Merge branch 'main' into remove-dokgen

Author: kenglxn

.github/workflows/cicd-backend.yaml

@@ -29,6 +29,22 @@ jobs:
           --health-retries 5
         ports:
           - 5532:5432
+      gotenberg:
+        image: gotenberg/gotenberg:8.37.0
+        env:
+          CHROMIUM_DISABLE_JAVASCRIPT: "true"
+          CHROMIUM_ALLOW_LIST: "^file:///tmp/.*"
+          API_DISABLE_DOWNLOAD_FROM: "true"
+          WEBHOOK_DISABLE: "true"
+          LIBREOFFICE_DISABLE_ROUTES: "true"
+          CHROMIUM_MAX_CONCURRENCY: "2"
+        options: >-
+          --health-cmd "curl -fsS http://localhost:3000/health || exit 1"
+          --health-interval 10s
+          --health-timeout 5s
+          --health-retries 10
+        ports:
+          - 3003:3000
     steps:
       - uses: actions/checkout@v4
 

.github/workflows/cicd-gotenberg.yaml

@@ -0,0 +1,66 @@
+name: CICD Gotenberg
+on:
+  push:
+    paths:
+      - gotenberg/**
+      - nais/dev-gcp-gotenberg.yaml
+      - nais/prod-gcp-gotenberg.yaml
+  workflow_dispatch:
+  schedule:
+    - cron: '0 6 * * 1' # bygg nytt image hver mandag morgen
+
+jobs:
+  compile-test-and-build:
+    name: Compile, build and deploy image
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      id-token: write
+    outputs:
+      image: ${{ steps.docker-build-push.outputs.image }}
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v5
+        with:
+          fetch-depth: 0
+
+      - uses: nais/docker-build-push@v0
+        id: docker-build-push
+        with:
+          team: fager
+          image_suffix: gotenberg
+          tag: ${{ github.sha }}
+          dockerfile: gotenberg/Dockerfile
+          docker_context: gotenberg
+          salsa: false
+
+  deploy-dev:
+    if: github.ref == 'refs/heads/main'
+    needs: [ compile-test-and-build ]
+    runs-on: ubuntu-latest
+    permissions:
+      id-token: write
+    steps:
+      - uses: actions/checkout@v5
+      - name: Deploy dev-gcp
+        uses: nais/deploy/actions/deploy@v2
+        env:
+          VAR: image=${{ needs.compile-test-and-build.outputs.image }}
+          RESOURCE: nais/dev-gcp-gotenberg.yaml
+          CLUSTER: dev-gcp
+
+  deploy-prod:
+    if: github.ref == 'refs/heads/main'
+    needs: [ compile-test-and-build ]
+    runs-on: ubuntu-latest
+    permissions:
+      id-token: write
+    steps:
+      - uses: actions/checkout@v5
+      - name: Deploy prod-gcp
+        uses: nais/deploy/actions/deploy@v2
+        env:
+          VAR: image=${{ needs.compile-test-and-build.outputs.image }}
+          RESOURCE: nais/prod-gcp-gotenberg.yaml
+          CLUSTER: prod-gcp

backend/README.md

@@ -11,6 +11,35 @@ Backend applikasjonen består av et rest endepunkt, en database for lagring av s
 Løsningen er utviklet i kotlin med ktor og bruker postgresql for datalagring. Forretningslogikk er frakoblet fra rest endepunktet via en Event sourcing arkitektur, hvor rest endepunktet kun er ansvarlig for å motta og validere søknader, og deretter trigge hendelser som håndteres av separate event handlers som inneholder all forretningslogikk.
 se [egen README.md](src/main/kotlin/no/nav/ekspertbistand/event/README.md) for mer informasjon om denne arkitekturen.
 
+## Dokumentgenerering (PDF)
+
+Søknads-PDF, tilskuddsbrev og arena-notat rendres fra Handlebars-maler til HTML og konverteres til PDF/A-2b av `ekspertbistand-gotenberg` (Gotenberg/Chromium). `DokumentService` er domeneadapteren, `DokumentRenderer` er den domeneuavhengige templating-kjernen, og `GotenbergClient` gjør HTML → PDF.
+
+- Maler og regler for dem: [`dokumentmaler/templates/README.md`](src/main/resources/dokumentmaler/templates/README.md).
+- Templating-kjernen: [`dokument/pdf/README.md`](src/main/kotlin/no/nav/ekspertbistand/dokument/pdf/README.md).
+
+### Lokal kjøring og tester
+
+Start Postgres og Gotenberg før `mvn verify`, på samme måte som Postgres-testene:
+
+```bash
+docker compose -f backend/docker-compose.yml up -d
+mvn -f backend/pom.xml verify
+```
+
+Testene når Gotenberg på `http://localhost:3003`. I CI kjører Gotenberg som service-container i `cicd-backend.yaml`. Testcontainers brukes ikke.
+
+### Visuell sammenligning
+
+`no.nav.ekspertbistand.executables.RenderDokumentmaler` rendrer alle `testdata/*.json` via lokal Gotenberg til `backend/target/dokumentmaler-preview/gotenberg/`. `RenderDokumentmalerDokgenLokal` henter de samme malene fra lokal dokgen (port 9000) til `backend/target/dokumentmaler-preview/dokgen/`. Filnavnene er like i begge mappene, så PDF-ene kan legges side om side eller diffes.
+
+```bash
+docker compose -f backend/docker-compose.yml up -d gotenberg dokgen
+mvn -f backend/pom.xml -q exec:java -Dexec.mainClass=no.nav.ekspertbistand.executables.RenderDokumentmalerKt -Dexec.classpathScope=test
+mvn -f backend/pom.xml -q exec:java -Dexec.mainClass=no.nav.ekspertbistand.executables.RenderDokumentmalerDokgenLokalKt -Dexec.classpathScope=test
+```
+
+
 
 ## Ny løsning for Ekspertbistand
 

backend/docker-compose.yml

@@ -16,3 +16,15 @@ services:
       - "9000:8080"
     environment:
       SPRING_PROFILES_ACTIVE: dev
+
+  gotenberg:
+    image: gotenberg/gotenberg:8.37.0
+    ports:
+      - "3003:3000"
+    environment:        # samme verdier som i nais (§4.2)
+      CHROMIUM_DISABLE_JAVASCRIPT: "true"
+      CHROMIUM_ALLOW_LIST: "^file:///tmp/.*"
+      API_DISABLE_DOWNLOAD_FROM: "true"
+      WEBHOOK_DISABLE: "true"
+      LIBREOFFICE_DISABLE_ROUTES: "true"
+      CHROMIUM_MAX_CONCURRENCY: "2"

backend/pom.xml

@@ -248,6 +248,13 @@
             <version>${graphql-kotlin.version}</version>
         </dependency>
 
+        <!-- Dokumentgenerering: Handlebars-templating i backend, HTML -> PDF/A i Gotenberg. -->
+        <dependency>
+            <groupId>com.github.jknack</groupId>
+            <artifactId>handlebars</artifactId>
+            <version>4.4.0</version>
+        </dependency>
+
         <dependency>
             <groupId>io.ktor</groupId>
             <artifactId>ktor-server-test-host-jvm</artifactId>
@@ -284,6 +291,27 @@
             <version>1.5.3</version>
             <scope>test</scope>
         </dependency>
+        <!-- HTML-validering av rendret mal-output (DokumentmalTest). -->
+        <dependency>
+            <groupId>org.jsoup</groupId>
+            <artifactId>jsoup</artifactId>
+            <version>1.21.2</version>
+            <scope>test</scope>
+        </dependency>
+        <!-- PDF/A-2b-validering av Gotenberg-output (integrasjonstest). -->
+        <dependency>
+            <groupId>org.verapdf</groupId>
+            <artifactId>validation-model</artifactId>
+            <version>1.28.1</version>
+            <scope>test</scope>
+        </dependency>
+        <!-- Tekstuttrekk fra generert PDF (integrasjonstest). -->
+        <dependency>
+            <groupId>org.apache.pdfbox</groupId>
+            <artifactId>pdfbox</artifactId>
+            <version>3.0.5</version>
+            <scope>test</scope>
+        </dependency>
     </dependencies>
     <build>
         <finalName>app</finalName>

backend/src/main/kotlin/no/nav/ekspertbistand/Application.kt

@@ -30,10 +30,13 @@ import no.nav.ekspertbistand.aareg.AaregClient
 import no.nav.ekspertbistand.altinn.AltinnTilgangerClient
 import no.nav.ekspertbistand.arena.ArenaClient
 import no.nav.ekspertbistand.arena.startKafkaConsumers
+import no.nav.ekspertbistand.audit.ArcSightAuditClient
 import no.nav.ekspertbistand.clamav.ClamAvClient
 import no.nav.ekspertbistand.dokarkiv.DokArkivClient
 import no.nav.ekspertbistand.dokarkiv.FagsakIdService
-import no.nav.ekspertbistand.dokgen.DokgenClient
+import no.nav.ekspertbistand.dokument.DokumentService
+import no.nav.ekspertbistand.dokument.gotenberg.GotenbergClient
+import no.nav.ekspertbistand.dokument.pdf.PdfKonverterer
 import no.nav.ekspertbistand.entraproxy.EntraProxyClient
 import no.nav.ekspertbistand.ereg.EregClient
 import no.nav.ekspertbistand.ereg.EregService
@@ -49,6 +52,7 @@ import no.nav.ekspertbistand.pdl.PdlApiKlient
 import no.nav.ekspertbistand.vedlegg.configureVedleggApiV1
 import no.nav.ekspertbistand.refusjon.configureRefusjonApiV1
 import no.nav.ekspertbistand.saksbehandling.configureSaksbehandlerApiV1
+import no.nav.ekspertbistand.saksbehandling.configureSaksbehandlingSakApiV1
 import no.nav.ekspertbistand.soknad.configureSoknadApiV1
 import no.nav.ekspertbistand.soknad.subjectToken
 import no.nav.ekspertbistand.tilgangsmaskin.TilgangsmaskinClient
@@ -86,7 +90,8 @@ fun main() {
 
             provide(AltinnTilgangerClient::class)
             provide(ClamAvClient::class)
-            provide(DokgenClient::class)
+            provide<PdfKonverterer>(GotenbergClient::class)
+            provide<DokumentService> { DokumentService(resolve()) }
             provide(DokArkivClient::class)
             provide(EregClient::class)
             provide(EregService::class)
@@ -98,6 +103,7 @@ fun main() {
             provide(AaregClient::class)
             provide(EntraProxyClient::class)
             provide(TilgangsmaskinClient::class)
+            provide<ArcSightAuditClient> { ArcSightAuditClient() }
             provide(FagsakIdService::class)
             basedOnEnv(
                 dev = { provide(KontoregisterClient::class) },
@@ -119,6 +125,11 @@ fun main() {
         configureTilsagnDataApiV1()
         configureEregApiV1()
         configureSaksbehandlerApiV1()
+        // Saksrutene for saksbehandling er ikke åpnet i prod ennå.
+        basedOnEnvSuspending(
+            prod = {},
+            other = { configureSaksbehandlingSakApiV1() },
+        )
         basedOnEnvSuspending(
             dev = { configureKontoregisterApiV1() },
             other = {}