Merge pull request #130 from catenax-ng/main

Updates to IRS - EDC interaction, Introduction of new Aspect Types

.config/owasp-suppressions.xml

@@ -21,4 +21,11 @@
         <gav regex="true">com\.google\.guava:guava.*</gav>
         <vulnerabilityName>CVE-2023-2976</vulnerabilityName>
     </suppress>
+    <suppress>
+        <notes><![CDATA[
+        Vulnerability is a false positive.
+        ]]></notes>
+        <gav regex="true">com\.fasterxml\.jackson\.core:jackson\-databind.*</gav>
+        <vulnerabilityName>CVE-2023-35116</vulnerabilityName>
+    </suppress>
 </suppressions>

.github/workflows/owasp.yml

@@ -40,7 +40,7 @@ jobs:
           restore-keys: ${{ runner.os }}-m2
 
       - name: run maven owasp plugin
-        run: mvn --batch-mode install -Pdependency-check -DskipTests
+        run: mvn --batch-mode clean package dependency-check:aggregate -Pdependency-check -DskipTests
 
       - name: upload results
         if: always()

CHANGELOG.md

@@ -8,6 +8,17 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 ### Known knowns
 - PLACEHOLDER REMOVE IF EMPTY: risks that were introduced or discovered in the release and are known but not resolved
 
+## [3.1.0] - 2023-06-28
+### Changed
+- Removed catalog cache
+- Changed EDC catalog retrieval from pagination to filter
+- Item graphs with asBuilt lifecycle & downward direction are now built with usage of SingleLevelBomAsBuilt aspect, instead of AssemblyPartRelationship aspect
+- Changed retrieval of BPN value from AAS Shell to SingleLevelBomAsBuilt
+- Renamed SerialPartTypization to SerialPart aspect
+- ESS
+  - Update ESS notification asset creation to new EDC DSP protocol
+  - Include DiscoveryFinder into ESS flow
+
 ## [3.0.1] - 2023-06-28
 ### Fixed
 - Added missing participantId to contract negotiation for decentral DTR contract negotiation
@@ -247,7 +258,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 ### Unresolved
 - **Select Aspects you need**  You are able to select the needed aspects for which you want to collect the correct endpoint information.
 
-[Unreleased]: https://github.com/eclipse-tractusx/item-relationship-service/compare/3.0.1...HEAD
+[Unreleased]: https://github.com/eclipse-tractusx/item-relationship-service/compare/3.0.2...HEAD
+[3.0.2]: https://github.com/eclipse-tractusx/item-relationship-service/compare/3.0.1...3.0.2
 [3.0.1]: https://github.com/eclipse-tractusx/item-relationship-service/compare/3.0.0...3.0.1
 [3.0.0]: https://github.com/eclipse-tractusx/item-relationship-service/compare/2.6.1...3.0.0
 [2.6.1]: https://github.com/eclipse-tractusx/item-relationship-service/compare/2.6.0...2.6.1

DEPENDENCIES

@@ -42,7 +42,7 @@ maven/mavencentral/commons-io/commons-io/2.11.0, Apache-2.0, approved, CQ23745
 maven/mavencentral/commons-logging/commons-logging/1.2, Apache-2.0, approved, CQ10162
 maven/mavencentral/commons-validator/commons-validator/1.7, Apache-2.0, approved, clearlydefined
 maven/mavencentral/dev.failsafe/failsafe-okhttp/3.3.1, Apache-2.0, approved, #9178
-maven/mavencentral/dev.failsafe/failsafe/3.3.1, Apache-2.0, approved, clearlydefined
+maven/mavencentral/dev.failsafe/failsafe/3.3.1, Apache-2.0, approved, #9268
 maven/mavencentral/dk.brics.automaton/automaton/1.11-8, BSD-2-Clause, approved, clearlydefined
 maven/mavencentral/io.github.classgraph/classgraph/4.8.149, MIT, approved, CQ22530
 maven/mavencentral/io.github.resilience4j/resilience4j-annotations/2.0.2, Apache-2.0, approved, clearlydefined
@@ -56,9 +56,9 @@ maven/mavencentral/io.github.resilience4j/resilience4j-retry/2.0.2, Apache-2.0,
 maven/mavencentral/io.github.resilience4j/resilience4j-spring-boot3/2.0.2, Apache-2.0, approved, #7276
 maven/mavencentral/io.github.resilience4j/resilience4j-spring6/2.0.2, Apache-2.0, approved, #7277
 maven/mavencentral/io.github.resilience4j/resilience4j-timelimiter/2.0.2, Apache-2.0, approved, clearlydefined
-maven/mavencentral/io.micrometer/micrometer-commons/1.11.0, Apache-2.0, approved, clearlydefined
-maven/mavencentral/io.micrometer/micrometer-core/1.11.0, Apache-2.0, approved, clearlydefined
-maven/mavencentral/io.micrometer/micrometer-observation/1.11.0, Apache-2.0, approved, clearlydefined
+maven/mavencentral/io.micrometer/micrometer-commons/1.11.0, Apache-2.0 AND (Apache-2.0 AND MIT), approved, #9243
+maven/mavencentral/io.micrometer/micrometer-core/1.11.0, Apache-2.0 AND (Apache-2.0 AND MIT), approved, #9238
+maven/mavencentral/io.micrometer/micrometer-observation/1.11.0, Apache-2.0, approved, #9242
 maven/mavencentral/io.micrometer/micrometer-registry-prometheus/1.10.4, Apache-2.0, approved, #4721
 maven/mavencentral/io.minio/minio/8.5.4, Apache-2.0, approved, #9097
 maven/mavencentral/io.prometheus/simpleclient/0.16.0, Apache-2.0, approved, clearlydefined
@@ -69,7 +69,7 @@ maven/mavencentral/io.prometheus/simpleclient_tracer_otel_agent/0.16.0, Apache-2
 maven/mavencentral/io.swagger.core.v3/swagger-annotations-jakarta/2.2.7, Apache-2.0, approved, #5947
 maven/mavencentral/io.swagger.core.v3/swagger-annotations/2.2.0, Apache-2.0, approved, clearlydefined
 maven/mavencentral/io.swagger.core.v3/swagger-core-jakarta/2.2.7, Apache-2.0, approved, #5929
-maven/mavencentral/io.swagger.core.v3/swagger-core/2.2.0, Apache-2.0, approved, clearlydefined
+maven/mavencentral/io.swagger.core.v3/swagger-core/2.2.0, Apache-2.0, approved, #9265
 maven/mavencentral/io.swagger.core.v3/swagger-models-jakarta/2.2.7, Apache-2.0, approved, #5919
 maven/mavencentral/io.swagger.core.v3/swagger-models/2.2.0, Apache-2.0, approved, clearlydefined
 maven/mavencentral/io.swagger/swagger-annotations/1.6.8, Apache-2.0, approved, #3792
@@ -164,7 +164,7 @@ maven/mavencentral/org.jetbrains.kotlin/kotlin-stdlib-common/1.8.21, Apache-2.0,
 maven/mavencentral/org.jetbrains.kotlin/kotlin-stdlib-jdk7/1.5.31, Apache-2.0, approved, clearlydefined
 maven/mavencentral/org.jetbrains.kotlin/kotlin-stdlib-jdk7/1.8.21, Apache-2.0, approved, #8807
 maven/mavencentral/org.jetbrains.kotlin/kotlin-stdlib-jdk8/1.5.31, Apache-2.0, approved, clearlydefined
-maven/mavencentral/org.jetbrains.kotlin/kotlin-stdlib-jdk8/1.8.21, Apache-2.0, approved, #8875
+maven/mavencentral/org.jetbrains.kotlin/kotlin-stdlib-jdk8/1.8.21, Apache-2.0, approved, #8919
 maven/mavencentral/org.jetbrains.kotlin/kotlin-stdlib/1.6.20, Apache-2.0, approved, clearlydefined
 maven/mavencentral/org.jetbrains.kotlin/kotlin-stdlib/1.8.21, Apache-2.0, approved, #8865
 maven/mavencentral/org.jetbrains/annotations/13.0, Apache-2.0, approved, clearlydefined

README.md

@@ -60,7 +60,7 @@ curl -X 'POST' \
   -H 'Authorization: Bearer <token_value>' \
   -d '{
   "aspects": [
-    "SerialPartTypization"
+    "SerialPart"
   ],
   "bomLifecycle": "asBuilt",
   "depth": 1,

charts/irs-helm/CHANGELOG.md

@@ -6,6 +6,13 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [6.1.0]
+### Changed
+- Remove EDC Catalog cache configuration
+
+### Added
+- New configuration for ess asset creation EDC management API path `ess.managementPath`
+
 ## [6.0.1] - 2023-06-26
 ### Changed
 - Update IRS to version 3.0.1

charts/irs-helm/Chart.yaml

@@ -35,12 +35,12 @@ type: application
 # This is the chart version. This version number should be incremented each time you make changes
 # to the chart and its templates, including the app version.
 # Versions are expected to follow Semantic Versioning (https://semver.org/)
-version: 6.0.1
+version: 6.1.0
 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application. Versions are not expected to
 # follow Semantic Versioning. They should reflect the version the application is using.
 # It is recommended to use it with quotes.
-appVersion: "3.0.1"
+appVersion: "3.1.0"
 dependencies:
   - name: common
     repository: https://charts.bitnami.com/bitnami

charts/irs-helm/templates/configmap-spring-app-config.yaml

@@ -107,16 +107,13 @@ data:
         urn-prefix: {{ tpl (.Values.edc.submodel.urnprefix | default "/urn") . | quote }}
 
       catalog:
-        cache:
-          enabled: {{ .Values.edc.catalog.cache.enabled | default true }}
-          ttl: {{ .Values.edc.catalog.cache.ttl | default "P1D" | quote }}
-          maxCachedItems: {{ .Values.edc.catalog.cache.maxCachedItems | default 64000 }}
         policies:
           allowedNames: {{ .Values.edc.catalog.policies.allowedNames | default "" | quote }}
 
     ess:
       localBpn: {{ tpl (.Values.bpn | default "") . | quote }}
       localEdcEndpoint: {{ tpl (.Values.edc.provider.host | default "") . | quote }}
+      managementPath: {{ tpl (.Values.ess.managementPath | default "/management/v2") . | quote }}
       irs:
         url: {{ tpl (.Values.irsUrl | default "") . | quote }}
       discovery:

docs/src/api/irs-v1.0.yaml

@@ -903,7 +903,7 @@ components:
           owner: ""
           parameter:
             aspects:
-              - SerialPartTypization
+              - SerialPart
               - AddressAspect
             bomLifecycle: asBuilt
             collectAspects: false
@@ -965,7 +965,7 @@ components:
           owner: ""
           parameter:
             aspects:
-              - SerialPartTypization
+              - SerialPart
               - AddressAspect
             bomLifecycle: asBuilt
             collectAspects: false
@@ -1033,13 +1033,13 @@ components:
                   value:
                     - urn:bamm:com.catenax.vehicle:0.1.1#PartDetails
         submodels:
-          - aspectType: urn:bamm:io.catenax.assembly_part_relationship:1.0.0
+          - aspectType: urn:bamm:io.catenax.single_level_bom_as_built:1.0.0
             identification: urn:uuid:fc784d2a-5506-4e61-8e34-21600f8cdeff
             payload:
               catenaXId: urn:uuid:d9bec1c6-e47c-4d18-ba41-0a5fe8b7f447
-              childParts:
+              childItems:
                 - createdOn: 2022-02-03T14:48:54.709Z
-                  childCatenaXId: urn:uuid:d9bec1c6-e47c-4d18-ba41-0a5fe8b7f447
+                  catenaXId: urn:uuid:d9bec1c6-e47c-4d18-ba41-0a5fe8b7f447
                   lastModifiedOn: 2022-02-03T14:48:54.709Z
                   lifecycleContext: AsBuilt
                   quantity:
@@ -1105,7 +1105,7 @@ components:
           owner: ""
           parameter:
             aspects:
-              - SerialPartTypization
+              - SerialPart
               - AddressAspect
             bomLifecycle: asBuilt
             collectAspects: false
@@ -1143,7 +1143,7 @@ components:
           owner: ""
           parameter:
             aspects:
-              - SerialPartTypization
+              - SerialPart
               - AddressAspect
             bomLifecycle: asBuilt
             collectAspects: false
@@ -1211,13 +1211,13 @@ components:
                   value:
                     - urn:bamm:com.catenax.vehicle:0.1.1#PartDetails
         submodels:
-          - aspectType: urn:bamm:io.catenax.assembly_part_relationship:1.0.0
+          - aspectType: urn:bamm:io.catenax.single_level_bom_as_built:1.0.0
             identification: urn:uuid:fc784d2a-5506-4e61-8e34-21600f8cdeff
             payload:
               catenaXId: urn:uuid:d9bec1c6-e47c-4d18-ba41-0a5fe8b7f447
-              childParts:
+              childItems:
                 - createdOn: 2022-02-03T14:48:54.709Z
-                  childCatenaXId: urn:uuid:d9bec1c6-e47c-4d18-ba41-0a5fe8b7f447
+                  catenaXId: urn:uuid:d9bec1c6-e47c-4d18-ba41-0a5fe8b7f447
                   lastModifiedOn: 2022-02-03T14:48:54.709Z
                   lifecycleContext: AsBuilt
                   quantity:
@@ -1249,7 +1249,7 @@ components:
           owner: ""
           parameter:
             aspects:
-              - SerialPartTypization
+              - SerialPart
               - AddressAspect
             bomLifecycle: asBuilt
             collectAspects: false
@@ -1270,16 +1270,16 @@ components:
       value:
         lastUpdated: 2023-02-13T08:18:11.990659500Z
         models:
-          - urn: urn:bamm:io.catenax.assembly_part_relationship:1.1.1#AssemblyPartRelationship
-            name: AssemblyPartRelationship
+          - urn: urn:bamm:io.catenax.single_level_bom_as_built:1.0.0#SingleLevelBomAsBuilt
+            name: SingleLevelBomAsBuilt
             status: RELEASED
             type: BAMM
-            version: 1.1.1
-          - urn: urn:bamm:io.catenax.serial_part_typization:1.1.0#SerialPartTypization
-            name: SerialPartTypization
+            version: 1.0.0
+          - urn: urn:bamm:io.catenax.serial_part:1.0.0#SerialPart
+            name: SerialPart
             status: RELEASED
             type: BAMM
-            version: 1.1.0
+            version: 1.0.0
   schemas:
     AdministrativeInformation:
       type: object

docs/src/docs/arc42/glossary.adoc

@@ -14,5 +14,5 @@
 |PRS |Formerly known Service Name: Parts Relationship Service
 |Traversal Aspect |aka Edge: Aspect which the IRS uses for traversal through the data chain. Identified by a parent-child or a child-parent relationship.
 
-Samples: SingleLevelBomAsPlanned, AssemblyPartRelationship and SingleLevelUsageAsBuilt
+Samples: SingleLevelBomAsPlanned, SingleLevelBomAsBuilt and SingleLevelUsageAsBuilt
 |===

docs/src/docs/arc42/introduction-goals/requirements.adoc

@@ -9,7 +9,7 @@ The IRS is a:
 - Data chain provider
 
 == Substantial Features
-- provide a top-down BoM asBuilt tree structure along the submodel "AssemblyPartRelationship"
+- provide a top-down BoM asBuilt tree structure along the submodel "SingleLevelBomAsBuilt"
 - usage of EDC consumer for communicating with the Catena-X network
 - functionality of IRS provider will be handled by providers submodel servers
 - federated IRS service

docs/src/docs/arc42/runtime-view/scenario-2.adoc

@@ -12,7 +12,7 @@ include::../../../uml-diagrams/runtime-view/job-execution.puml[]
 
 After a job has been created (see Scenario 1: Create Job), the first transfer containing the root item ID is passed to the ExecutorService. The transfer is then started asynchronously and retrieves the necessary information from the Catena-X network, first by fetching the AAS information from the DigitalTwin registry and then calling the SubmodelProviders for the submodel payload.
 
-At least the aspect AssemblyPartRelationship is required for the tree to be built. If the customer that started the job provided more aspects to be fetched, they will be retrieved here too.
+At least the aspect SingleLevelBomAsBuilt is required for the tree to be built. If the customer that started the job provided more aspects to be fetched, they will be retrieved here too.
 The result of each transfer is stored in the BlobStore.
 
 After the transfer process has finished, any subsequent child IDs will be extracted and new transfer processes will be scheduled for those via the ExecutorService. This cycle repeats until all leafs were reached, the specified max depth has been reached, or the job was canceled externally.

docs/src/docs/arc42/scope-context/technical-context.adoc

@@ -13,7 +13,7 @@ We provide a REST API that can be consumed by any system registered in the Caten
 In order to consume the Restful application IRS, the security aspect should be taken in consideration. IRS is a Spring Boot based application and is secured with the OpenID connector provider Keycloak and the OAuth2. This means for the consumers (users) that they need to authenticate themselves in order to be authorized to get access to the IRS. They generate a bearer token that they get from Keycloak and attach it to the HTTP header parameter Authorization. Certainly, both a consumer and the IRS should use the same configured Keycloak Realm.
 
 === Registry API
-The IRS acts as a consumer of the component Asset Administration Shell Registry. The IRS contains a Restful client (REST template) that build a REST call to the mentioned Digital Twin Registry API based on its known URL (the AAS registry URL is configured in the IRS Restful API). The request contains the given "globalAssetId" by the consumer. Like described in the above section, the security aspect is required in order to achieve a REST call against the AAS Registry. As a response, the IRS gets the corresponding asset administration shell descriptor. The last one contains a list of submodel descriptors which can be filtered by the aspect type entered by the consumer. An aspect type like AssemblyPartRelationship, SerialPartTypization etc. And as mentioned above, the transport protocol HTTP(S) is used for the REST call communication.
+The IRS acts as a consumer of the component Asset Administration Shell Registry. The IRS contains a Restful client (REST template) that build a REST call to the mentioned Digital Twin Registry API based on its known URL (the AAS registry URL is configured in the IRS Restful API). The request contains the given "globalAssetId" by the consumer. Like described in the above section, the security aspect is required in order to achieve a REST call against the AAS Registry. As a response, the IRS gets the corresponding asset administration shell descriptor. The last one contains a list of submodel descriptors which can be filtered by the aspect type entered by the consumer. An aspect type like SingleLevelBomAsBuilt, SerialPart etc. And as mentioned above, the transport protocol HTTP(S) is used for the REST call communication.
 
 ==== Discovery Service
 In a decentralized system, the digital twin registry is moved behind an EDC. To access the registry of a data provider, a new set of central services was introduces. These discovery services consist of BPN Discovery, Discovery Finder and EDC Discovery.

docs/src/uml-diagrams/cross-cutting/data-model-job-response.puml

@@ -66,8 +66,8 @@ enum BomLifecycle {
 
 enum AspectType {
     ---
-    SerialPartTypization
-	AssemblyPartRelationship
+    SerialPart
+	SingleLevelBomAsBuilt
 	PartDimension
 	SupplyRelationData
 	PCFCoreData

docs/src/uml-diagrams/cross-cutting/json-response-model.puml

@@ -21,7 +21,7 @@ skinparam shadowing false
              }},
             "queryParameter": {
                 "bomLifecycle" : "asBuilt",
-                "aspect" : ["SerialPartTypization", "Contact"],
+                "aspect" : ["SerialPart", "Contact"],
                 "depth": 4,
                 "direction": "downward"
              },

docs/src/uml-diagrams/runtime-view/aas-shell-and submodel-processing.puml

@@ -18,7 +18,7 @@ note right
     IRS API endpoint
     POST /isr/jobs with
     {globalAssetId: urn:uuid:<uuid4>,
-    aspects [SerialPartTypization, SupplyRelationData]]}
+    aspects [SerialPart, SupplyRelationData]]}
 end note
 AASTransferProcessManager -> AASTransferProcessManager : initiateRequest
 note left