City-of-Helsinki · khalima · Mar 12, 2026 · Feb 26, 2026 · Feb 26, 2026 · Mar 1, 2026
diff --git a/Makefile b/Makefile
@@ -1,5 +1,6 @@
 PHONY :=
 PROJECT_DIR := $(dir $(lastword $(MAKEFILE_LIST)))
+IS_CONTAINER := $(shell test ${CONTAINER_RUNNING} && echo true || echo false)
 
 # Colors
 NO_COLOR=\033[0m

diff --git a/composer.lock b/composer.lock
diff --git a/conf/cmi/core.extension.yml b/conf/cmi/core.extension.yml
@@ -19,6 +19,7 @@ module:
   content_lock: 0
   crop: 0
   csp: 0
+  csp_log: 0
   datetime: 0
   diff: 0
   dynamic_page_cache: 0

diff --git a/conf/cmi/csp.settings.yml b/conf/cmi/csp.settings.yml
@@ -28,4 +28,6 @@ enforce:
     frame-ancestors:
       base: self
   reporting:
-    plugin: none
+    plugin: csp_log
+    options:
+      cleanup: 14
diff --git a/conf/cmi/editor.editor.full_html.yml b/conf/cmi/editor.editor.full_html.yml
@@ -7,7 +7,7 @@ dependencies:
   module:
     - ckeditor5
 _core:
-  default_config_hash: oCDUwt4GjXQJeBCiJlq5NKEU0d9JP2Kx3QZKMuDAi_g
+  default_config_hash: i1fLaAzni2rKBDARlCWA1xa79zo_RYF-8oQ3x9wxgfM
 format: full_html
 editor: ckeditor5
 settings:
@@ -151,6 +151,11 @@ settings:
           weight: 19
           search: '(<a\b[^>]*?)\s+target\s*=\s*("_blank"|_blank)'
           replace: $1
+        -
+          enabled: true
+          weight: 20
+          search: '&nbsp;'
+          replace: ' '
     ckeditor5_sourceEditing:
       allowed_tags:
         - '<figure tabindex>'

diff --git a/conf/cmi/editor.editor.minimal.yml b/conf/cmi/editor.editor.minimal.yml
@@ -7,7 +7,7 @@ dependencies:
   module:
     - ckeditor5
 _core:
-  default_config_hash: 5XykmWxByyrIQ2N9_zHqVQlMtBUy9wc5P9lPrM_g7oQ
+  default_config_hash: oE8ZPS7LMQvOJv0JDM2AJcGyPAti79fl6vzr3v-GWM0
 format: minimal
 editor: ckeditor5
 settings:
@@ -133,6 +133,11 @@ settings:
           weight: 19
           search: '(<a\b[^>]*?)\s+target\s*=\s*("_blank"|_blank)'
           replace: $1
+        -
+          enabled: true
+          weight: 20
+          search: '&nbsp;'
+          replace: ' '
     ckeditor5_sourceEditing:
       allowed_tags:
         - '<p data-chat-trigger>'

diff --git a/conf/cmi/openid_connect.client.tunnistamo.yml b/conf/cmi/openid_connect.client.tunnistamo.yml
@@ -10,12 +10,33 @@ id: tunnistamo
 label: Tunnistamo
 plugin: tunnistamo
 settings:
-  client_id: placeholder
-  client_secret: placeholder
+  client_id: ''
+  client_secret: ''
   iss_allowed_domains: ''
-  is_production: 0
+  prompt:
+    login: login
   auto_login: 0
-  environment_url: 'https://tunnistamo.test.hel.ninja'
+  environment_url: ''
   client_scopes: 'openid,email'
   client_roles: {  }
-  debug_log: false
+  ad_roles:
+    -
+      ad_role: Drupal_Helfi_kaupunkitaso_paakayttajat
+      roles:
+        - admin
+    -
+      ad_role: Drupal_Helfi_Asuminen_sisallontuottajat_laaja
+      roles:
+        - editor
+    -
+      ad_role: Drupal_Helfi_Asuminen_sisallontuottajat_suppea
+      roles:
+        - content_producer
+    -
+      ad_role: Drupal_Helfi_Etusivu_kayttajakyselyt
+      roles:
+        - survey_editor
+    -
+      ad_role: 947058f4-697e-41bb-baf5-f69b49e5579a
+      roles:
+        - super_administrator
diff --git a/conf/cmi/search_api.index.embeddings.yml b/conf/cmi/search_api.index.embeddings.yml
@@ -5,7 +5,10 @@ dependencies:
   config:
     - search_api.server.etusivu
   module:
+    - helfi_react_search
+    - helfi_recommendations
     - helfi_search
+    - helfi_tpr
     - node
 id: embeddings
 name: 'Vector embeddings'
@@ -20,14 +23,10 @@ field_settings:
     label: 'Entity type'
     property_path: search_api_entity_type
     type: string
-  title:
-    label: Title
-    datasource_id: 'entity:node'
-    property_path: title
+  label:
+    label: 'Entity label'
+    property_path: helfi_entity_label
     type: string
-    dependencies:
-      module:
-        - node
   url:
     label: URI
     property_path: search_api_url
@@ -44,16 +43,37 @@ datasource_settings:
     languages:
       default: true
       selected: {  }
+  'entity:tpr_service':
+    languages:
+      default: true
+      selected: {  }
+  'entity:tpr_unit':
+    languages:
+      default: true
+      selected: {  }
 processor_settings:
   add_url: {  }
+  aggregated_field: {  }
+  channels_for_service: {  }
+  custom_value: {  }
+  district_image_absolute_url: {  }
   entity_status: {  }
   entity_type: {  }
+  helfi_entity_label: {  }
   helfi_search_embeddings: {  }
+  language_with_fallback: {  }
+  project_execution_schedule: {  }
+  project_image_absolute_url: {  }
+  project_plan_schedule: {  }
+  rendered_item: {  }
+  scored_reference: {  }
+  scored_reference_parent: {  }
+  units_for_service: {  }
 tracker_settings:
   default:
     indexing_order: fifo
 options:
-  cron_limit: 100
+  cron_limit: 1
   delete_on_fail: true
   index_directly: false
   track_changes_in_references: true

diff --git a/docker/openshift/crons/cron.sh b/docker/openshift/crons/cron.sh
@@ -2,7 +2,7 @@
 
 while true
 do
-  echo "Running cron: $(date +'%Y-%m-%dT%H:%M:%S%:z')\n"
+  echo "Running cron: $(date +'%Y-%m-%dT%H:%M:%S%:z')"
   drush cron
   # Sleep for 10 minutes.
   sleep 600

diff --git a/docker/openshift/crons/purge-queue.sh b/docker/openshift/crons/purge-queue.sh
@@ -1,5 +1,11 @@
 #!/bin/bash
 
+source /init.sh
+
+if ! is_drupal_module_enabled "purge"; then
+  exit 0
+fi
+
 function has_items {
   NUM_ITEMS=$(drush p:queue-stats --format=json | jq .number_of_items)
 

diff --git a/docker/openshift/hooks/db-replace/50-sanitize.sh b/docker/openshift/hooks/db-replace/50-sanitize.sh
@@ -7,3 +7,5 @@ fi
 
 # Obfuscate user data
 drush sql:sanitize
+# Convert file schemes for Stage file proxy
+drush sql-query "UPDATE file_managed SET uri = REPLACE(uri, 'azure://', 'public://');"
diff --git a/public/sites/default/settings.php b/public/sites/default/settings.php
@@ -12,6 +12,7 @@
   ini_set('zend.enable_gc', 'Off');
 }
 
+$env = getenv('APP_ENV');
 
 if (!function_exists('drupal_get_env')) {
   /**
@@ -155,15 +156,15 @@ function drupal_get_env(string|array $variables) : mixed {
 
 // Make sure project name and app env are defined in GitHub actions too.
 if ($github_repository = getenv('GITHUB_REPOSITORY')) {
-  if (!getenv('APP_ENV')) {
+  if (!$env) {
     putenv('APP_ENV=ci');
   }
 
   if (!getenv('PROJECT_NAME')) {
     putenv('PROJECT_NAME=' . $github_repository);
   }
 }
-$config['helfi_api_base.environment_resolver.settings']['environment_name'] = getenv('APP_ENV');
+$config['helfi_api_base.environment_resolver.settings']['environment_name'] = $env;
 $config['helfi_api_base.environment_resolver.settings']['project_name'] = getenv('PROJECT_NAME');
 
 if ($varnish_host = getenv('DRUPAL_VARNISH_HOST')) {
@@ -172,7 +173,7 @@ function drupal_get_env(string|array $variables) : mixed {
 
   $varnish_backend = parse_url($drush_options_uri, PHP_URL_HOST);
 
-  if (getenv('APP_ENV') === 'local') {
+  if ($env === 'local') {
     // Varnish backend is something like varnish-helfi-kymp.docker.so on
     // local env.
     $varnish_backend = 'varnish-' . $varnish_backend;
@@ -227,15 +228,6 @@ function drupal_get_env(string|array $variables) : mixed {
     }
   }
 }
-$stage_file_proxy_origin = getenv('STAGE_FILE_PROXY_ORIGIN');
-$stage_file_proxy_dir = getenv('STAGE_FILE_PROXY_ORIGIN_DIR');
-
-if ($stage_file_proxy_origin || $stage_file_proxy_dir) {
-  $config['stage_file_proxy.settings']['origin'] = $stage_file_proxy_origin ?: 'https://stplattaprod.blob.core.windows.net';
-  $config['stage_file_proxy.settings']['origin_dir'] = $stage_file_proxy_dir;
-  $config['stage_file_proxy.settings']['hotlink'] = FALSE;
-  $config['stage_file_proxy.settings']['use_imagecache_root'] = FALSE;
-}
 
 if ($drupal_pubsub_vault = getenv('DRUPAL_PUBSUB_VAULT')) {
   $config['helfi_api_base.api_accounts']['vault'][] = [
@@ -343,7 +335,7 @@ function drupal_get_env(string|array $variables) : mixed {
 }
 
 // Supported values: https://github.com/Seldaek/monolog/blob/main/doc/01-usage.md#log-levels.
-$default_log_level = getenv('APP_ENV') === 'production' ? 'info' : 'debug';
+$default_log_level = $env === 'production' ? 'info' : 'debug';
 $settings['helfi_api_base.log_level'] = getenv('LOG_LEVEL') ?: $default_log_level;
 
 // Turn sentry JS error tracking on if SENTRY_DSN_PUBLIC is defined.
@@ -373,7 +365,7 @@ function drupal_get_env(string|array $variables) : mixed {
 
 // E2E test users. We should never do this in production, so adding a failsafe
 // in case the environment variable would ever end up in production.
-if (getenv('APP_ENV') !== 'production' && $e2e_test_user = getenv('E2E_TEST_USER')) {
+if ($env !== 'production' && $e2e_test_user = getenv('E2E_TEST_USER')) {
   $e2e_test_user = json_decode($e2e_test_user, TRUE);
 
   // Make sure the user exists in Drupal.
@@ -386,13 +378,31 @@ function drupal_get_env(string|array $variables) : mixed {
   ]);
 }
 
+if ($env !== 'production') {
+  $stage_file_proxy_origin = getenv('STAGE_FILE_PROXY_ORIGIN');
+  $stage_file_proxy_dir = getenv('STAGE_FILE_PROXY_ORIGIN_DIR');
+
+  // Always default to blob storage if configured.
+  if ($blob_storage_container = getenv('AZURE_BLOB_STORAGE_CONTAINER')) {
+    $stage_file_proxy_origin = 'https://stplattaprod.blob.core.windows.net';
+    // The container name uses the same naming convention across environments.
+    // Make sure the container name also points to production.
+    // For example: 'etusivu64e62test' -> 'etusivu64e62prod'.
+    $stage_file_proxy_dir = str_replace(['test', 'staging'], 'prod', $blob_storage_container);
+  }
+  $config['stage_file_proxy.settings']['origin'] = $stage_file_proxy_origin;
+  $config['stage_file_proxy.settings']['origin_dir'] = $stage_file_proxy_dir;
+  $config['stage_file_proxy.settings']['hotlink'] = FALSE;
+  $config['stage_file_proxy.settings']['use_imagecache_root'] = TRUE;
+}
+
 // Environment specific overrides.
 if (file_exists(__DIR__ . '/all.settings.php')) {
   // phpcs:ignore
   include_once __DIR__ . '/all.settings.php'; // NOSONAR
 }
 
-if ($env = getenv('APP_ENV')) {
+if ($env) {
   if (file_exists(__DIR__ . '/' . $env . '.settings.php')) {
     // phpcs:ignore
     include_once __DIR__ . '/' . $env . '.settings.php'; // NOSONAR

diff --git a/public/themes/custom/hdbt_subtheme/package-lock.json b/public/themes/custom/hdbt_subtheme/package-lock.json
diff --git a/tools/make/drupal.mk b/tools/make/drupal.mk
@@ -126,6 +126,12 @@ open-db-gui: ## Open database with GUI tool
 	$(eval DB_PASS ?= drupal)
 	@open mysql://$(DB_USER):$(DB_PASS)@$(shell docker compose port $(DB_SERVICE) 3306 | grep -v ::)/$(DB_NAME)
 
+ifeq ($(IS_CONTAINER),false)
 define drush
 	$(call docker_compose_exec,drush $(1),$(2))
 endef
+else
+define drush
+	@drush $(1) $(2)
+endef
+endif