_SECRET` (or the `EVENT_GRID_*` overrides below).\n- `key`: Access Key header\n - Provide `EVENT_GRID_KEY`.\n\nKey Vault (optional, to fetch `HMAC_SECRET` at runtime):\n\n- `KEY_VAULT_SECRET_URI` OR `KEY_VAULT_URL` + `KEY_VAULT_SECRET_NAME`\n- `KEY_VAULT_AUTH` = `managed` (default) or `sp` with `AZURE_*` or `KEY_VAULT_*` overrides\n\nEvent Grid Namespace (optional):\n\n- `EVENT_GRID_NAMESPACE_TOPIC`: Namespace Topic name (only for Namespace endpoints)\n- `EVENT_GRID_CLOUD_SOURCE` (default `/osdu/relay`): CloudEvent `source` when converting for Namespace\n\nService Principal overrides (optional, when using `*_AUTH=sp`):\n\n- Shared defaults: `AZURE_TENANT_ID`, `AZURE_CLIENT_ID`, `AZURE_CLIENT_SECRET`\n- Key Vault specific: `KEY_VAULT_TENANT_ID`, `KEY_VAULT_CLIENT_ID`, `KEY_VAULT_CLIENT_SECRET`\n- Event Grid specific: `EVENT_GRID_TENANT_ID`, `EVENT_GRID_CLIENT_ID`, `EVENT_GRID_CLIENT_SECRET`\n\nSignature and translation settings (optional):\n\n- `HMAC_HEADER` (default `Authorization`), `SIGNATURE_PREFIX` (default `hmac`), `SIGNATURE_FORMAT` (`hex`|`base64`)\n- `CHALLENGE_HMAC_REQUIRED` (default `true`), `CHALLENGE_HASH_ENCODING` (`base64-hex` default, `base64`, or `hex`)\n- `EVENT_TYPE_MODE` (`single` default or `by_op`), `EVENT_TYPE_*` variables\n\nFor the full list and details, see the project README in the repository.\n\n---\n\n## Usage examples\n\n### 1) Access Key auth (simple local run)\n\n```powershell\n# PowerShell\n$env:AzureWebJobsStorage = \"\"\n$env:EVENT_GRID_ENDPOINT = \"https://..eventgrid.azure.net/api/events\"\n$env:EVENT_GRID_AUTH = \"key\"\n$env:EVENT_GRID_KEY = \"\"\n$env:HMAC_SECRET = \"\"\n\ndocker run --rm -p 7071:80 --name osdu-notification-broker `\n -e AzureWebJobsStorage `\n -e EVENT_GRID_ENDPOINT -e EVENT_GRID_AUTH -e EVENT_GRID_KEY `\n -e HMAC_SECRET `\n :\n```\n\nSend an OSDU payload; the service will translate and forward when appropriate:\n\n```bash\ncurl -X POST \"http://localhost:7071/api/osdu-relay\" \\\n -H \"Content-Type: application/json\" \\\n -H \"Authorization: hmac \" \\\n --data '[{\"id\":\"opendes:doc:123\",\"kind\":\"opendes:doc:0.2.0\",\"op\":\"create\"}]'\n```\n\nAdd `?dryRun=1` to see the translated Event Grid batch without forwarding.\n\n### 2) Azure Container Apps with Managed Identity\n\n- Assign a managed identity to your Container App.\n- Grant it RBAC role \"Event Grid Data Sender\" on the target topic/domain/namespace topic.\n- Optionally, grant Key Vault access (e.g., \"Key Vault Secrets User\") and set `KEY_VAULT_SECRET_URI`.\n\nSet app env vars:\n\n- `EVENT_GRID_AUTH=managed`\n- `EVENT_GRID_ENDPOINT=...`\n- `KEY_VAULT_SECRET_URI=...` (or `HMAC_SECRET`)\n- `EVENT_GRID_NAMESPACE_TOPIC=...` if using a Namespace\n\n---\n\n## Ports and health\n\n- Exposed port: `80` (map as needed)\n- Ready check: `GET /api/osdu-relay` returns 200 OK when the host is up\n- Handshake: `GET /api/osdu-relay?crc=...&hmac=...` returns `{ \"responseHash\": \"...\" }` on success\n\n---\n\n## Notes and best practices\n\n- Do not bake real secrets into images. Use environment variables and (in Azure) Managed Identity + Key Vault.\n- For local use, a real Storage connection string is simplest. If you prefer Azurite, run it alongside this container and point `AzureWebJobsStorage` at the Azurite endpoints.\n- If signature checks fail, ensure the client computes the HMAC over the exact bytes sent (UTF‑8) and uses the same `SIGNATURE_FORMAT`.\n\n---\n","has_starred","hub_user","immutable_tags_settings",{"_104":11,"_105":106},"enabled","rules",[107],".*","is_automated","permissions",{"_111":17,"_112":11,"_113":11},"read","write","admin","user","storage_size",843691827,"isOrg","reponame","tag","canDeleteTags","isHubSbxKitsEnabled","currentTab","","tagAttestations","displaySecurityMetadata","routes/_layout.layers.$namespace.$reponame.$tag.(images).($imageUrlDigest)._index",{"_23":24,"_59":-7,"_57":-7,"_58":-7,"_25":128,"_31":32,"_130":-7,"_131":11},{"_27":28,"_29":30,"_31":32,"_33":34,"_35":36,"_37":129,"_39":40,"_41":30,"_42":43,"_44":45,"_46":47,"_48":49,"_50":-5,"_51":40,"_52":53,"_54":17},[],"imageWithLayers","hasPermissionToViewRepoSettings","actionData","errors"]

eirikhaughom/adme-notification-relay:sha256-f6a3795523db6ac2476d804a8024f7771cf4b366fb055da0ddd2686f63839a54