feat: adopt core collaboration contracts and the UI API extension endpoints #8

2026-10-13T22:28:57Z

KofTwentyTwo commented

2026-10-13 22:28:57 +00:00

(Migrated from github.com)

Summary

This PR moves qbit-collaboration onto the core collaboration contracts (QRun-IO/qqq#1138, #1140, #1143, #1144, #1148) and adds the full UI API extension, /qqq/v1/qbit/collaboration (spec §10.2 of QRun-IO/qqq#1136).

Core adoption (the stand-ins are removed):

Feature settings:
- collaboration_feature_setting drives core RecordFeaturesMetaData through RecordFeatureOverrideProviderInterface, and the overlay refreshes after writes.
- Defaults: FAVORITES, RECENTS and TIMELINE are on for every table; the rest are set per table in config.
Permissions: feature permissions (<table>.comment|attach|tag|share|task|assign) come from core's TableFeaturePermission hook, so they appear in the qbit-authentik policy editor.
Security: extension tables declare RecordReferenceTableMetaData. Core enforces parent read access, the write rules, the own-row rule and mirrored locks; mirrored lock columns are added when key types are configured.
Core SPIs implemented: RecordReferenceCleanupInterface, RecordAccessCheckerInterface (over core UserSessionProviderInterface) and RecordFeatureSummaryProviderInterface.
Tags:
- collaborationTags is a virtual field contributed through the runtime overlay to every table with TAGS enabled.
- It has a QSubQuery criteria expander covering IN, NOT_IN, EQUALS, NOT_EQUALS, blank and CONTAINS_ALL, and joins quick search (text and #tag).
Realtime: comment, attachment, tag and task events and notification hints are published on the core realtime bus.

Endpoints:

favorites, recents, attachments (multipart upload; download/preview return a short-lived {url}), tags, comments, mentions, follow, timeline and people;
added in this PR: link, share preview and send, access requests (create, mine), tasks (list, create, update, mine), assignment, and My work.
Every endpoint has typed Collaboration* schemas. The fragment src/main/resources/openapi/qqq-v1/collaboration.yaml is checked by UiApiContract.

Not yet:

Tags as a selectable column: the overlay has no post-query hook for virtual fields.
The followers provider: waits for QRun-IO/qqq#1164 in an RC.
The fallback post-filter for unpinned queries stays in the qbit until core implements its own (spec §3.2 item 4).

Dependency: this builds against 4.1.0-SNAPSHOT (develop) and switches to 4.1.0-RC.6 when it's published. It stays a draft until then.

Test plan

./mvnw -o verify against the develop SNAPSHOT: 100 tests, 97.1% instruction and 100% class coverage, checkstyle clean. That includes real-HTTP endpoint tests and the contract check.
CircleCI on RC.6.

🤖 Generated with Claude Code

## Summary This PR moves qbit-collaboration onto the core collaboration contracts (QRun-IO/qqq#1138, #1140, #1143, #1144, #1148) and adds the full UI API extension, `/qqq/v1/qbit/collaboration` (spec §10.2 of QRun-IO/qqq#1136). **Core adoption** (the stand-ins are removed): - **Feature settings:** - `collaboration_feature_setting` drives core `RecordFeaturesMetaData` through `RecordFeatureOverrideProviderInterface`, and the overlay refreshes after writes. - Defaults: FAVORITES, RECENTS and TIMELINE are on for every table; the rest are set per table in config. - **Permissions:** feature permissions (`<table>.comment|attach|tag|share|task|assign`) come from core's `TableFeaturePermission` hook, so they appear in the qbit-authentik policy editor. - **Security:** extension tables declare `RecordReferenceTableMetaData`. Core enforces parent read access, the write rules, the own-row rule and mirrored locks; mirrored lock columns are added when key types are configured. - **Core SPIs implemented:** `RecordReferenceCleanupInterface`, `RecordAccessCheckerInterface` (over core `UserSessionProviderInterface`) and `RecordFeatureSummaryProviderInterface`. - **Tags:** - `collaborationTags` is a virtual field contributed through the runtime overlay to every table with TAGS enabled. - It has a `QSubQuery` criteria expander covering IN, NOT_IN, EQUALS, NOT_EQUALS, blank and CONTAINS_ALL, and joins quick search (text and `#tag`). - **Realtime:** comment, attachment, tag and task events and notification hints are published on the core realtime bus. **Endpoints:** - favorites, recents, attachments (multipart upload; download/preview return a short-lived `{url}`), tags, comments, mentions, follow, timeline and people; - added in this PR: link, share preview and send, access requests (create, mine), tasks (list, create, update, mine), assignment, and My work. - Every endpoint has typed `Collaboration*` schemas. The fragment `src/main/resources/openapi/qqq-v1/collaboration.yaml` is checked by `UiApiContract`. **Not yet:** - Tags as a selectable column: the overlay has no post-query hook for virtual fields. - The followers provider: waits for QRun-IO/qqq#1164 in an RC. - The fallback post-filter for unpinned queries stays in the qbit until core implements its own (spec §3.2 item 4). **Dependency:** this builds against `4.1.0-SNAPSHOT` (develop) and switches to `4.1.0-RC.6` when it's published. It stays a draft until then. ## Test plan - [x] `./mvnw -o verify` against the develop SNAPSHOT: 100 tests, 97.1% instruction and 100% class coverage, checkstyle clean. That includes real-HTTP endpoint tests and the contract check. - [ ] CircleCI on RC.6. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: QRun-IO/qbit-collaboration#8