[{"_1":2,"_137":-5,"_138":-5},"loaderData",{"_3":4,"_17":18,"_25":26,"_131":132},"root",{"_5":-5,"_6":-7,"_7":8,"_9":-7,"_10":11,"_12":-7,"_13":14,"_15":16},"currentUser","primaryEmail","siteVerification","6LeIxAcTAAAAAJcZVRqyHh71UMIEGNQ_MXjiZKhI","toast","enableDev",false,"incidentStatus","theme","system","contrast","normal","routes/_layout",{"_19":-5,"_20":21,"_22":21,"_23":11,"_24":21},"username","isAskGordonEnabled",true,"isUsingNewTemplate","showMinimalLanding","showHoneypotTrap","routes/_layout.layers.$namespace.$reponame.$tag.(images).($imageUrlDigest)",{"_27":28,"_29":30,"_59":60,"_61":-7,"_62":-7,"_63":-7,"_64":-7,"_65":-5,"_66":-5,"_67":11,"_68":11,"_52":69,"_121":11,"_90":47,"_122":89,"_123":51,"_35":36,"_124":11,"_125":21,"_126":127,"_128":-5,"_129":11,"_130":11},"scanningType","none","tagData",{"_31":32,"_33":34,"_35":36,"_37":38,"_39":40,"_41":42,"_43":44,"_45":34,"_46":47,"_48":49,"_50":51,"_52":53,"_54":-5,"_55":44,"_56":57,"_58":21},"content_type","image","creator",29277714,"digest","sha256:c4d1d2ef8d2097176f55132654e4b3dca5855aecffd02262d42972ec1c5c9c81","full_size",11124,"id",960747936,"images",[],"last_updated","2025-08-25T15:47:07.265169Z","last_updater","last_updater_username","eirikhaughom","media_type","application/vnd.oci.image.index.v1+json","name","sha256-2dc0be37753773eba773ba175a5a1962735fc5a319f2b5dffcdf4974e872cca6","repository",28382955,"tag_last_pulled","tag_last_pushed","tag_status","inactive","v2","tagImages",[],"layerOrdinals","packageName","cveId","sbom","scoutSummary","staticSummary","isScoutPaymentRequired","canSeeVulnerabilities",{"_70":71,"_76":77,"_78":79,"_80":81,"_82":11,"_43":83,"_84":85,"_86":87,"_50":89,"_90":47,"_91":92,"_93":32,"_94":95,"_96":97,"_98":99,"_100":-5,"_101":95,"_102":103,"_104":11,"_105":47,"_106":107,"_112":11,"_113":114,"_118":47,"_119":120},"categories",[72],{"_50":73,"_74":75},"Message queues","slug","message-queues","content_types",[32],"date_registered","2025-08-25T11:31:09.81102Z","description","Handles incoming events from OSDU/Azure Data Manager for Energy and relays them to Azure Event Grid.","is_private","2025-08-25T16:17:59.959235Z","last_modified","2025-08-25T13:14:51.200541Z","media_types",[88,49],"application/vnd.docker.container.image.v1+json","adme-notification-relay","namespace","pull_count",4532,"repository_type","star_count",0,"status",1,"status_description","active","source","collaborator_count","full_description","# OSDU Notification Broker (Azure Functions) – Container Image\n\nSmall Azure Functions relay that accepts OSDU notifications, validates HMAC signatures (incl. OSDU challenge/handshake), optionally translates OSDU DataNotification payloads into Azure Event Grid events, and forwards them to an Event Grid topic.\n\n- HTTP endpoint: `/api/osdu-relay`\n- Exposed container port: `80` (map to your host, e.g., `-p 7071:80`)\n- Base image: `mcr.microsoft.com/azure-functions/python:4-python3.12`\n\n
\nFor more information, see [GitHub Repo](https://github.com/EirikHaughom/adme-notification-relay).\n\n---\n\n## Quick start\n\nPull and run with required environment variables:\n\n```powershell\n# PowerShell\n$IMAGE = \"docker pull eirikhaughom/adme-notification-relay:main\"\n\ndocker pull $IMAGE\n\ndocker run --rm --name adme-notification-relay `\n -p 7071:80 `\n -e EVENT_GRID_ENDPOINT=\"https://..eventgrid.azure.net/api/events\" `\n -e EVENT_GRID_AUTH=\"key\" `\n -e EVENT_GRID_KEY=\"\" `\n -e HMAC_SECRET=\"\" `\n $IMAGE\n```\n\nThen call the function:\n\n- Readiness: `GET http://localhost:7071/api/osdu-relay`\n- Handshake: `GET http://localhost:7071/api/osdu-relay?crc=...&hmac=...`\n- Post events: `POST http://localhost:7071/api/osdu-relay`\n\nFor local dev with Azurite, use docker compose so the function can reach a local Storage emulator. See the repo’s `docker-compose.yml` for an example.\n\n---\n\n## What this image does\n\n- Verifies incoming HMAC signatures from header/query (supports raw HMAC or OSDU token format).\n- Handles OSDU challenge handshake and returns the `responseHash` expected by clients.\n- Detects payload schema:\n - If already Event Grid schema, forwards as-is.\n - If OSDU DataNotification array, translates each item into Event Grid events and forwards the batch.\n- Publishes to Azure Event Grid using either Managed Identity/AAD, Service Principal, or Access Key.\n\n---\n\n## Configuration (environment variables)\n\nMinimum to run:\n\n- `EVENT_GRID_ENDPOINT` (required): Event Grid publish endpoint.\n - Basic Topic/Domain: `https://..eventgrid.azure.net/api/events`\n - Namespace: the Namespace endpoint host or URL.\n- `HMAC_SECRET` or Key Vault settings (one of): HMAC secret to validate signatures.\n - `HMAC_SECRET` (simple local/dev), OR one of the Key Vault options below.\n\nAuth modes for Event Grid (set `EVENT_GRID_AUTH`):\n\n- `managed` (default): Managed Identity/AAD using environment credentials\n - Recommended in Azure Container Apps/AKS with a managed identity and RBAC role \"Event Grid Data Sender\" on the target.\n- `sp`: Service Principal (Client ID/Secret)\n - Provide `AZURE_TENANT_ID`, `AZURE_CLIENT_ID`, `AZURE_CLIENT_SECRET` (or the `EVENT_GRID_*` overrides below).\n- `key`: Access Key header\n - Provide `EVENT_GRID_KEY`.\n\nKey Vault (optional, to fetch `HMAC_SECRET` at runtime):\n\n- `KEY_VAULT_SECRET_URI` OR `KEY_VAULT_URL` + `KEY_VAULT_SECRET_NAME`\n- `KEY_VAULT_AUTH` = `managed` (default) or `sp` with `AZURE_*` or `KEY_VAULT_*` overrides\n\nEvent Grid Namespace (optional):\n\n- `EVENT_GRID_NAMESPACE_TOPIC`: Namespace Topic name (only for Namespace endpoints)\n- `EVENT_GRID_CLOUD_SOURCE` (default `/osdu/relay`): CloudEvent `source` when converting for Namespace\n\nService Principal overrides (optional, when using `*_AUTH=sp`):\n\n- Shared defaults: `AZURE_TENANT_ID`, `AZURE_CLIENT_ID`, `AZURE_CLIENT_SECRET`\n- Key Vault specific: `KEY_VAULT_TENANT_ID`, `KEY_VAULT_CLIENT_ID`, `KEY_VAULT_CLIENT_SECRET`\n- Event Grid specific: `EVENT_GRID_TENANT_ID`, `EVENT_GRID_CLIENT_ID`, `EVENT_GRID_CLIENT_SECRET`\n\nSignature and translation settings (optional):\n\n- `HMAC_HEADER` (default `Authorization`), `SIGNATURE_PREFIX` (default `hmac`), `SIGNATURE_FORMAT` (`hex`|`base64`)\n- `CHALLENGE_HMAC_REQUIRED` (default `true`), `CHALLENGE_HASH_ENCODING` (`base64-hex` default, `base64`, or `hex`)\n- `EVENT_TYPE_MODE` (`single` default or `by_op`), `EVENT_TYPE_*` variables\n\nFor the full list and details, see the project README in the repository.\n\n---\n\n## Usage examples\n\n### 1) Access Key auth (simple local run)\n\n```powershell\n# PowerShell\n$env:AzureWebJobsStorage = \"\"\n$env:EVENT_GRID_ENDPOINT = \"https://..eventgrid.azure.net/api/events\"\n$env:EVENT_GRID_AUTH = \"key\"\n$env:EVENT_GRID_KEY = \"\"\n$env:HMAC_SECRET = \"\"\n\ndocker run --rm -p 7071:80 --name osdu-notification-broker `\n -e AzureWebJobsStorage `\n -e EVENT_GRID_ENDPOINT -e EVENT_GRID_AUTH -e EVENT_GRID_KEY `\n -e HMAC_SECRET `\n :\n```\n\nSend an OSDU payload; the service will translate and forward when appropriate:\n\n```bash\ncurl -X POST \"http://localhost:7071/api/osdu-relay\" \\\n -H \"Content-Type: application/json\" \\\n -H \"Authorization: hmac \" \\\n --data '[{\"id\":\"opendes:doc:123\",\"kind\":\"opendes:doc:0.2.0\",\"op\":\"create\"}]'\n```\n\nAdd `?dryRun=1` to see the translated Event Grid batch without forwarding.\n\n### 2) Azure Container Apps with Managed Identity\n\n- Assign a managed identity to your Container App.\n- Grant it RBAC role \"Event Grid Data Sender\" on the target topic/domain/namespace topic.\n- Optionally, grant Key Vault access (e.g., \"Key Vault Secrets User\") and set `KEY_VAULT_SECRET_URI`.\n\nSet app env vars:\n\n- `EVENT_GRID_AUTH=managed`\n- `EVENT_GRID_ENDPOINT=...`\n- `KEY_VAULT_SECRET_URI=...` (or `HMAC_SECRET`)\n- `EVENT_GRID_NAMESPACE_TOPIC=...` if using a Namespace\n\n---\n\n## Ports and health\n\n- Exposed port: `80` (map as needed)\n- Ready check: `GET /api/osdu-relay` returns 200 OK when the host is up\n- Handshake: `GET /api/osdu-relay?crc=...&hmac=...` returns `{ \"responseHash\": \"...\" }` on success\n\n---\n\n## Notes and best practices\n\n- Do not bake real secrets into images. Use environment variables and (in Azure) Managed Identity + Key Vault.\n- For local use, a real Storage connection string is simplest. If you prefer Azurite, run it alongside this container and point `AzureWebJobsStorage` at the Azurite endpoints.\n- If signature checks fail, ensure the client computes the HMAC over the exact bytes sent (UTF‑8) and uses the same `SIGNATURE_FORMAT`.\n\n---\n","has_starred","hub_user","immutable_tags_settings",{"_108":11,"_109":110},"enabled","rules",[111],".*","is_automated","permissions",{"_115":21,"_116":11,"_117":11},"read","write","admin","user","storage_size",843691827,"isOrg","reponame","tag","canDeleteTags","isHubSbxKitsEnabled","currentTab","","tagAttestations","displaySecurityMetadata","showSbxLogoOverride","routes/_layout.layers.$namespace.$reponame.$tag.(images).($imageUrlDigest)._index",{"_27":28,"_63":-7,"_61":-7,"_62":-7,"_29":133,"_35":36,"_135":-7,"_136":11},{"_31":32,"_33":34,"_35":36,"_37":38,"_39":40,"_41":134,"_43":44,"_45":34,"_46":47,"_48":49,"_50":51,"_52":53,"_54":-5,"_55":44,"_56":57,"_58":21},[],"imageWithLayers","hasPermissionToViewRepoSettings","actionData","errors"]

eirikhaughom/adme-notification-relay:sha256-2dc0be37753773eba773ba175a5a1962735fc5a319f2b5dffcdf4974e872cca6