$ show phax/phoss-smp
This repository implements a production-grade Service Metadata Publisher (SMP) server for the Peppol and OASIS BDXR eDelivery networks. It manages participant service groups, service metadata (endpoints, processes, document types), business cards, redirects, and participant migrations. The system exposes both a REST API (supporting Peppol SMP 1.x, BDXR 1.0, and BDXR 2.0 formats) and a Bootstrap-based web administration UI for managing all entities. It integrates with an external Service Metadata Locator (SML) for DNS-based participant registration and provides background jobs for SML synchronization, bulk endpoint changes, and import/export of service groups. The architecture is modular and backend-agnostic: core domain logic and interfaces reside in `phoss-smp-backend`, with three pluggable storage backends implemented via SPI — XML file-based (WAL DAO), SQL (JDBC with Flyway migrations supporting PostgreSQL, MySQL, Oracle, SQL Server, DB2), and MongoDB. The web application layer (`phoss-smp-webapp`) provides servlets, REST executors, and UI pages, with backend-specific webapp modules for each storage variant. Security features include HTTP Basic/Bearer token authentication, TOTP two-factor authentication, role-based authorization, audit logging, and CSP headers. The system is designed for high-volume eDelivery networks and includes caching, long-running job management, and extensive functional/integration tests. Key entry points include the REST API handlers (e.g., `APIExecutorServiceGroupPut`, `APIExecutorServiceMetadataGet`), the secure admin UI pages (e.g., `PageSecureServiceGroup`, `PageSecureSMLRegCreate`), and the application lifecycle listeners (`SMPWebAppListener`). External dependencies include the ph-commons/ph-oton framework stack, database drivers, and Peppol identifier libraries. The codebase is actively maintained with version 8.7.0 and demonstrates strong engineering practices including SPI-based extensibility, immutable domain objects, and consistent audit patterns.
The LLM identified 5 files worth highlighting for reuse:
Implements a Service Provider Interface (SPI) registry for pluggable storage backends (XML, SQL, MongoDB). Backends register via ISMPBackendRegistrarSPI and are discovered at runtime. This pattern allows the core SMP logic to be completely storage-agnostic, and a new backend can be added by implementing a single interface and registering it. Demonstrates clean separation of concerns and extensibility.
Provides a generation-based HTTP response cache for REST API responses. Cache entries are invalidated when the generation counter increments (triggered by data changes via callbacks). Supports manual cache entries and SPI-based custom cache providers. The design avoids per-request cache key computation overhead and ensures stale data is never served after mutations. Reusable in any REST API that needs conditional invalidation.
Builds parameterized SQL queries for paging, searching, and ordering across multiple SQL dialects (PostgreSQL, MySQL, Oracle, SQL Server, DB2). Handles column name whitelisting, LIKE escaping, and pagination clause generation. This is a self-contained utility that can be extracted and reused in any Java project needing portable SQL query construction with security-conscious column resolution.
A reusable server-side pagination UI component built with Bootstrap. Renders a header with page size selector and search input, and a footer with page links. Integrates with backend pagination via IPagingSpec. The component is self-contained and can be extracted for any web application needing consistent pagination controls with minimal coupling.
Centralized TOTP (Time-based One-Time Password) helper implementing RFC 6238 with SHA-1, SHA-256, SHA-512 support. Includes recovery code generation and validation with hashed storage. Designed for reuse in any Java application needing TOTP-based two-factor authentication. The helper is stateless and depends only on standard Java crypto libraries.