[{"_1":2,"_131":-5,"_132":-5},"loaderData",{"_3":4,"_13":14,"_20":21,"_125":126},"root",{"_5":-5,"_6":-7,"_7":8,"_9":-7,"_10":11,"_12":-7},"currentUser","primaryEmail","siteVerification","6LeIxAcTAAAAAJcZVRqyHh71UMIEGNQ_MXjiZKhI","toast","enableDev",false,"incidentStatus","routes/_layout",{"_15":-5,"_16":17,"_18":17,"_19":11},"username","isAskGordonEnabled",true,"isUsingNewTemplate","showMinimalLanding","routes/_layout.layers.$namespace.$reponame.$tag.(images).($imageUrlDigest)",{"_22":23,"_24":25,"_54":55,"_56":-7,"_57":-7,"_58":-7,"_59":-7,"_60":-5,"_61":-5,"_62":11,"_63":11,"_47":64,"_116":11,"_85":42,"_117":84,"_118":46,"_30":31,"_119":11,"_120":17,"_121":122,"_123":-5,"_124":11},"scanningType","none","tagData",{"_26":27,"_28":29,"_30":31,"_32":33,"_34":35,"_36":37,"_38":39,"_40":29,"_41":42,"_43":44,"_45":46,"_47":48,"_49":-5,"_50":39,"_51":52,"_53":17},"content_type","image","creator",29277714,"digest","sha256:544afb648f890a7ee8b992e21338395efc9b2473bc010a7ff31b59c007765567","full_size",10842,"id",960640392,"images",[],"last_updated","2025-08-25T13:04:21.721936Z","last_updater","last_updater_username","eirikhaughom","media_type","application/vnd.oci.image.index.v1+json","name","sha256-f07d320ade3ee77565e9361dcd177d6f346b5512efc9ec3b8d1c39ebe8023a8f","repository",28382955,"tag_last_pulled","tag_last_pushed","tag_status","inactive","v2","tagImages",[],"layerOrdinals","packageName","cveId","sbom","scoutSummary","staticSummary","isScoutPaymentRequired","canSeeVulnerabilities",{"_65":66,"_71":72,"_73":74,"_75":76,"_77":11,"_38":78,"_79":80,"_81":82,"_45":84,"_85":42,"_86":87,"_88":27,"_89":90,"_91":92,"_93":94,"_95":-5,"_96":90,"_97":98,"_99":11,"_100":42,"_101":102,"_107":11,"_108":109,"_113":42,"_114":115},"categories",[67],{"_45":68,"_69":70},"Message queues","slug","message-queues","content_types",[27],"date_registered","2025-08-25T11:31:09.81102Z","description","Handles incoming events from OSDU/Azure Data Manager for Energy and relays them to Azure Event Grid.","is_private","2025-08-25T16:17:59.959235Z","last_modified","2025-08-25T13:14:51.200541Z","media_types",[83,44],"application/vnd.docker.container.image.v1+json","adme-notification-relay","namespace","pull_count",4287,"repository_type","star_count",0,"status",1,"status_description","active","source","collaborator_count","full_description","# OSDU Notification Broker (Azure Functions) – Container Image\n\nSmall Azure Functions relay that accepts OSDU notifications, validates HMAC signatures (incl. OSDU challenge/handshake), optionally translates OSDU DataNotification payloads into Azure Event Grid events, and forwards them to an Event Grid topic.\n\n- HTTP endpoint: `/api/osdu-relay`\n- Exposed container port: `80` (map to your host, e.g., `-p 7071:80`)\n- Base image: `mcr.microsoft.com/azure-functions/python:4-python3.12`\n\n
\nFor more information, see [GitHub Repo](https://github.com/EirikHaughom/adme-notification-relay).\n\n---\n\n## Quick start\n\nPull and run with required environment variables:\n\n```powershell\n# PowerShell\n$IMAGE = \"docker pull eirikhaughom/adme-notification-relay:main\"\n\ndocker pull $IMAGE\n\ndocker run --rm --name adme-notification-relay `\n -p 7071:80 `\n -e EVENT_GRID_ENDPOINT=\"https://..eventgrid.azure.net/api/events\" `\n -e EVENT_GRID_AUTH=\"key\" `\n -e EVENT_GRID_KEY=\"\" `\n -e HMAC_SECRET=\"\" `\n $IMAGE\n```\n\nThen call the function:\n\n- Readiness: `GET http://localhost:7071/api/osdu-relay`\n- Handshake: `GET http://localhost:7071/api/osdu-relay?crc=...&hmac=...`\n- Post events: `POST http://localhost:7071/api/osdu-relay`\n\nFor local dev with Azurite, use docker compose so the function can reach a local Storage emulator. See the repo’s `docker-compose.yml` for an example.\n\n---\n\n## What this image does\n\n- Verifies incoming HMAC signatures from header/query (supports raw HMAC or OSDU token format).\n- Handles OSDU challenge handshake and returns the `responseHash` expected by clients.\n- Detects payload schema:\n - If already Event Grid schema, forwards as-is.\n - If OSDU DataNotification array, translates each item into Event Grid events and forwards the batch.\n- Publishes to Azure Event Grid using either Managed Identity/AAD, Service Principal, or Access Key.\n\n---\n\n## Configuration (environment variables)\n\nMinimum to run:\n\n- `EVENT_GRID_ENDPOINT` (required): Event Grid publish endpoint.\n - Basic Topic/Domain: `https://..eventgrid.azure.net/api/events`\n - Namespace: the Namespace endpoint host or URL.\n- `HMAC_SECRET` or Key Vault settings (one of): HMAC secret to validate signatures.\n - `HMAC_SECRET` (simple local/dev), OR one of the Key Vault options below.\n\nAuth modes for Event Grid (set `EVENT_GRID_AUTH`):\n\n- `managed` (default): Managed Identity/AAD using environment credentials\n - Recommended in Azure Container Apps/AKS with a managed identity and RBAC role \"Event Grid Data Sender\" on the target.\n- `sp`: Service Principal (Client ID/Secret)\n - Provide `AZURE_TENANT_ID`, `AZURE_CLIENT_ID`, `AZURE_CLIENT_SECRET` (or the `EVENT_GRID_*` overrides below).\n- `key`: Access Key header\n - Provide `EVENT_GRID_KEY`.\n\nKey Vault (optional, to fetch `HMAC_SECRET` at runtime):\n\n- `KEY_VAULT_SECRET_URI` OR `KEY_VAULT_URL` + `KEY_VAULT_SECRET_NAME`\n- `KEY_VAULT_AUTH` = `managed` (default) or `sp` with `AZURE_*` or `KEY_VAULT_*` overrides\n\nEvent Grid Namespace (optional):\n\n- `EVENT_GRID_NAMESPACE_TOPIC`: Namespace Topic name (only for Namespace endpoints)\n- `EVENT_GRID_CLOUD_SOURCE` (default `/osdu/relay`): CloudEvent `source` when converting for Namespace\n\nService Principal overrides (optional, when using `*_AUTH=sp`):\n\n- Shared defaults: `AZURE_TENANT_ID`, `AZURE_CLIENT_ID`, `AZURE_CLIENT_SECRET`\n- Key Vault specific: `KEY_VAULT_TENANT_ID`, `KEY_VAULT_CLIENT_ID`, `KEY_VAULT_CLIENT_SECRET`\n- Event Grid specific: `EVENT_GRID_TENANT_ID`, `EVENT_GRID_CLIENT_ID`, `EVENT_GRID_CLIENT_SECRET`\n\nSignature and translation settings (optional):\n\n- `HMAC_HEADER` (default `Authorization`), `SIGNATURE_PREFIX` (default `hmac`), `SIGNATURE_FORMAT` (`hex`|`base64`)\n- `CHALLENGE_HMAC_REQUIRED` (default `true`), `CHALLENGE_HASH_ENCODING` (`base64-hex` default, `base64`, or `hex`)\n- `EVENT_TYPE_MODE` (`single` default or `by_op`), `EVENT_TYPE_*` variables\n\nFor the full list and details, see the project README in the repository.\n\n---\n\n## Usage examples\n\n### 1) Access Key auth (simple local run)\n\n```powershell\n# PowerShell\n$env:AzureWebJobsStorage = \"\"\n$env:EVENT_GRID_ENDPOINT = \"https://..eventgrid.azure.net/api/events\"\n$env:EVENT_GRID_AUTH = \"key\"\n$env:EVENT_GRID_KEY = \"\"\n$env:HMAC_SECRET = \"\"\n\ndocker run --rm -p 7071:80 --name osdu-notification-broker `\n -e AzureWebJobsStorage `\n -e EVENT_GRID_ENDPOINT -e EVENT_GRID_AUTH -e EVENT_GRID_KEY `\n -e HMAC_SECRET `\n :\n```\n\nSend an OSDU payload; the service will translate and forward when appropriate:\n\n```bash\ncurl -X POST \"http://localhost:7071/api/osdu-relay\" \\\n -H \"Content-Type: application/json\" \\\n -H \"Authorization: hmac \" \\\n --data '[{\"id\":\"opendes:doc:123\",\"kind\":\"opendes:doc:0.2.0\",\"op\":\"create\"}]'\n```\n\nAdd `?dryRun=1` to see the translated Event Grid batch without forwarding.\n\n### 2) Azure Container Apps with Managed Identity\n\n- Assign a managed identity to your Container App.\n- Grant it RBAC role \"Event Grid Data Sender\" on the target topic/domain/namespace topic.\n- Optionally, grant Key Vault access (e.g., \"Key Vault Secrets User\") and set `KEY_VAULT_SECRET_URI`.\n\nSet app env vars:\n\n- `EVENT_GRID_AUTH=managed`\n- `EVENT_GRID_ENDPOINT=...`\n- `KEY_VAULT_SECRET_URI=...` (or `HMAC_SECRET`)\n- `EVENT_GRID_NAMESPACE_TOPIC=...` if using a Namespace\n\n---\n\n## Ports and health\n\n- Exposed port: `80` (map as needed)\n- Ready check: `GET /api/osdu-relay` returns 200 OK when the host is up\n- Handshake: `GET /api/osdu-relay?crc=...&hmac=...` returns `{ \"responseHash\": \"...\" }` on success\n\n---\n\n## Notes and best practices\n\n- Do not bake real secrets into images. Use environment variables and (in Azure) Managed Identity + Key Vault.\n- For local use, a real Storage connection string is simplest. If you prefer Azurite, run it alongside this container and point `AzureWebJobsStorage` at the Azurite endpoints.\n- If signature checks fail, ensure the client computes the HMAC over the exact bytes sent (UTF‑8) and uses the same `SIGNATURE_FORMAT`.\n\n---\n","has_starred","hub_user","immutable_tags_settings",{"_103":11,"_104":105},"enabled","rules",[106],".*","is_automated","permissions",{"_110":17,"_111":11,"_112":11},"read","write","admin","user","storage_size",843691827,"isOrg","reponame","tag","canDeleteTags","isHubSbxKitsEnabled","currentTab","","tagAttestations","displaySecurityMetadata","routes/_layout.layers.$namespace.$reponame.$tag.(images).($imageUrlDigest)._index",{"_22":23,"_58":-7,"_56":-7,"_57":-7,"_24":127,"_30":31,"_129":-7,"_130":11},{"_26":27,"_28":29,"_30":31,"_32":33,"_34":35,"_36":128,"_38":39,"_40":29,"_41":42,"_43":44,"_45":46,"_47":48,"_49":-5,"_50":39,"_51":52,"_53":17},[],"imageWithLayers","hasPermissionToViewRepoSettings","actionData","errors"]

eirikhaughom/adme-notification-relay:sha256-f07d320ade3ee77565e9361dcd177d6f346b5512efc9ec3b8d1c39ebe8023a8f