Levandor

nyilvantarto_scraper — KKSZB & nyilvantarto.hu RabbitMQ service

15 min read

nyilvantarto_scraper

Two services, one repo

Despite the name, this repo bundles two Hungarian government ID-verification services:

  1. KKSZB — a structured REST/SOAP client to the Hungarian government interop gateway (gw.kkszb.gov.hu) that retrieves official document/person data + portrait images by 4T personal data or document number. This is the service that the deployable node server actually starts.
  2. Nyilvantarto Scraper — a Puppeteer-based browser scraper of the public www.nyilvantarto.hu ID-validity web form, behind an internal proxy, with captcha decoding delegated to the CV service. Its code is present and wired (NyilvantartoScraperRPCServer), but it is NOT registered in the current server.js boot path (see Gotchas).

Source of truth for purpose: README.md:1-3 (“KKSZB & nyilvantarto.hu RabbitMQ service”), README.md:5-6 (KKSZB), README.md:498-501 (Scraper). package.json:2 name nyilvantarto_scraper, version 2.0.4.

Repo: github.com/TechTeamer/nyilvantarto_scraper (package.json:20-23). Base branch main, HEAD 6e52f0e “chore: [fkqa-327] maintenance/main (#37)” by Balázs Horváth, 2026-05-11.

1. Purpose & role in FaceKom

This is a back-end RabbitMQ RPC microservice — there is no HTTP server of its own; it exposes its functionality only over an AMQP RPC queue (@techteamer/mq). It is the FaceKom component responsible for Hungarian official-identity document verification and data/image retrieval, producing tamper-evidence ZIP bundles of every request/response/OCSP exchange.

  • KKSZB RPC contract (README.md:147-206): two endpoints, getDocumentDataBy4T and getDocumentDataByIdNumber, returning QueryResponse | ErrorResponse plus image + evidence attachments.
  • Document types handled (server/kkszb/kkszb.d.ts:18): szig (Személyazonosító igazolvány), rszig (régi személyi), utl (Útlevél/passport), ven (Vezetői engedély/driving licence). Descriptions: README.md:210-218.
  • The scraper half checks live ID validity against the public portal and zips the proof of interaction (README.md:498-549, server/service/NyilvantartoScraperService.js).

Naming

“nyilvantarto” = Hungarian for “register/registry”; nyilvantarto.hu is the Hungarian government records portal. “KKSZB” is the Hungarian central government service-bus / interop gateway.

2. Tech stack & runtime

AspectValueSource
LanguageJavaScript (CommonJS, require), with // @ts-check + JSDoc typing and hand-written .d.ts.eslintrc.json:20 (commonjs: true), server/kkszb/kkszb.d.ts, // @ts-check headers
RuntimeNode.js >= 20.15.0package.json:17-19 (engines.node)
CI NodeNode 20 on Ubuntu Jammy.travis.yml:6-7
Package managerYarn 1.x (Classic; yarn.lock present, 124.7 KB; CI pins 1.22.22)yarn.lock, .travis.yml:25, test/scripts/travis.sh:6
Messaging@techteamer/mq ^7.2.0 (RabbitMQ RPC)package.json:26
HTTP clientnode-fetch ^2.7.0 (CV calls) + native node:http/node:https (KKSZB calls)package.json:34, server/util/request.js, server/service/CVService.js:1
XML/SOAPfast-xml-parser ^4.5.0package.json:29, server/kkszb/UtlIdQueryProcessor.js:3
Zip/evidencearchiver ^7.0.1package.json:27, server/util/store.js:5
Multipartformdata-node ^6.0.3 + form-data-encoder ^4.0.2 (CV captcha upload)package.json:30-31, server/service/CVService.js:3-5
CLIcommander ^12.1.0package.json:28, bin/kkszbquery:6
Configgetconfig ^4.5.0package.json:32, config.js:6
Logginglog4js ^6.9.1package.json:33, logger.js:2
Browser scraping@techteamer/scraper (Puppeteer wrapper)server/service/NyilvantartoScraperService.js:3

@techteamer/scraper / Puppeteer is NOT a declared dependency

server/service/NyilvantartoScraperService.js:3 does require('@techteamer/scraper'), but @techteamer/scraper does not appear in package.json dependencies (lines 25-35). The scraper path would fail to resolve at runtime in this base clone unless that dep is added by a customization/build overlay. This is consistent with the scraper service being unwired in server.js.

Hand-rolled type system

No tsconfig.json. Types are enforced via // @ts-check pragmas + JSDoc @typedef referencing server/kkszb/kkszb.d.ts (the central type file: Data4T, DocumentType, KkszbConfig, processor interfaces, EvidenceConfig). There is no compile step — npm run build is echo OK (package.json:10).

LFS / binaries: no .gitattributes, no Git-LFS pointer files, no Dockerfile, no model weights in this repo. test/bin/fakekkszb is a plain Node script (verified file = “node script text executable”, not a binary).

3. Build & run

Entry points

  • Service (deployable): node server → resolves server.js (package.json has no main; supervisor uses command=node server). Boot sequence in server.js:1-45:
    1. process-settings (TZ=UTC, optional self-signed TLS) — server.js:1, server/bootstrap/process-settings.js.
    2. process-listeners(true) (uncaughtException/unhandledRejection/SIGTERM-SIGINT graceful exit) — server.js:2, server/bootstrap/process-listeners.js.
    3. Build RabbitMQ ConnectionPool named 'nyilvantarto' — server.js:39, server/bootstrap/connection/rabbitmq.js.
    4. Instantiate KkszbService with config.clone('kkszb') — server.js:13-16.
    5. Register RPC server kkszb-rpc (class KkszbRPCServer) on connection nyilvantarto, then connectionPool.connect() — server.js:25-30.
  • CLI: bin/kkszbquery (#!/usr/bin/env node) — manual test calls to KKSZB. See §5.
  • Integration runner CLI: bin/qtspintegrity (#!/usr/bin/env -S node --test) — runs as a Node test file against the real QTSP KKSZB TEST server. See §5.

package.json scripts (verbatim, package.json:7-16)

ScriptCommandWhat it does
linteslint . ./bin/**/* ./bin/* && echo 'npm run lint: OK'ESLint over the tree + bin scripts; prints OK on success.
lint:fixeslint . ./bin/**/* ./bin/* --fixSame, auto-fixing.
buildecho OKNo-op build (no transpile step).
testc8 --src server --reporter=lcov --reporter=html --report-dir=test/coverage --exclude="node_modules/**" --exclude="test/**" node --test ./test/**/**/*.test.jsRuns all *.test.js (unit + integration) under coverage via c8 + native node --test; lcov+html into test/coverage.
test:silentsame as test but > /dev/null 2>&1Quiet run (used by CI).
test:unitnode --test test/unitUnit tests only, no coverage.
test:integrationnode --test test/integrationIntegration tests only, no coverage.
test:coverage:allc8 --all --src server ... node --test ./test/**/**/*.test.jsLike test but --all so uncovered server files are counted too.

Start commands (verified)

  • Production/dev process manager: supervisord, command=node server, directory=/workspace/nyilvantarto, restart on exit codes 0,2, stopsignal=TERM, stopwaitsecs=5. Two confs differ only by RUNTIME_ENV:
    • supervisor_nyilvantarto_scraper_dev.conf:6-7 → RUNTIME_ENV="dev".
    • supervisor_nyilvantarto_scraper_docker.conf:6-7 → RUNTIME_ENV="docker".
  • No Dockerfile in repo (verified). Image build is presumably external (e.g. via vuer_docker); not evidenced here.

Config selection is by RUNTIME_ENV (getconfig)

getconfig picks config/<RUNTIME_ENV>.json. The repo ships config/dev.json and config/docker.json. RUNTIME_ENV=travisci is synthesized in CI by copying dev → travisci (.travis.yml:27).

4. Top-level structure

PathRoleVerified
server.jsService entrypoint; boots settings, RabbitMQ, KkszbService, kkszb-rpc serverread
config.jsgetconfig wrapper adding .get/.has/.clone; CV-host derivation for dev; travisci queue override; JSON syntax-error pretty printerread
logger.jslog4js colored stdout logger, category nyilvantarto-scraperread
config/dev.json, docker.json — full service config (queue, kkszb, scraper, hosts)read both
server/bootstrap/process-settings.js, process-listeners.js, connection/rabbitmq.jsread all
server/service/KkszbService.js (active), NyilvantartoScraperService.js, CVService.jsread all
server/kkszb/KKSZB core: KkszbApi, Context, DocumentRequestProcessorFactory, 12 per-doc-type processors, 2 image processors, base processor.js, 4 error classes, kkszb.d.tsread key files; rest mapped
server/queue/rpc_server/KkszbRPCServer.js (registered), NyilvantartoScraperRPCServer.js (not registered in server.js)read both
server/queue/rpc_client/KkszbRPCClient.js, NyilvantartoScraperRPCClient.js — client helpers for other servicesread both
server/util/request.js (http/https send), certificate.js (OCSP via openssl), store.js (zip/unzip), stream.js (ConcatStream), xml.js (fxp SOAP→JSON), error.js (errorResult)read all
server/validator/Validator.js — regex/required field validator for scraper inputread
server/service_container.jsSingleton DI container + ServiceBus EventEmitter (hooks/overrides)read
bin/kkszbquery, qtspintegrity — first-party CLIs (see §5)read both
test/unit + integration tests, mocks, fake KKSZB server, travis scriptsampled
maintenance/2026-04-07.md, 2026-05-04.md — yarn outdated audit logs / pending dep upgradesread latest
security/2026-04-07.md, 2026-05-04.md — yarn audit logs (fast-xml-parser + uuid advisories)read latest
changelog.mdVersion history 1.0.0 → 2.0.4read
.travis.ymlCI: yarn install, yarn audit (fail on CRITICAL ≥16), tests, SonarCloud scanread
sonar-project.propertiesSonarCloud config (TechTeamer_nyilvantarto_scraper)read
build.ignoreFiles excluded from production runtime build (dev.json, test/, *.md, eslint, _dev.conf …)read
.eslintrc.json / .eslintignoreESLint standard + plugin:n rulesetread
.editorconfig2-space, LF, utf-8, max 240 colsread

5. First-party bin scripts

Scope

Only two first-party bin scripts exist. (CI’s travis.sh:21 references ./customization/bin/ and ./test/customization/travis/ paths — a customization-overlay convention — but no such dirs exist in this base clone; see customization-architecture.)

bin/kkszbquery (#!/usr/bin/env node)

A commander CLI to make ad-hoc test calls to the live KKSZB service. Builds a real KkszbService from config.clone('kkszb') (forcing https:true, port:443). Two subcommands:

  • personal-data <documentType> [options] (bin/kkszbquery:43-98): 4T lookup → service.getDocumentDataBy4T. Required -bD/--birthDate; optional birthPlace, gender, birth/legal surname/forenames, mother’s name, --identityMatchLevel, -i/--image, -v/--verbose (full base64), -f/--file (write evidence ZIP).
  • document-number <documentType> [options] (bin/kkszbquery:100-146): ID lookup → service.getDocumentDataByIdNumber. Required -d/--documentNumber; same image/verbose/file flags.
  • <documentType> is constrained to ['szig','rszig','utl','ven'] (bin/kkszbquery:29,47,104). By default it truncates returned image base64 to 32 chars (TRUNCATED_IMAGE_LENGTH, :19-26) unless --verbose.

bin/qtspintegrity (#!/usr/bin/env -S node --test)

A live integration smoke-test harness executed as a Node test file (shebang runs node --test). Builds the same real KkszbService (https:true, port:443 + config.clone('kkszb')) and asserts known fixtures against the QTSP KKSZB TEST server (bin/qtspintegrity:32):

  • rszig id query for AF519034 (expects “VARGA KATALIN”, :50-82).
  • szig id query for 112891TT (:101-147).
  • utl 4T + id queries for SAMPLE/TÓDOR / BH0003919 (:149-217).
  • rszig/szig 4T cases are present but { todo:true, skip:true } (:34,85).
  • Helper removeImageIdentifiers nulls portrait/signature IDs before deep-equal (:23-30).

bin/qtspintegrity hits the real government TEST endpoint

Running it requires valid kkszb config + tokens and network access to the KKSZB test gateway; it is not a hermetic unit test.

6. Key modules / entities

KKSZB service path (active)

  • server/service/KkszbService.js — the registered service. Public API: getDocumentDataBy4T(documentType, includeImage, data4T) and getDocumentDataByIdNumber(documentType, includeImage, documentId) (:74,105). Both create a Context (evidence collector), call KkszbApi, optionally fetch images, zip evidence, strip raw image fields from adatLista before returning { error:false, adatLista, imageList, evidence } or an errorResult. _createConfig (:156-183) hard-validates the kkszb config via KkszbConfigError (missing baseUrl/port/https/apis/token throw). _createAgentConfig (:190-202) builds an https.Agent with maxCachedSessions:0 (fresh cert every request) only if caCheck.enabled — this is what gates OCSP.
  • server/kkszb/KkszbApi.js — the engine (:29). Constructor wires a DocumentRequestProcessorFactory with per-document-type processors (:45-62):
    • 4T (JSON): szig, rszig plain; utl, ven get endpointId (SOAP).
    • ID: szig/rszig JSON; utl/ven SOAP via UtlIdQueryProcessor/VenIdQueryProcessor.
    • Image: szig/rszig → ImageJsonRequestProcessor (separate kepLekeres REST call by arckepmasAzonosito); utl/ven → ImageSoapRequestProcessor wrapping the ID processor (image arrives inline as arckep).
    • Picks request.sendHttps vs sendHttp by config.https (:37). Each request gets a crypto.randomUUID() request-id and records 5 evidence files (request header [sensitive x-kk-authentication stripped], payload, response header, response data, OCSP) into the Context (:97-101,152-156,203-207). getImageList runs per-document image fetches with Promise.allSettled (:124).
  • server/kkszb/Context.js — evidence accumulator honoring the fine-grained EvidenceConfig (boolean | per-document/image | per-evidence-type), skipping empty values, producing a ZIP via store.createZip (:28-62).
  • Processors (server/kkszb/*Processor.js, base processor.js): each implements path()/payload()/header()/json(). processor.js provides jsonHeader (sets x-kk-authentication token + x-request-id), json4T (maps English Data4T → Hungarian SOAP/JSON field names, nemKod female→‘N’ else ‘F’, lekerdezesCelja:'Ügyfél azonosítás'), parseData, and soapHeader (idomsoft mediator namespaces). Szig4TQueryProcessor (server/kkszb/Szig4TQueryProcessor.js, class Data4TJsonRequestProcessor) is the JSON 4T template; UtlIdQueryProcessor builds a soap:Envelope with fast-xml-parser XMLBuilder and parses the SOAP response (or a SOAP Fault → KkszbDataError) back to JSON (server/kkszb/UtlIdQueryProcessor.js:57-126).
  • Error classes (server/kkszb/): KkszbApiError (technical), KkszbDataError (carries issue + Response, message Response status: N), KkszbConfigError (field + MISSING|TYPE_ERROR|FORMAT_ERROR), KkszbMissingResourceError (missing arckepmasAzonosito/okmanyAzonosito). server/util/error.js#errorResult maps thrown errors → {error:true,name,message,issue?}; Kkszb*-prefixed names are “data errors”, others (OcspError, Error, UnkownError) are “technical” (README.md:434-470).

RPC surface

  • server/queue/rpc_server/KkszbRPCServer.js (registered as kkszb-rpc) — extends mq.RPCServer, forces timeoutMs:300000 & prefetchCount:undefined (:12). Registers actions getDocumentDataBy4T and getDocumentDataByIdNumber (:14-15) delegating to serviceContainer.service.kkszb. _response (:57-81) converts each image to a Buffer RPC attachment keyed {i}_portrait_image, returns {error:false,imageType,attachmentKey} per image, and attaches the evidence ZIP.
  • server/queue/rpc_server/NyilvantartoScraperRPCServer.js (NOT registered in server.js) — validates the incoming msg via Validator, runs a NyilvantartoScraper, attaches zipContent, returns the validity result.
  • server/queue/rpc_client/* — caller-side helpers other FaceKom services would extends RPCClient: KkszbRPCClient (getDocumentDataBy4T/ByIdNumber, default 30 s) and NyilvantartoScraperRPCClient (verifyID(...) mapping the 7 Hungarian fields).

KkszbRPCClient payload shape diverges from the server

KkszbRPCClient.getDocumentDataBy4T sends { documentType, customerSignature, customerPortrait, birthName, birthDate, birthPlace, mothersBirthName } (server/queue/rpc_client/KkszbRPCClient.js:4-5), but KkszbService.getDocumentDataBy4T / processor.json4T consume { legalSurname, legalForenames, birthSurname, birthForenames, mothersSurname, mothersForenames, birthPlace, birthDate, gender, identityMatchLevel } (server/kkszb/processor.js:26-39, server/kkszb/kkszb.d.ts:5-16). The client helper appears stale relative to the v2 server contract — verify field mapping before relying on it.

Scraper service path (present, unwired)

  • server/service/NyilvantartoScraperService.js — class NyilvantartoScraper extends Scraper (@techteamer/scraper). Drives a Puppeteer page against config.scraper.path (/ugyseged/OkmanyErvenyessegLekerdezes.xhtml), waits for the form, delegates captcha image to CVService.decodeCaptcha (:77-85), fills the JSF form (okmanyTipus, okmanyAzonosito, names, captcha; anyjaNeve only for SZIG/REGI_SZIG), submits, screenshots open + filled form into a ZIP archive, and parses the Hungarian result message to set isSuccess (:209-216). getZipBuffer() finalizes the archive.
  • server/service/CVService.js — HTTP client to the CV service (vuer_cv). decodeCaptcha uploads the captcha JPEG to POST {cvHost}/api/v1/image-upload, then POST /api/v1/kaptcha-decoder to OCR it (:96-138); ping hits /api/v1/ping (:68-88). Picks a random CV host from config.hosts.cvs (mutual-TLS agent if cert/key/ca present).
  • server/validator/Validator.js — rule engine (regex pattern / type / required / options) for scraper input fields: utoNev, csaladiNev, okmanyAzonosito (regex ^\d{6}[A-Za-z]{2}$|^[A-Za-z]{2}\d{6,7}$), okmanyTipus ∈ {SZEMELYI_IGAZOLVANY, REGI_SZEMELYI_IGAZOLVANY, VEZETOI_ENGEDELY, UTLEVEL}, szuletesiHely, szuletesiIdo, anyjaNeve (required only for the two SZIG types).

Cross-cutting

  • server/service_container.js — exported singleton { emitter: ServiceBus }. ServiceBus extends EventEmitter adds a hook system (addHook/callHooks/callOnlyHook) and an override registry (registerOverride/callOverride) — the extension seam customizations use (server.js:29 calls emitter.callHooks('queue', connectionPool)).
  • server/util/certificate.js — OCSP revocation check by shelling out to openssl ocsp (:63), throwing OcspError on revoked/expired/missing.
  • server/util/store.js — createZip (archiver) and a hand-written extractZip that parses ZIP local-file headers + zlib-inflates entries (:49-73).

7. Configuration

Config is loaded by getconfig (env RUNTIME_ENV → config/<env>.json), wrapped by config.js to add .get(path, default), .has(path), .clone(path, default) and to:

  • derive config.hosts.cv from /etc/hostname (or DEV_DOMAIN) when RUNTIME_ENV is dev/travisci (config.js:39-50),
  • override config.queue.url='amqp://localhost:5672' under travisci (config.js:52-55),
  • fan hosts.cv → hosts.cvs:[{host}] (config.js:57-61),
  • pretty-print + process.exit(2) on a JSON syntax error in the config file (config.js:7-37).

Config keys (from config/dev.json / config/docker.json)

PathPurposedev vs docker
settings.listenProcessWarninglog Node process 'warning' eventsboth true
settings.allowSelfSignedCerts(consumed in process-settings.js:6) sets NODE_TLS_REJECT_UNAUTHORIZED=0not present in shipped configs (default off)
server.queueName"nyilvantarto-scraper"docker only (config/docker.json:5-7) — note server.js does not read this
queue.urlamqps://rabbitmq:5671both
queue.optionsmTLS: rejectUnauthorized:false + client cert/key + CA from /workspace/vuer_mq_cert/...both
queue.rpcTimeoutMs / queue.rpcQueueMaxSize10000 / 100both
kkszb.httpsfalse (dev) / true (docker)differs
kkszb.baseUrlgw.int-kkszb.gov.hu (dev) / gw.kkszb.gov.hu (docker)differs
kkszb.endpointId127.0.0.1 (SOAP vegpontAzonosito)both
kkszb.port443both
kkszb.evidencetrue (collect all evidence)both
kkszb.caCheck.{enabled,caCertFile}enabled:true, caCertFile:"" — gates OCSP + mTLS agentboth
kkszb.token.{szig,rszig,utl,ven}.{adat4T,okmanyszam} + kkszb.token.kepLekeresper-doc API tokens via $$ENV substitutionboth
kkszb.apis.*KKSZB interop paths (/interop/<doc>/lek/{4T,okmany}/v1, image /interop/szig/lek/kep/v1)both
hosts.cvCV host (empty; derived at runtime in dev)both
scraper.port 8080, scraper.path /ugyseged/OkmanyErvenyessegLekerdezes.xhtmlscraper targetboth
scraper.captchaTimeout 5000captcha decode timeout (ms)both
scraper.proxy.targethttps://www.nyilvantarto.hu:443 + 5 s proxy/timeoutboth
scraper.ipFilter 195.228.130.13, scraper.browser.puppeteer (headless, --no-sandbox, --shm-size=8gb …), scraper.ocsp.agent, scraper.savescraper/browserboth

Env vars (verified)

VarUseSource
RUNTIME_ENVselects getconfig file; dev/travisci trigger CV-host + queue overridesconfig.js:39,52, supervisor confs
DEV_DOMAINoverrides /etc/hostname for CV-host derivation (dev)config.js:40-42
NODE_ENVset to travisci in CI.travis.yml:13
DOCKER_USERsupervisor user=%(ENV_DOCKER_USER)ssupervisor confs :8
$$USZIG_4T_TOKEN, $$USZIG_OKMANYSZAM_TOKEN, $$RSZIG_4T_TOKEN, $$RSZIG_OKMANYSZAM_TOKEN, $$UTLEVEL_4T_TOKEN, $$UTLEVEL_OKMANYSZAM_TOKEN, $$VEZETOI_4T_TOKEN, $$VEZETOI_OKMANYSZAM_TOKEN, $$KEP_TOKENKKSZB API tokens substituted into configconfig/*.json:26-44, README.md:107-129
process.env.TZforced to Etc/UTC at bootserver/bootstrap/process-settings.js:4

Config validation is code, not AJV

There is no AJV schema. Config correctness for KKSZB is enforced imperatively in KkszbService._createConfig / _assertKkszbConfig / _assertString, throwing KkszbConfigError on missing/wrong-typed fields (server/service/KkszbService.js:156-251). Local secrets live in config/local.json (git-ignored, .gitignore:7).

8. Tests

  • Framework: native node --test + node:assert/strict; coverage via c8. No Jest (despite eslint-plugin-jest being installed). package.json:11-15.
  • Location: test/unit/kkszb/*.test.js (11 processor/Context unit tests), test/integration/kkszb/*.test.js (8 {Rszig,Szig,Utl,Ven}{4T,Id}Query tests), test/mock/ (FakeServiceContainer, per-doc-type handlers, FakeServer.js HTTP fake KKSZB), test/bin/fakekkszb (manual harness to drive kkszbquery against the fake server), test/scripts/travis.sh (CI driver).
  • Unit tests (e.g. test/unit/kkszb/Szig4TQueryProcessor.test.js) assert path/payload/header/json and error mapping (KkszbDataError issue extraction, KkszbApiError on non-JSON) with no network.
  • Integration tests run against the in-repo FakeServer (test/mock/kkszb/FakeServer.js) which routes URLs like /rszig/4T/ok/no-image to canned handlers.
  • How to run: yarn test (all, with coverage), yarn test:unit, yarn test:integration. Coverage reports → test/coverage/ (lcov + html).
  • CI (test/scripts/travis.sh): yarn install --frozen-lockfile → yarn audit (fail only on CRITICAL, exit ≥16) → yarn test:silent → git diff --exit-code (no uncommitted changes) → assert no stray executables outside whitelisted dirs (:21-27), then SonarCloud scan (.travis.yml:29-33, needs JDK 17).

test/coverage/.gitkeep only

The coverage dir is committed empty; reports are generated, not stored (.gitignore:14-16).

9. Dependencies on other FaceKom services

DependencyDirectionEvidence
RabbitMQ (amqps://rabbitmq:5671, mTLS)This service is an RPC server on connection nyilvantarto, RPC name kkszb-rpc, actions getDocumentDataBy4T/getDocumentDataByIdNumberserver.js:25-30, config/*.json:8-15, server/queue/rpc_server/KkszbRPCServer.js:14-15
RabbitMQ client certsReads /workspace/vuer_mq_cert/client/{cert,key}.pem + ca/cacert.pemconfig/*.json:9-11 — see vuer_docker for cert provisioning
CV service (vuer_cv)This service is an HTTP client → GET /api/v1/ping, POST /api/v1/image-upload, POST /api/v1/kaptcha-decoder (captcha OCR)server/service/CVService.js:72,105,119; host from config.hosts.cvs, dev host cv<sep><devDomain> (config.js:47-49)
KKSZB gov gateway (external, not FaceKom)HTTP/SOAP client → gw[.int]-kkszb.gov.hu:443/interop/...config/*.json:16-66, server/kkszb/KkszbApi.js:85-92
nyilvantarto.hu portal (external)Puppeteer-via-proxy scrape (scraper path only)config/*.json:71-83, server/service/NyilvantartoScraperService.js
OpenSSL binaryShelled out for OCSP (openssl ocsp ...)server/util/certificate.js:63

No DB and no Redis are referenced anywhere in first-party code (verified — no pg/mysql/mongo/redis/ioredis imports; sonar-project.properties:7 mentions a server/db/ exclusion glob but no server/db/ directory exists in this clone).

10. Verified gotchas

The scraper RPC server is dead code in server.js

Only kkszb-rpc (KkszbRPCServer) is registered (server.js:25-30). NyilvantartoScraperRPCServer is never wired into the boot path of this base clone, and its dependency @techteamer/scraper is not in package.json. The README documents the scraper RPC contract (README.md:498-549) but node server will not serve it as-is. (Likely activated via a customization overlay — see customization-architecture / customization-branch-catalog.)

Any RabbitMQ connection close kills the process

server/bootstrap/connection/rabbitmq.js:14-18 registers connection.on('close') → process.exit(2) for every pool connection. Supervisor treats exit 2 as a clean restart code (exitcodes=0,2). Expect hard restarts on broker blips.

OCSP / mTLS only run when caCheck.enabled AND a real caCertFile

KkszbService._createAgentConfig returns undefined (no agent, no OCSP) unless caCheck.enabled is true (server/service/KkszbService.js:191). Shipped configs set enabled:true but caCertFile:"", so fs.readFileSync("") would throw at startup — a real CA path must be injected at deploy. _verifyOcsp is a no-op when there’s no agent (server/kkszb/KkszbApi.js:217-223).

OCSP shells out via an unescaped command string

server/util/certificate.js:63 builds an openssl ocsp ... <(echo "${pem}") ... -url ${ocspUri} string and execs it (bash process substitution). The OCSP URI comes from the server certificate’s infoAccess. Requires a bash-capable shell with openssl on PATH.

fast-xml-parser has a known moderate advisory (unpatched here)

security/2026-05-04.md records advisory 1116957 (XMLBuilder comment/CDATA injection), patched in ≥5.7.0; repo pins ^4.5.0. The uuid advisory is mitigated via resolutions["@techteamer/mq/uuid"]: ^14.0.0 (package.json:47-49). CI only fails on CRITICAL (≥16), so this moderate passes (test/scripts/travis.sh:14).

English ⇄ Hungarian field mapping is everywhere

The RPC/CLI accept English-ish field names (legalSurname, birthDate, mothersSurname) which processor.json4T maps to Hungarian KKSZB fields (viseltVezeteknev, szuletesiDatum, anyjaVezetekneve); responses keep Hungarian keys (okmanyAzonosito, adatLista). Budget time for the glossary in README.md:227-256 when integrating.

Misspellings are load-bearing in the contract

Error name 'UnkownError' (sic) and KkszbDataError issue typos are part of the wire contract (server/util/error.js:31,48, README.md:182). Don’t “fix” them without coordinating callers.

KkszbRPCClient is likely stale (see §6 warning) — prefer the documented {documentType, ...4T} shape from README.md:240-256.

Unverified / gaps

  • Surveyed structurally, not line-by-line: the 12 per-document processors are represented by reading Szig4TQueryProcessor.js (JSON 4T), UtlIdQueryProcessor.js (SOAP id), ImageJsonRequestProcessor.js, and ImageSoapRequestProcessor.js. The siblings Rszig4TQueryProcessor.js, RszigIdQueryProcessor.js, SzigIdQueryProcessor.js, Utl4TQueryProcessor.js, Ven4TQueryProcessor.js, Ven4TQueryProcessor.js/VenIdQueryProcessor.js and error classes KkszbApiError.js/KkszbMissingResourceError.js were not read in full (names/roles inferred from KkszbApi.js wiring + the read base processor.js).
  • Test mocks not all read: of test/, only Szig4TQueryProcessor.test.js, FakeServer.js, test/bin/fakekkszb, and travis.sh were read; the 8 integration tests, the other 10 unit tests, and per-doc mock handlers (RszigHandler/SzigHandler/UtlHandler/VenHandler/KepLekeresHandler, FakeConfig.js, FakeServiceContainer.js) were listed but not opened line-by-line.
  • maintenance/2026-04-07.md and security/2026-04-07.md were not read (only the 2026-05-04 successors were).
  • @techteamer/mq and @techteamer/scraper internals are third-party and intentionally not documented; RPC server/timeout semantics (timeoutMs:300000, prefetch) are taken from the subclass call only.
  • No runtime executed (read-only task). Claims about behavior derive from source reading, not from running node server/tests.
  • Whether/how the scraper RPC server and server.queueName get activated (and @techteamer/scraper added) is out of scope — expected to live in a customization branch (see customization-branch-catalog), not verified here.

Sources

Files actually read in /Users/levander/coding/facekom-v2-clones/nyilvantarto_scraper:

  • Root: package.json, README.md, server.js, config.js, logger.js, changelog.md, .eslintrc.json, .eslintignore, .editorconfig, .gitignore, .travis.yml, build.ignore, sonar-project.properties, supervisor_nyilvantarto_scraper_dev.conf, supervisor_nyilvantarto_scraper_docker.conf
  • config/dev.json, config/docker.json
  • server/service_container.js
  • server/bootstrap/process-settings.js, server/bootstrap/process-listeners.js, server/bootstrap/connection/rabbitmq.js
  • server/service/KkszbService.js, server/service/NyilvantartoScraperService.js, server/service/CVService.js
  • server/kkszb/KkszbApi.js, server/kkszb/Context.js, server/kkszb/DocumentRequestProcessorFactory.js, server/kkszb/processor.js, server/kkszb/Szig4TQueryProcessor.js, server/kkszb/UtlIdQueryProcessor.js, server/kkszb/ImageJsonRequestProcessor.js, server/kkszb/ImageSoapRequestProcessor.js, server/kkszb/KkszbDataError.js, server/kkszb/KkszbConfigError.js, server/kkszb/kkszb.d.ts
  • server/queue/rpc_server/KkszbRPCServer.js, server/queue/rpc_server/NyilvantartoScraperRPCServer.js, server/queue/rpc_client/KkszbRPCClient.js, server/queue/rpc_client/NyilvantartoScraperRPCClient.js
  • server/util/request.js, server/util/certificate.js, server/util/store.js, server/util/stream.js, server/util/xml.js, server/util/error.js
  • server/validator/Validator.js
  • bin/kkszbquery, bin/qtspintegrity
  • test/scripts/travis.sh, test/unit/kkszb/Szig4TQueryProcessor.test.js, test/mock/kkszb/FakeServer.js, test/bin/fakekkszb
  • maintenance/2026-05-04.md, security/2026-05-04.md
  • Directory listings (verified via find/ls -R): server/**, bin/, config/, test/**, maintenance/, security/
  • Git metadata: git -C ... branch -a, git -C ... log -1 (HEAD 6e52f0e)

Graph View