first naive draft for RDC implem

Author: r0xsh

.env.dist

@@ -112,6 +112,19 @@ INSEE_PORTAIL_API_KEY=
 STANDTRACK_API_KEY=
 PROXIMUS_SYNC_URI=
 
+###> logist-x/rdc ###
+KEYCLOAK_BASE_URL=https://keycloak.bav.logist-x.eu
+KEYCLOAK_REALM=
+KEYCLOAK_CLIENT_ID=
+KEYCLOAK_CLIENT_SECRET=
+KEYCLOAK_USERNAME=
+KEYCLOAK_PASSWORD=
+RDC_INSTANCE_BASE_URL=
+RDC_INSTANCE_NAME=
+RDC_ACL_AUTHORIZATIONS=[{"memberIdentifier":"BOL.MEMBER.APPLICOLIS","authorizedBy":"BOL.MEMBER.COURSIERS_BORDELAIS","mode":"READ"}]
+RDC_WEBHOOK_SECRET=
+###< logist-x/rdc ###
+
 ###> feature flags ###
 ###< feature flags ###
 

config/services.yaml

@@ -1629,6 +1629,29 @@ services:
     arguments:
       $standtrackApiKey: '%env(STANDTRACK_API_KEY)%'
 
+  AppBundle\Integration\Rdc\Api\RdcClientInterface:
+    class: AppBundle\Integration\Rdc\Api\RdcClient
+    arguments:
+      $keycloakBaseUrl: '%env(KEYCLOAK_BASE_URL)%'
+      $keycloakRealm: '%env(KEYCLOAK_REALM)%'
+      $keycloakClientId: '%env(KEYCLOAK_CLIENT_ID)%'
+      $keycloakClientSecret: '%env(KEYCLOAK_CLIENT_SECRET)%'
+      $keycloakUsername: '%env(KEYCLOAK_USERNAME)%'
+      $keycloakPassword: '%env(KEYCLOAK_PASSWORD)%'
+      $rdcInstanceBaseUrl: '%env(RDC_INSTANCE_BASE_URL)%'
+      $memberProvider: '%env(RDC_MEMBER_PROVIDER)%'
+      $aclAuthorizations: '%env(json:RDC_ACL_AUTHORIZATIONS)%'
+
+  AppBundle\Integration\Rdc\Webhook\WebhookPayloadParser: ~
+
+  AppBundle\Integration\Rdc\Webhook\RdcIdempotencyChecker: ~
+
+  AppBundle\Controller\Api\RdcWebhookController:
+    arguments:
+      $rdcWebhookSecret: '%env(RDC_WEBHOOK_SECRET)%'
+    tags:
+      - { name: monolog.logger, channel: rdc }
+
   AppBundle\Utils\Defaults: ~
 
   AppBundle\Api\Filter\AssignedFilter:

config/services/commands.yml

@@ -216,3 +216,7 @@ services:
   AppBundle\Command\Paygreen\CheckStatusCommand:
     tags:
       - { name: 'console.command', command: 'coopcycle:paygreen:check-status' }
+
+  AppBundle\Command\RdcTestConnectionCommand:
+    tags:
+      - { name: 'console.command', command: 'rdc:test-connection' }

src/Command/RdcTestConnectionCommand.php

@@ -0,0 +1,48 @@
+<?php
+
+namespace AppBundle\Command;
+
+use AppBundle\Integration\Rdc\Api\RdcClientInterface;
+use Symfony\Component\Console\Attribute\AsCommand;
+use Symfony\Component\Console\Command\Command;
+use Symfony\Component\Console\Input\InputInterface;
+use Symfony\Component\Console\Output\OutputInterface;
+use Symfony\Component\Console\Style\SymfonyStyle;
+
+#[AsCommand(
+    name: 'rdc:test-connection',
+    description: 'Test RDC integration connection (Keycloak token retrieval)',
+)]
+class RdcTestConnectionCommand extends Command
+{
+    public function __construct(
+        private readonly RdcClientInterface $rdcClient,
+    ) {
+        parent::__construct();
+    }
+
+    protected function execute(InputInterface $input, OutputInterface $output): int
+    {
+        $io = new SymfonyStyle($input, $output);
+
+        $io->title('RDC Connection Test');
+
+        $io->section('Testing Keycloak Token Retrieval');
+
+        try {
+            $io->text('Requesting token from Keycloak...');
+
+            $token = $this->rdcClient->getToken();
+
+            $io->success('Token retrieved successfully!');
+            $io->text(sprintf('Token (first 50 chars): %s...', substr($token, 0, 50)));
+
+            return Command::SUCCESS;
+        } catch (\Exception $e) {
+            $io->error('Failed to retrieve token');
+            $io->text('Error: ' . $e->getMessage());
+
+            return Command::FAILURE;
+        }
+    }
+}

src/Controller/Api/RdcWebhookController.php

@@ -0,0 +1,99 @@
+<?php
+
+declare(strict_types=1);
+
+namespace AppBundle\Controller\Api;
+
+use AppBundle\Integration\Rdc\Webhook\RdcIdempotencyChecker;
+use AppBundle\Integration\Rdc\Webhook\WebhookPayloadParser;
+use AppBundle\Message\RdcWebhookMessage;
+use Psr\Log\LoggerInterface;
+use Symfony\Bundle\FrameworkBundle\Controller\AbstractController;
+use Symfony\Component\HttpFoundation\JsonResponse;
+use Symfony\Component\HttpFoundation\Request;
+use Symfony\Component\HttpFoundation\Response;
+use Symfony\Component\Messenger\MessageBusInterface;
+use Symfony\Component\Routing\Attribute\Route;
+
+class RdcWebhookController extends AbstractController
+{
+    private const WEBHOOK_SOURCE = 'RDC';
+
+    public function __construct(
+        private readonly WebhookPayloadParser $payloadParser,
+        private readonly RdcIdempotencyChecker $idempotencyChecker,
+        private readonly MessageBusInterface $messageBus,
+        private readonly LoggerInterface $logger,
+        private readonly string $rdcWebhookSecret,
+    ) {
+    }
+
+    #[Route(path: '/api/v1/webhooks/rdc', name: 'api_v1_webhooks_rdc', methods: ['POST'])]
+    public function handleWebhook(Request $request): JsonResponse
+    {
+        // Validate X-webhook-source header
+        $source = $request->headers->get('X-webhook-source');
+        if ($source !== self::WEBHOOK_SOURCE) {
+            $this->logger->warning('RDC webhook received with invalid source', [
+                'source' => $source,
+            ]);
+            return new JsonResponse(['error' => 'Invalid webhook source'], Response::HTTP_FORBIDDEN);
+        }
+
+        // Validate X-webhook-secret header with timing-attack safe comparison
+        $secret = $request->headers->get('X-webhook-Secret');
+        if (!hash_equals($this->rdcWebhookSecret, $secret)) {
+            $this->logger->warning('RDC webhook received with invalid secret');
+            return new JsonResponse(['error' => 'Invalid webhook secret'], Response::HTTP_FORBIDDEN);
+        }
+
+        // Parse JSON payload
+        $content = $request->getContent();
+        $payload = json_decode($content, true);
+        if (json_last_error() !== JSON_ERROR_NONE) {
+            $this->logger->warning('RDC webhook received with invalid JSON', [
+                'json_error' => json_last_error_msg(),
+            ]);
+            return new JsonResponse(['error' => 'Invalid JSON payload'], Response::HTTP_BAD_REQUEST);
+        }
+
+        // Parse webhook payload
+        $parsed = $this->payloadParser->parse($payload);
+        if ($parsed === null) {
+            return new JsonResponse(['error' => 'Invalid payload structure'], Response::HTTP_BAD_REQUEST);
+        }
+
+        $loUri = $parsed['loUri'];
+        $eventType = $parsed['eventType'];
+        $lo = $parsed['lo'];
+
+        // Check idempotency and resolve effective event type
+        $effectiveEventType = $this->idempotencyChecker->resolveEventType($loUri, $eventType);
+
+        // Mark as processed (will be idempotent due to unique constraint)
+        if (!$this->idempotencyChecker->isAlreadyProcessed($loUri)) {
+            $this->idempotencyChecker->markAsProcessed($loUri, $effectiveEventType);
+        }
+
+        // Dispatch message to queue
+        $message = new RdcWebhookMessage(
+            $loUri,
+            $effectiveEventType,
+            $lo,
+            new \DateTimeImmutable(),
+        );
+        $this->messageBus->dispatch($message);
+
+        $this->logger->info('RDC webhook accepted', [
+            'lo_uri' => $loUri,
+            'event_type' => $eventType,
+            'effective_event_type' => $effectiveEventType,
+        ]);
+
+        return new JsonResponse([
+            'status' => 'accepted',
+            'lo_uri' => $loUri,
+            'event_type' => $effectiveEventType,
+        ]);
+    }
+}

src/Entity/Rdc/RdcProcessedWebhook.php

@@ -0,0 +1,58 @@
+<?php
+
+declare(strict_types=1);
+
+namespace AppBundle\Entity\Rdc;
+
+use Doctrine\ORM\Mapping as ORM;
+use Gedmo\Timestampable\Traits\Timestampable;
+
+/**
+ * Tracks processed webhooks for idempotency.
+ *
+ * @ORM\Entity
+ * @ORM\Table(name="rdc_processed_webhooks")
+ * @ORM\UniqueConstraint(name="uniq_lo_uri", columns={"lo_uri"})
+ */
+class RdcProcessedWebhook
+{
+    use Timestampable;
+
+    /**
+     * @ORM\Id
+     * @ORM\GeneratedValue
+     * @ORM\Column(type="integer")
+     */
+    private ?int $id = null;
+
+    /**
+     * @ORM\Column(type="string", length=255, unique=true)
+     */
+    private string $loUri;
+
+    /**
+     * @ORM\Column(type="string", length=50)
+     */
+    private string $eventType;
+
+    public function __construct(string $loUri, string $eventType)
+    {
+        $this->loUri = $loUri;
+        $this->eventType = $eventType;
+    }
+
+    public function getId(): ?int
+    {
+        return $this->id;
+    }
+
+    public function getLoUri(): string
+    {
+        return $this->loUri;
+    }
+
+    public function getEventType(): string
+    {
+        return $this->eventType;
+    }
+}