Donate to Postulo/postulo

• https://buymeacoffee.com/tiagoagueda

---

See the documentation for more details on donation links.

Look a company up in its register, on a press, and keep what is ticked (#1021) #1068

Merged

tiagoagueda merged 1 commit from 1021-register-lookup into main 2026-10-28 04:29:21 +00:00

Conversation 0 Commits 1 Files changed 201 +27104 -91

tiagoagueda commented 2026-10-27 16:22:24 +00:00

Owner

• Copy link
• Copy Markdown

The online half of #935, built as option B there: a feature plugin beside the
identifier module, which stays offline and always on. Register lookup
offers Look up in ... beside a company's register number, where an adapter
answers for its country, and beside its LEI (GLEIF), to whoever may change the
company. A press is one request carrying the number and nothing else; the
answer is held in the session and shown on a review page modelled on the
Wikidata one (#673): official name, registered office, state and NACE
activity (#897), each an unticked box. Only what is ticked is kept: the name
through update_company (a clash is refused), the office added beside the
company's addresses, the state with the register's page as its source, the
NACE division as an industry. From an LEI, GLEIF's registeredAs is offered to
a company with no register number, and compared with the one it has, the
cross-check that cannot be made offline.

• The plugin is off until an administrator switches it on: plugins migration
  0012 writes the instance's "off" row, which the switch on Server settings ->
  Plugins removes as for any other plugin. A press is a register learning
  which company somebody here looks at, so it is the operator's decision.
• Adapters are a new ungoverned plugin kind, register-adapter, with an open
  entry-point group (postulo.register_adapters) modelled on link services
  (#305). An adapter declares its scheme, country and hosts, builds the
  address and reads the JSON; Postulo makes the request through
  public_only_client, https on a declared host only, with its user agent, a
  deadline, a 2 MB limit and no redirects, under POSTULO_REGISTER_LOOKUP_RATE
  (30/h) through core/throttle. A package cannot take a country Postulo
  answers for. RegisterAdapter, RegisterRecord, RegisterAddress and
  RegisterAdapterPlugin are on the plugin surface.
• Shipped: France (API Recherche d'entreprises), Norway (Enhetsregisteret),
  Finland (YTJ v3), Czechia (ARES), Poland (KRS) and GLEIF, each confirmed on
  2026-10-27 against the register's documentation and a real answer, recorded
  in the adapters' docstring. Estonia is left out: every documented query
  service needs an agreement and a key. The keyed registers (GB, NL, DK, SE)
  are the follow-up.
• The record of processing lists each register, its hosts, what it is sent
  and its licence while the plugin is on for anybody; the review page shows
  the attribution each licence asks for. THREAT-MODEL.md has the entry.

Closes #1021
Closes #935

Notes for review

• Decided by the maintainer (2026-10-27): keyless registers plus GLEIF, off by default. The keyed registers (GB, NL, DK, SE) and Estonia are the follow-up issue.
• Estonia is left out: every documented query service needs a RIK agreement and a key.
• Confirmed on 2026-10-27 (sources in the docstring of plugins/register_lookup/adapters.py):
  • FR (Licence Ouverte 2.0);
  • NO (NLOD 2.0);
  • FI (YTJ v3, CC BY 4.0);
  • CZ (ARES; no licence stated);
  • PL (KRS);
  • GLEIF (CC0).
• Off by default: migration plugins 0012_register_lookup_starts_off writes the instance's FORCED_OFF row, and the existing switch removes it.
• Only confirmed fields are mapped: CZ offers no activity and PL no state. GLEIF's INACTIVE is shown, not offered.
• A registered office is kept as a new address, never replacing one.
• Rebased over #913: the record of processing lists both the geocoder and the registers.

🤖 Generated with Claude Code

The online half of #935, built as option B there: a feature plugin beside the identifier module, which stays offline and always on. *Register lookup* offers *Look up in ...* beside a company's register number, where an adapter answers for its country, and beside its LEI (GLEIF), to whoever may change the company. A press is one request carrying the number and nothing else; the answer is held in the session and shown on a review page modelled on the Wikidata one (#673): official name, registered office, state and NACE activity (#897), each an unticked box. Only what is ticked is kept: the name through update_company (a clash is refused), the office added beside the company's addresses, the state with the register's page as its source, the NACE division as an industry. From an LEI, GLEIF's registeredAs is offered to a company with no register number, and compared with the one it has, the cross-check that cannot be made offline. - The plugin is off until an administrator switches it on: plugins migration 0012 writes the instance's "off" row, which the switch on Server settings -> Plugins removes as for any other plugin. A press is a register learning which company somebody here looks at, so it is the operator's decision. - Adapters are a new ungoverned plugin kind, register-adapter, with an open entry-point group (postulo.register_adapters) modelled on link services (#305). An adapter declares its scheme, country and hosts, builds the address and reads the JSON; Postulo makes the request through public_only_client, https on a declared host only, with its user agent, a deadline, a 2 MB limit and no redirects, under POSTULO_REGISTER_LOOKUP_RATE (30/h) through core/throttle. A package cannot take a country Postulo answers for. RegisterAdapter, RegisterRecord, RegisterAddress and RegisterAdapterPlugin are on the plugin surface. - Shipped: France (API Recherche d'entreprises), Norway (Enhetsregisteret), Finland (YTJ v3), Czechia (ARES), Poland (KRS) and GLEIF, each confirmed on 2026-10-27 against the register's documentation and a real answer, recorded in the adapters' docstring. Estonia is left out: every documented query service needs an agreement and a key. The keyed registers (GB, NL, DK, SE) are the follow-up. - The record of processing lists each register, its hosts, what it is sent and its licence while the plugin is on for anybody; the review page shows the attribution each licence asks for. THREAT-MODEL.md has the entry. Closes #1021 Closes #935 ## Notes for review - **Decided by the maintainer (2026-10-27):** keyless registers plus GLEIF, off by default. The keyed registers (GB, NL, DK, SE) and Estonia are the follow-up issue. - **Estonia is left out:** every documented query service needs a RIK agreement and a key. - **Confirmed on 2026-10-27** (sources in the docstring of `plugins/register_lookup/adapters.py`): - FR (Licence Ouverte 2.0); - NO (NLOD 2.0); - FI (YTJ v3, CC BY 4.0); - CZ (ARES; no licence stated); - PL (KRS); - GLEIF (CC0). - **Off by default:** migration `plugins 0012_register_lookup_starts_off` writes the instance's FORCED_OFF row, and the existing switch removes it. - **Only confirmed fields are mapped:** CZ offers no activity and PL no state. GLEIF's INACTIVE is shown, not offered. - **A registered office** is kept as a new address, never replacing one. - **Rebased over #913:** the record of processing lists both the geocoder and the registers. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

tiagoagueda added 1 commit 2026-10-27 16:22:24 +00:00

Look a company up in its register, on a press, and keep what is ticked (#1021) ... 6c548ad061

The online half of #935, built as option B there: a feature plugin beside the
identifier module, which stays offline and always on. *Register lookup*
offers *Look up in ...* beside a company's register number, where an adapter
answers for its country, and beside its LEI (GLEIF), to whoever may change the
company. A press is one request carrying the number and nothing else; the
answer is held in the session and shown on a review page modelled on the
Wikidata one (#673): official name, registered office, state and NACE
activity (#897), each an unticked box. Only what is ticked is kept: the name
through update_company (a clash is refused), the office added beside the
company's addresses, the state with the register's page as its source, the
NACE division as an industry. From an LEI, GLEIF's registeredAs is offered to
a company with no register number, and compared with the one it has, the
cross-check that cannot be made offline.

- The plugin is off until an administrator switches it on: plugins migration
  0012 writes the instance's "off" row, which the switch on Server settings ->
  Plugins removes as for any other plugin. A press is a register learning
  which company somebody here looks at, so it is the operator's decision.
- Adapters are a new ungoverned plugin kind, register-adapter, with an open
  entry-point group (postulo.register_adapters) modelled on link services
  (#305). An adapter declares its scheme, country and hosts, builds the
  address and reads the JSON; Postulo makes the request through
  public_only_client, https on a declared host only, with its user agent, a
  deadline, a 2 MB limit and no redirects, under POSTULO_REGISTER_LOOKUP_RATE
  (30/h) through core/throttle. A package cannot take a country Postulo
  answers for. RegisterAdapter, RegisterRecord, RegisterAddress and
  RegisterAdapterPlugin are on the plugin surface.
- Shipped: France (API Recherche d'entreprises), Norway (Enhetsregisteret),
  Finland (YTJ v3), Czechia (ARES), Poland (KRS) and GLEIF, each confirmed on
  2026-10-27 against the register's documentation and a real answer, recorded
  in the adapters' docstring. Estonia is left out: every documented query
  service needs an agreement and a key. The keyed registers (GB, NL, DK, SE)
  are the follow-up.
- The record of processing lists each register, its hosts, what it is sent
  and its licence while the plugin is on for anybody; the review page shows
  the attribution each licence asks for. THREAT-MODEL.md has the entry.

Closes #1021
Closes #935

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

tiagoagueda force-pushed 1021-register-lookup from 6c548ad061 to e69ff6ca44 2026-10-27 21:45:29 +00:00 Compare

tiagoagueda force-pushed 1021-register-lookup from e69ff6ca44 to 3593e3455e 2026-10-28 04:25:33 +00:00 Compare

tiagoagueda merged commit db76d4402a into main 2026-10-28 04:29:21 +00:00

tiagoagueda referenced this pull request from a commit 2026-10-28 04:29:22 +00:00

Look a company up in its register, on a press, and keep what is ticked (#1021) (#1068)

tiagoagueda deleted branch 1021-register-lookup 2026-10-28 04:29:23 +00:00

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels   

accessibility

Usable by everyone, including people with disabilities: one of the project's stated missions

  

authentication

Signing in, and proving who you are

  

breaking change

Changes behaviour or data in a way operators must act on

  

bug

Something does not do what it says it does

  

documentation

The wiki, the docs, or the words in the interface

  

enhancement

An improvement or a new capability

  

interface

The shape of the pages: what is where, and how it reads

  

internationalisation

Languages, regions, and the formats and symbols that go with them

  

observability

What an operator can see about a running instance: metrics, logs, health

  

performance

Uses fewer resources, or is more reliable, with no loss of features or accessibility

  

security

Keeping the code and the data secure: one of the project's stated missions

  

tier

1

Easy: small, self-contained, no prerequisites

  

tier

2

High-severity security: account access, personal data, the boundaries

  

tier

3

Foundations: prerequisite work that unblocks other issues

  

tier/4

Later: large features and long-horizon work

No labels

accessibility

authentication

breaking change

bug

documentation

enhancement

interface

internationalisation

observability

performance

security

tier

1

tier

2

tier

3

tier/4

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

Postulo/postulo!1068

No description provided.