T

Stéphane Tailland f308b8264f Reconcile this repo's Flux entrypoints instead of applying them by hand

dev/ declares this repo's GitRepository, the Kustomization that deploys
./kong, and its ExternalSecrets — but nothing watched dev/, so those files
were applied once by hand and never re-read. Editing them in git changed
nothing until someone remembered to kubectl apply, which is what silently
swallowed the CONTROL_PLANE_REF_NAME rollout: correct in git for hours
while the cluster still held the old value.

Add the bootstrap Kustomization that watches ./dev and, living in ./dev,
manages itself. This is what `flux bootstrap` would have created;
flux-operator installs the controllers and no root.

It sits in the domain namespace rather than flux-system, because sourceRef
resolves in the Kustomization's own namespace and because this is the
team's to own.

Needs one kubectl apply to exist. That is the last one this repo needs.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

2026-08-27 14:33:04 +02:00

dev

Reconcile this repo's Flux entrypoints instead of applying them by hand

2026-08-27 14:33:04 +02:00

kong

Build sales-api REST + MCP layers (Layer 3), full build in one pass

2026-08-23 17:02:17 +02:00

openapi.yaml

Add the OpenAPI spec for the sales domain

2026-08-26 18:28:25 +02:00

README.md

Build sales-api REST + MCP layers (Layer 3), full build in one pass

2026-08-23 17:02:17 +02:00

README.md

sales-api

Kong routing/policy layer for the sales slice of classic-models-api (see /Users/stephanetailland/git/classic-models-api), split out per the DDD decomposition in ../kong-konnect-deployment-strategy.md. The backend stays a single monolith — only Kong does the domain split. Structure mirrors ../payments-api/../customers-api — single MCP route, not ../catalog-api's original two-route pattern (see ../STATUS.md section 18).

Two resources, both with a REST surface and MCP tools:

Order (single key ordernumber) — full CRUD + an order-details sub-resource (GET /sales/v1/orders/{ordernumber}/order-details/, mirrors the backend's own @action on OrderViewSet).
Orderdetail (composite key ordernumber + productcode, exposed as its own top-level resource — the backend does this too, not just nested under Order).

Route	Method	Backend path
`/sales/v1/orders/`	GET, POST	`/classic-models/api/v1/orders/`
`/sales/v1/orders/{ordernumber}/`	GET, PUT, PATCH, DELETE	`/classic-models/api/v1/orders/{ordernumber}/`
`/sales/v1/orders/{ordernumber}/order-details/`	GET	`/classic-models/api/v1/orders/{ordernumber}/order-details/`
`/sales/v1/orderdetails/`	GET, POST	`/classic-models/api/v1/orderdetails/`
`/sales/v1/orderdetails/{ordernumber}/{productcode}/`	GET, PUT, PATCH, DELETE	`/classic-models/api/v1/orderdetails/{ordernumber}/{productcode}/`
`/sales-mcp`	GET, POST, DELETE	MCP streamable-http (tools call into the REST routes above)

Auth & MCP tool ACLs

openid-connect on both surfaces (sales-api REST audience, mcp-sales MCP audience), RFC 8693 exchange chain MCP → sales-api → classic-models-api, same shape as every other domain. IdP: local Keycloak (https://keycloak.sttlab.local/realms/classic-models).

MCP write-tool ACLs (create-order, create-orderdetail) are admin + customer + support — deliberately different from customers-api's/ payments-api's admin-only write tools, because it's what the real backend permission classes actually allow, verified directly against authentication/permissions.py rather than assumed by analogy: OrderPermission.check()/OrderScopedPermission.check() give support an unconditional pass at the class-level (has_permission) check — the "status-only" restriction usually associated with support is enforced at the object level (has_object_permission), which only applies to existing records (update/delete), not create. read_only/ product_manager are excluded (both classes only pass those roles for SAFE_METHODS).

Correction to note: payments-api's create-payment tool (built earlier this session) restricted writes to admin only, described at the time as "verified against PaymentPermission's actual logic" — but PaymentPermission extends this same OrderScopedPermission base class, so by the same reasoning above, customer and support should also have been included there. Not fixed as part of this domain's build (out of scope, and it's more restrictive than the backend rather than less, so not a safety issue) — flagged here and in ../STATUS.md for whoever revisits payments-api's MCP tool ACLs.

Structure

Same dev/ + kong/rest/ + kong/mcp/ layout as payments-api. Deploy key and broker secret follow the same reused/mirrored pattern (catalog-api's deploy key, broker's real secret pulled live from Keycloak and copied to kong-v2/sales-api/* in Vault).