Merge pull request 'build(deps): align with Gitea registry (parent 2.2.1, QQQ 4.1.0-RC.26)' (#42) from deps/align-gitea into develop

Replace the CrmHealthChecks STAND-IN (qqq#1199) adapter onto the
qqq-middleware-health HealthIndicator with checks registered in the QQQ
4.1 core HealthChecksMetaData registry (crm.email, crm.sequence_lag,
crm.lead_score). The core HealthRunner schedules them and runs each as
the core system user. Drop the optional qqq-middleware-health dependency.

Also keep the lead-score incremental watermark at millisecond precision
to match modifyDate, fixing PlatformReuseTest skipping a same-millisecond
change on a warm JVM.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

.circleci/config.yml

@@ -1,60 +1,14 @@
 version: 2.1
-
+setup: true
 orbs:
-   qqq-orb: kingsrook/qqq-orb@0.6.9
-
-commands:
-   configure-package-install:
-      steps:
-         - run:
-              name: Keep package installation unattended
-              command: |
-                 # These build machines are discarded after the job.
-                 sudo install -d /etc/needrestart/conf.d
-                 printf '%s\n' '$nrconf{restart} = "l";' | sudo tee /etc/needrestart/conf.d/99-qqq-ci.conf >/dev/null
-
+  qqq-orb: kingsrook/qqq-orb@0.8
 workflows:
-   test_only:
-      jobs:
-         - qqq-orb/mvn_test_only:
-              pre-steps:
-                 - configure-package-install
-              context: [qqq-maven-registry-credentials]
-              filters:
-                 branches:
-                    ignore: /(develop|release\/.*)/
-
-   publish_snapshot:
-      jobs:
-         - qqq-orb/mvn_publish:
-              pre-steps:
-                 - configure-package-install
-              context: [qqq-maven-registry-credentials]
-              branch_type: snapshot
-              filters:
-                 branches:
-                    only: [develop]
-
-   publish_release_candidate:
-      jobs:
-         - qqq-orb/mvn_publish:
-              pre-steps:
-                 - configure-package-install
-              context: [qqq-maven-registry-credentials]
-              branch_type: release_candidate
-              filters:
-                 branches:
-                    only: [/release\/.*/]
-
-   publish_release:
-      jobs:
-         - qqq-orb/mvn_publish:
-              pre-steps:
-                 - configure-package-install
-              context: [qqq-maven-registry-credentials]
-              branch_type: release
-              filters:
-                 branches:
-                    ignore: /.*/
-                 tags:
-                    only: [/^v\d+\.\d+\.\d+$/]
+  setup:
+    jobs:
+    - qqq-orb/generate_pipeline:
+        orb_version: '0.8'
+        filters:
+          branches:
+            ignore: automation/qbit-rc-pending
+          tags:
+            only: /^v\d+\.\d+\.\d+$/

.gitea/workflows/build.yaml

@@ -0,0 +1,7 @@
+name: build
+on:
+  push:
+jobs:
+  maven:
+    uses: self:KofTwentyTwo/ci-workflows/.gitea/workflows/maven.yaml@v1
+    secrets: inherit

.github/workflows/codeql.yml

@@ -0,0 +1,23 @@
+name: CodeQL
+'on':
+  push:
+    branches:
+    - main
+    - develop
+    - release/**
+    - hotfix/**
+  pull_request: {}
+  schedule:
+  - cron: 41 16 * * 0
+  workflow_dispatch: {}
+permissions:
+  contents: read
+  actions: read
+  security-events: write
+  packages: read
+concurrency:
+  group: codeql-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+jobs:
+  analyze:
+    uses: QRun-IO/qqq-orb/.github/workflows/qbit-codeql.yml@c288a8864fe9054f68410e1d78f5863aea4c4d22

.github/workflows/release-rc.yml

@@ -1,26 +1,74 @@
-# Cut the next release candidate (QRun-IO/qqq docs/QRUN-QBIT-REPO-STANDARD.md, C6):
-# run this workflow by hand, or merge a develop PR labelled `release:rc`. It merges develop into
-# the release line and the release/* push runs CircleCI publish_release_candidate.
 name: Release candidate
-
-on:
+'on':
   workflow_dispatch:
     inputs:
       dry_run:
-        description: Print the plan without merging or creating branches
+        description: Plan a cut without changing release state
         type: boolean
         default: false
+      finalize:
+        description: Retry finalization of an existing cut; do not cut another RC
+        type: boolean
+        default: false
+      recover:
+        description: Recover the same published RC after a deployment timeout; never
+          reupload
+        type: boolean
+        default: false
+      circle_build:
+        description: Original Circle publisher build number (recovery only)
+        type: string
+        default: ''
+      merge_sha:
+        description: Existing cut merge_sha (finalize retry only)
+        type: string
+        default: ''
+      bump_sha:
+        description: Existing cut bump_sha (finalize retry only)
+        type: string
+        default: ''
+      branch:
+        description: Existing cut branch (finalize retry only)
+        type: string
+        default: ''
+      version:
+        description: Existing cut version (finalize retry only)
+        type: string
+        default: ''
   pull_request:
-    types: [closed]
-    branches: [develop]
-
+    types:
+    - closed
+    branches:
+    - develop
+  repository_dispatch:
+    types:
+    - qbit-rc-published
 permissions:
   contents: write
-
+  actions: read
+  checks: read
 jobs:
   release-rc:
-    if: github.event_name == 'workflow_dispatch' || (github.event.pull_request.merged == true && contains(github.event.pull_request.labels.*.name, 'release:rc'))
-    uses: QRun-IO/.github/.github/workflows/qbit-release-rc.yml@main
-    secrets: inherit
+    if: github.event_name == 'workflow_dispatch' || github.event_name == 'repository_dispatch'
+      || (github.event_name == 'pull_request' && github.event.pull_request.merged
+      == true && github.event.pull_request.base.ref == 'develop' && contains(github.event.pull_request.labels.*.name,
+      'release:rc'))
+    uses: QRun-IO/qqq-orb/.github/workflows/qbit-release-rc.yml@cc30f599e63c8e41629c99d23395bac1adb8bc44
     with:
-      dry_run: ${{ github.event_name == 'workflow_dispatch' && inputs.dry_run }}
+      dry_run: ${{ github.event_name == 'workflow_dispatch' && inputs.dry_run || false
+        }}
+      finalize: ${{ github.event_name == 'repository_dispatch' || (github.event_name
+        == 'workflow_dispatch' && inputs.finalize) }}
+      recover: ${{ github.event_name == 'workflow_dispatch' && inputs.recover || false
+        }}
+      circle_build: ${{ github.event_name == 'workflow_dispatch' && inputs.circle_build
+        || '' }}
+      merge_sha: ${{ github.event_name == 'repository_dispatch' && github.event.client_payload.merge_sha
+        || inputs.merge_sha || '' }}
+      bump_sha: ${{ github.event_name == 'repository_dispatch' && github.event.client_payload.bump_sha
+        || inputs.bump_sha || '' }}
+      branch: ${{ github.event_name == 'repository_dispatch' && github.event.client_payload.branch
+        || inputs.branch || '' }}
+      version: ${{ github.event_name == 'repository_dispatch' && github.event.client_payload.version
+        || inputs.version || '' }}
+    secrets: inherit

.qqq-ci.yml

@@ -0,0 +1,16 @@
+profile: qbit
+orb_version: '0.8'
+default_branch: develop
+java_version: '21'
+browsers: true
+api_checks: false
+docs_only: false
+release_on_main: false
+release_tag_policy: stable
+test_branch_policy: non-release
+publish:
+  snapshot: true
+  release_candidate: true
+  release: true
+  asciidoc: false
+release_completion: true

CHANGELOG.md

@@ -2,8 +2,9 @@
 
 ## Unreleased / 0.2.0
 
-- Add an optional unique catalog slug and allow absent catalog prices without changing required deal-line prices. Ship the additive `crm-product-catalog.changelog.sql`; hosts must include it before adopting the metadata.
-- Add opt-in `productPermissionBase` configuration for native catalog-only read/write permissions. Existing hosts retain `crm.manage` behavior; opting into `crm.product` requires the role migration documented in UPGRADE.md.
+- Register CRM health checks (`crm.email`, `crm.sequence_lag`, `crm.lead_score`) with the QQQ 4.1 core health registry (`HealthChecksMetaData`, qqq#1199), replacing the `qqq-middleware-health` indicator stand-in and its optional dependency.
+
+- Lead scoring keeps its incremental watermark at millisecond precision, matching `modifyDate`, so a contact changed in the same millisecond a pass starts is not skipped.
 
 - Read the CRM QBit metadata version from the Maven-filtered artifact version so release metadata matches the build.
 

README.md

@@ -56,16 +56,15 @@ qInstance.setEnforcePermissionsInCoreActions(true);
 
 - `defaultBackendNameForTables`: required backend name.
 - `inferBackendNames`: defaults to true; sets snake_case SQL column names while Java/QQQ field names remain camelCase. SQL table names equal the QQQ table names. Set false only for an explicit host column mapping.
-- `withProductPermissionBase("crm.product")`: opt into catalog-only `crm.product.read/write` permissions. The default remains `crm.manage` for existing hosts. Before opting in, preserve existing catalog access by adding the corresponding product grants to roles that already hold `crm.manage.read/write`; Marketing catalog readers receive only `crm.product.read`. This does not grant CRM app/settings access or product writes to Marketing. See UPGRADE.md for the required schema and role migration.
 - `tableMetaDataCustomizer`: optional host table customizer.
 - `withTenantSecurityKeyType("tenant")`: enables nullable `tenantKey` fields and record locks. It defaults to null (off). `withTenantAllAccessKeyName("allTenants")` names the host's all-access key. Existing host key types are preserved.
 - Tenant-enabled hosts separately include `src/main/resources/db/liquibase/qbit-crm/crm-tenancy.changelog.sql` **after** the base changelog and explicitly select the `crm-tenancy` context. Single-tenant hosts omit that file. Child records use parent join locks; polymorphic external mappings and internal job checkpoints carry direct tenant keys. Hosts must supply tenant keys on new direct-key records.
 - `withApiName(...)` and `withApiVersion(...)`: publish main and settings tables into an existing host API definition. The host supplies `ApiInstanceMetaData` and includes optional `qqq-middleware-api` at runtime. Main tables declare core search fields.
 - `withEsbDestinationName(...)`: reserved but rejected on RC.6. Its ESB event factory copies all values and has no classified-field exclusion; CRM does not publish those payloads.
 - `CrmBulkLoadProfiles.ensure()`: call once in host startup after registering core's `SavedBulkLoadProfileMetaDataProvider`. It seeds three CSV mappings by label without replacing edited profiles. CRM does not register the core profile tables.
-- `CrmHealthChecks.indicators(monitoringSession)`: register the returned indicators with the host health middleware. Include optional `qqq-middleware-health`; the supplied session determines tenant scope and is restored on worker threads. `run()` uses the caller's context. No check adds permissions or tenant keys.
+- Health: the producer registers `crm.email`, `crm.sequence_lag` and `crm.lead_score` with the core health registry (`HealthChecksMetaData`). Hosts that enable core health monitoring (`HealthMetaDataProvider`) get them scheduled by the core `HealthRunner`, which runs each check as the core system user. `CrmHealthChecks.run()` evaluates them once in the caller's context. No check adds permissions or tenant keys or returns personal values.
 
-The shipped help bundle and health adapter are temporary core integration adapters; their removal target is RC.9. See [P4B implementation notes](docs/P4B-IMPLEMENTATION.md) for RC.6 limits.
+Help and health both use the core registries (`HelpBundles`, `HealthChecksMetaData`). See [P4B implementation notes](docs/P4B-IMPLEMENTATION.md) for RC.6 limits.
 
 | Scope | Permissions |
 |---|---|

UPGRADE.md

@@ -1,22 +1,5 @@
 # Upgrading
 
-## Shared product catalog (unreleased)
-
-`crm_product` now supports an optional unique `slug` (64 characters) and an absent catalog `unit_price` for informational products. No price is invented. Deal-line `unit_price` remains required; existing prices and amounts are unchanged.
-
-Before running the updated metadata against an existing schema, include `db/liquibase/qbit-crm/crm-product-catalog.changelog.sql` after the base CRM schema. This additive migration also works for hosts that copied the old CRM DDL; do not replay the base changelog against an already-created schema. Fresh installs using `crm.changelog.sql` must include the catalog changelog too. `docs/ddl/postgres.sql` describes the final schema, so hosts creating tables directly from that file must not then replay the additive migration.
-
-The migration adds nullable `slug`, its unique constraint, and drops only the catalog price NOT NULL constraint. It preserves product IDs, timestamps, prices and tenant keys. It does not migrate Marketing data or alter any deal-line price. Roll back application code only after checking schema compatibility; do not drop populated slugs or force null prices to zero.
-
-Catalog permissions stay on `crm.manage.read/write` unless the host opts into `withProductPermissionBase("crm.product")`. Opt-in requires an explicit role migration in the same adoption rollout:
-
-- Existing `crm.manage.read` holders retain that grant and gain `crm.product.read`.
-- Existing `crm.manage.write` holders retain that grant and gain `crm.product.write` (preserve their existing read grant separately).
-- Marketing roles needing catalog selection receive `crm.product.read` only. Their marketing permissions remain unchanged.
-- Do not grant `crm.manage` to Marketing users or infer permissions from navigation placement.
-
-The native QQQ permission checks enforce both API writes and UI operation checks. Tenant locks continue to apply. Marketing integration and host data migration must be adopted separately before retiring `marketing_product`.
-
 ## Starter defaults (Unreleased / 0.2.0)
 
 The CRM now ships `db/liquibase/qbit-crm/crm-defaults.changelog.sql`, a separate insert-only changelog. Without it,

docs/DESIGN.md

@@ -89,8 +89,8 @@ These parts are real and are kept, adapted to 0.2.0:
 | Imports | `importContacts` | core bulk load + saved bulk-load profiles |
 | PII | none | `DataClassification.PII` on every personal field; secured-data tiers apply |
 | Reporting | 14 bespoke widgets | home widgets for the daily view; trend reports via data analysis (`crm_*.analyze`) |
-| Health | none | `crm` health checks (stand-in until core #1199) |
-| Help | none | `help/qbit-crm.yaml` bundle (stand-in loader until core #1198) |
+| Health | none | `crm.*` checks in the core health registry (`HealthChecksMetaData`) |
+| Help | none | `help/qbit-crm.yaml` bundle registered with core `HelpBundles` |
 | Tenancy | clientId lock on 3 tables | configurable tenant key type on every table; the host maps Authentik claims to keys |
 
 ## Data model (33 tables: 6 main, 15 settings, 12 sub-tables)
@@ -268,13 +268,14 @@ signals are logged.
 
 ### Health
 
-`CrmHealthChecks` reports three checks:
-- email transport readiness
-- sequence lag (the oldest due enrollment more than 30 min late)
-- the scoring job's last success time
+`CrmHealthChecks` registers three checks with the core health registry
+(`HealthChecksMetaData`, component `crm`):
+- `crm.email`: email transport readiness
+- `crm.sequence_lag`: the oldest due enrollment more than 30 min late
+- `crm.lead_score`: the scoring job's last success time
 
-It is a `STAND-IN(core=QRun-IO/qqq#1199, removeBy=4.1.0-RC.9)` adapter onto the
-`qqq-middleware-health` `HealthIndicator` until the central `HealthCheck` SPI ships.
+The core `HealthRunner` schedules them on hosts that enable health monitoring and runs each one
+as the core system user. A failing check reports UNKNOWN with a fixed message.
 
 ### Help
 
@@ -282,9 +283,8 @@ It is a `STAND-IN(core=QRun-IO/qqq#1199, removeBy=4.1.0-RC.9)` adapter onto the
 - the app
 - every table, field, action and possible-value source
 
-`HelpBundleAssertions` checks that it is complete. Until `HelpBundles.register` is in a core RC,
-`CrmHelpBundleStandIn` (`STAND-IN(core=QRun-IO/qqq#1198, removeBy=4.1.0-RC.9)`) loads the same
-file into `QHelpContent`.
+The producer registers it with core `HelpBundles.register`; `HelpBundleAssertions` checks that it
+is complete.
 
 ### Contingent dropdowns
 

docs/ddl/postgres.sql

@@ -565,15 +565,13 @@ CREATE TABLE IF NOT EXISTS crm_product (
    id INTEGER GENERATED BY DEFAULT AS IDENTITY PRIMARY KEY,
    name VARCHAR(250) NOT NULL,
    sku VARCHAR(100),
-   slug VARCHAR(64),
    description TEXT,
-   unit_price DECIMAL(20,6),
+   unit_price DECIMAL(20,6) NOT NULL,
    currency_code VARCHAR(3) DEFAULT 'USD',
    is_active BOOLEAN DEFAULT TRUE NOT NULL,
    create_date TIMESTAMP WITHOUT TIME ZONE,
    modify_date TIMESTAMP WITHOUT TIME ZONE,
-   CONSTRAINT uq_crm_product_1 UNIQUE (sku),
-   CONSTRAINT uq_crm_product_slug UNIQUE (slug)
+   CONSTRAINT uq_crm_product_1 UNIQUE (sku)
 );
 
 CREATE TABLE IF NOT EXISTS crm_sales_goal (

pom.xml

@@ -22,6 +22,7 @@
 <project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
 
    <properties>
+      <qqq.version>4.1.0-RC.26</qqq.version> <!-- feeds qbit-build-parent's qqq-bom-pom import -->
       <revision>0.2.0-SNAPSHOT</revision>
       <maven.compiler.source>21</maven.compiler.source>
       <maven.compiler.target>21</maven.compiler.target>
@@ -33,7 +34,7 @@
    <parent>
       <groupId>com.kingsrook</groupId>
       <artifactId>qbit-build-parent</artifactId>
-      <version>2.1.2</version>
+      <version>2.2.1</version>
    </parent>
 
    <groupId>com.kingsrook.qbits</groupId>
@@ -78,16 +79,11 @@
          <artifactId>qqq-middleware-api</artifactId>
          <optional>true</optional>
       </dependency>
-      <dependency>
-         <groupId>com.kingsrook.qqq</groupId>
-         <artifactId>qqq-middleware-health</artifactId>
-         <optional>true</optional>
-      </dependency>
 
       <dependency>
          <groupId>com.kingsrook.qbits</groupId>
          <artifactId>qbit-email</artifactId>
-         <version>0.1.0-RC.3</version>
+         <version>0.1.0-RC.11</version>
          <optional>true</optional>
       </dependency>
       <dependency>
@@ -239,7 +235,7 @@
             <activeByDefault>true</activeByDefault>
          </activation>
          <properties>
-            <qqq.snapshot.version>4.1.0-RC.7</qqq.snapshot.version>
+            <qqq.snapshot.version>4.1.0-RC.26</qqq.snapshot.version>
          </properties>
          <dependencyManagement>
             <dependencies>

src/main/java/com/kingsrook/qbits/crm/CrmQBitConfig.java

@@ -41,7 +41,6 @@ public class CrmQBitConfig implements QBitConfig
 {
    public static final CrmQBitConfig DEFAULT_CONFIG = new CrmQBitConfig();
 
-   private String productPermissionBase = "crm.manage";
    private String tenantSecurityKeyType;
    private String tenantAllAccessKeyName;
    private String apiName;
@@ -70,45 +69,12 @@ public class CrmQBitConfig implements QBitConfig
    @Override
    public void validate(com.kingsrook.qqq.backend.core.model.metadata.QInstance qInstance, List<String> errors)
    {
-      assertCondition(StringUtils.hasContent(productPermissionBase), "CrmQBitConfig.productPermissionBase is required", errors);
       assertCondition(StringUtils.hasContent(defaultBackendNameForTables),
          "CrmQBitConfig.defaultBackendNameForTables is required", errors);
    }
 
 
 
-   /*******************************************************************************
-    ** Catalog permission base. Defaults to crm.manage for existing hosts.
-    ** Shared-catalog hosts may use crm.product after migrating role grants.
-    *******************************************************************************/
-   public String getProductPermissionBase()
-   {
-      return (productPermissionBase);
-   }
-
-
-
-   /*******************************************************************************
-    ** Set the catalog's native read/write permission base.
-    *******************************************************************************/
-   public void setProductPermissionBase(String productPermissionBase)
-   {
-      this.productPermissionBase = productPermissionBase;
-   }
-
-
-
-   /*******************************************************************************
-    ** Set the catalog's native read/write permission base fluently.
-    *******************************************************************************/
-   public CrmQBitConfig withProductPermissionBase(String productPermissionBase)
-   {
-      setProductPermissionBase(productPermissionBase);
-      return (this);
-   }
-
-
-
    /*******************************************************************************
     ** Getter for defaultBackendNameForTables
     *******************************************************************************/

src/main/java/com/kingsrook/qbits/crm/CrmQBitProducer.java

@@ -46,6 +46,7 @@ import com.kingsrook.qbits.crm.deals.customizers.DealStageChangeCustomizer;
 import com.kingsrook.qbits.crm.deals.model.Deal;
 import com.kingsrook.qbits.crm.deals.model.DealProduct;
 import com.kingsrook.qbits.crm.email.CrmEmailProcessIdentity;
+import com.kingsrook.qbits.crm.health.CrmHealthChecks;
 import com.kingsrook.qbits.crm.scoring.AutoAssignCustomizer;
 import com.kingsrook.qbits.crm.security.CrmDataPolicy;
 import com.kingsrook.qbits.crm.security.CrmPermissions;
@@ -151,6 +152,7 @@ public class CrmQBitProducer implements QBitMetaDataProducer<CrmQBitConfig>
       }
       CrmDataPolicy.apply(metaDataProducerMultiOutput, qInstance, qBitConfig);
       CrmIntegrations.apply(metaDataProducerMultiOutput, qBitConfig);
+      CrmHealthChecks.register(qInstance, qBitConfig);
       for(QWidgetMetaData widget : metaDataProducerMultiOutput.getEach(QWidgetMetaData.class))
       {
          widget.setName(snakeCase(widget.getName()));
@@ -208,10 +210,6 @@ public class CrmQBitProducer implements QBitMetaDataProducer<CrmQBitConfig>
             addOrComposeCustomizer(table, TableCustomizers.PRE_UPDATE_RECORD, new QCodeReference(CrmRelationshipValidator.class));
          }
          table.setPermissionRules(CrmPermissions.tableRules(tableName));
-         if("crm_product".equals(tableName))
-         {
-            table.getPermissionRules().setPermissionBaseName(qBitConfig.getProductPermissionBase());
-         }
          table.setSourceQBitName(getQBitMetaData().getName());
          if(table.getSections() != null)
          {

src/main/java/com/kingsrook/qbits/crm/deals/model/Product.java

@@ -87,8 +87,7 @@ public class Product extends QRecordEntity
             .withRecordLabelFormat("%s")
             .withRecordLabelFields("name")
             .withUniqueKey(new UniqueKey("sku"))
-            .withUniqueKey(new UniqueKey("slug"))
-            .withSection(SectionFactory.defaultT1("id", "name", "slug", "sku", "isActive"))
+            .withSection(SectionFactory.defaultT1("id", "name", "sku", "isActive"))
             .withSection(new QFieldSection("pricing", new QIcon("payments"), Tier.T2,
                List.of("unitPrice", "currencyCode")))
             .withSection(SectionFactory.defaultT2("description"))
@@ -146,13 +145,10 @@ public class Product extends QRecordEntity
    @QField(maxLength = 100, valueTooLongBehavior = ValueTooLongBehavior.ERROR)
    private String sku;
 
-   @QField(maxLength = 64, valueTooLongBehavior = ValueTooLongBehavior.ERROR)
-   private String slug;
-
    @QField()
    private String description;
 
-   @QField()
+   @QField(isRequired = true)
    private BigDecimal unitPrice;
 
    @QField(maxLength = 3, valueTooLongBehavior = ValueTooLongBehavior.ERROR, defaultValue = "USD")
@@ -188,37 +184,6 @@ public class Product extends QRecordEntity
 
 
 
-   /*******************************************************************************
-    ** Optional stable catalog slug for cross-module references.
-    *******************************************************************************/
-   public String getSlug()
-   {
-      return (slug);
-   }
-
-
-
-   /*******************************************************************************
-    ** Set the catalog slug.
-    *******************************************************************************/
-   public void setSlug(String slug)
-   {
-      this.slug = slug;
-   }
-
-
-
-   /*******************************************************************************
-    ** Set the catalog slug fluently.
-    *******************************************************************************/
-   public Product withSlug(String slug)
-   {
-      setSlug(slug);
-      return (this);
-   }
-
-
-
    /*******************************************************************************
     ** Getter for id
     *******************************************************************************/

src/main/java/com/kingsrook/qbits/crm/health/CrmHealthChecks.java

@@ -23,6 +23,7 @@ package com.kingsrook.qbits.crm.health;
 
 import java.time.Instant;
 import java.time.temporal.ChronoUnit;
+import java.util.LinkedHashMap;
 import java.util.List;
 import java.util.Map;
 import com.kingsrook.qbits.crm.CrmQBitConfig;
@@ -32,9 +33,15 @@ import com.kingsrook.qbits.crm.email.CrmEmailTransport;
 import com.kingsrook.qbits.crm.scoring.JobState;
 import com.kingsrook.qbits.crm.scoring.processes.CalculateLeadScoresProcess;
 import com.kingsrook.qqq.backend.core.actions.tables.QueryAction;
-import com.kingsrook.qqq.backend.core.context.CapturedContext;
-import com.kingsrook.qqq.backend.core.context.QContext;
+import com.kingsrook.qqq.backend.core.alerts.AlertSeverity;
 import com.kingsrook.qqq.backend.core.exceptions.QException;
+import com.kingsrook.qqq.backend.core.health.HealthCategory;
+import com.kingsrook.qqq.backend.core.health.HealthCheck;
+import com.kingsrook.qqq.backend.core.health.HealthCheckInput;
+import com.kingsrook.qqq.backend.core.health.HealthCheckKind;
+import com.kingsrook.qqq.backend.core.health.HealthCheckMetaData;
+import com.kingsrook.qqq.backend.core.health.HealthCheckOutcome;
+import com.kingsrook.qqq.backend.core.health.HealthChecksMetaData;
 import com.kingsrook.qqq.backend.core.model.actions.tables.query.QCriteriaOperator;
 import com.kingsrook.qqq.backend.core.model.actions.tables.query.QFilterCriteria;
 import com.kingsrook.qqq.backend.core.model.actions.tables.query.QFilterOrderBy;
@@ -42,24 +49,25 @@ import com.kingsrook.qqq.backend.core.model.actions.tables.query.QQueryFilter;
 import com.kingsrook.qqq.backend.core.model.actions.tables.query.QueryInput;
 import com.kingsrook.qqq.backend.core.model.data.QRecord;
 import com.kingsrook.qqq.backend.core.model.metadata.QInstance;
-import com.kingsrook.qqq.backend.core.model.session.QSession;
-import com.kingsrook.qqq.backend.core.model.session.QSystemUserSession;
-import com.kingsrook.qqq.middleware.health.HealthIndicator;
-import com.kingsrook.qqq.middleware.health.model.metadata.HealthCheckResult;
-import com.kingsrook.qqq.middleware.health.model.metadata.HealthStatus;
 
 
 /*******************************************************************************
- ** STAND-IN(core=QRun-IO/qqq#1199, removeBy=4.1.0-RC.9)
- ** CRM checks for hosts to register with their health middleware. Run in the
- ** caller's tenant context when one is supplied, else as the core system user;
- ** no check returns personal values.
+ ** CRM checks registered with the core health registry (HealthChecksMetaData).
+ ** The core HealthRunner schedules them and runs each one in its own automated
+ ** system-user context; no check returns personal values.
  *******************************************************************************/
 public class CrmHealthChecks
 {
+   public static final String EMAIL        = "crm.email";
+   public static final String SEQUENCE_LAG = "crm.sequence_lag";
+   public static final String LEAD_SCORE   = "crm.lead_score";
+
+   private static final String COMPONENT = "crm";
+
    private final CrmEmailTransport transport;
 
 
+
    /*******************************************************************************
     ** Use the same readiness decision as actual email delivery.
     *******************************************************************************/
@@ -69,6 +77,7 @@ public class CrmHealthChecks
    }
 
 
+
    /*******************************************************************************
     ** Allow a host transport adapter.
     *******************************************************************************/
@@ -78,121 +87,141 @@ public class CrmHealthChecks
    }
 
 
+
    /*******************************************************************************
-    ** Run all checks without registering tables or starting background workers.
+    ** Register the CRM checks with the instance's core health registry.
+    ** Production may run repeatedly; an already registered name is kept.
     *******************************************************************************/
-   public Map<String, HealthCheckResult> run() throws QException
+   public static void register(QInstance instance, CrmQBitConfig config)
    {
-      return (Map.of("crm.email", email(), "crm.sequenceLag", sequenceLag(), "crm.leadScore", leadScore()));
+      new CrmHealthChecks(config).registerWith(instance);
    }
 
 
+
    /*******************************************************************************
-    ** Expose individual checks through the RC.6 health SPI. With no caller
-    ** session (registration at startup), each check runs as the core system
-    ** user: token-based authentication modules (OAuth2, Auth0) reject any other
-    ** tokenless session, and the checks report only UP/DEGRADED, never values.
+    ** Register these checks (with this transport) with the core health registry.
     *******************************************************************************/
-   public List<HealthIndicator> indicators()
+   public void registerWith(QInstance instance)
    {
-      return (indicators(QContext.getQSession()));
+      HealthChecksMetaData registry = HealthChecksMetaData.ofOrWithNew(instance);
+      add(registry, EMAIL, "CRM email transport", HealthCategory.EMAIL, 300);
+      add(registry, SEQUENCE_LAG, "CRM sequence lag", HealthCategory.JOBS, 300);
+      add(registry, LEAD_SCORE, "CRM lead scoring", HealthCategory.JOBS, 900);
    }
 
 
-   /*******************************************************************************
-    ** Supply the host's monitoring session explicitly for middleware worker threads.
-    ** Its permissions and tenant keys are preserved; this adapter never grants keys.
-    ** A null session runs each check as the core system user.
-    *******************************************************************************/
-   public List<HealthIndicator> indicators(QSession session)
-   {
-      return (List.of(new Indicator("crm.email", session), new Indicator("crm.sequenceLag", session), new Indicator("crm.leadScore", session)));
-   }
-
 
    /*******************************************************************************
-    ** One independently evaluated middleware indicator.
+    ** Run all checks once in the caller's context, without registering anything.
     *******************************************************************************/
-   private class Indicator implements HealthIndicator
+   public Map<String, HealthCheckOutcome> run() throws QException
    {
-      private final String name;
-      private final QSession session;
-
-
-      /*******************************************************************************
-       ** Select a check.
-       *******************************************************************************/
-      private Indicator(String name, QSession session)
+      Map<String, HealthCheckOutcome> outcomes = new LinkedHashMap<>();
+      for(String name : List.of(EMAIL, SEQUENCE_LAG, LEAD_SCORE))
       {
-         this.name = name;
-         this.session = session;
+         outcomes.put(name, check(name).run(new HealthCheckInput()));
       }
+      return (outcomes);
+   }
 
 
-      @Override
-      public String getName()
+
+   /*******************************************************************************
+    ** The core SPI body for one named check. Failures are reported as UNKNOWN
+    ** with a fixed message, so no exception text (or value) leaves the check.
+    *******************************************************************************/
+   public HealthCheck check(String name)
+   {
+      return (new HealthCheck()
       {
-         return (name);
-      }
-
-
-      @Override
-      public HealthCheckResult check(QInstance instance)
-      {
-         CapturedContext original = QContext.capture();
-         try
+         /*******************************************************************
+          ** Evaluate the named check in the current QContext.
+          *******************************************************************/
+         @Override
+         public HealthCheckOutcome run(HealthCheckInput input)
          {
-            QContext.init(instance, session != null ? session : new QSystemUserSession(instance));
-            return (switch(name)
+            try
             {
-               case "crm.email" -> email();
-               case "crm.sequenceLag" -> sequenceLag();
-               default -> leadScore();
-            });
+               return (switch(name)
+               {
+                  case EMAIL -> email();
+                  case SEQUENCE_LAG -> sequenceLag();
+                  case LEAD_SCORE -> leadScore();
+                  default -> throw (new IllegalArgumentException("Unknown CRM health check"));
+               });
+            }
+            catch(QException | RuntimeException e)
+            {
+               return (HealthCheckOutcome.unknown("CRM check could not be completed"));
+            }
          }
-         catch(QException | RuntimeException e)
-         {
-            return (new HealthCheckResult().withStatus(HealthStatus.UNKNOWN).withDetail("reason", "CRM check could not be completed"));
-         }
-         finally
-         {
-            QContext.init(original);
-         }
-      }
+      });
    }
 
 
+
+   /*******************************************************************************
+    ** Add one check definition unless the name is already registered.
+    *******************************************************************************/
+   private void add(HealthChecksMetaData registry, String name, String label, HealthCategory category, int intervalSeconds)
+   {
+      if(registry.getChecks().stream().anyMatch(existing -> name.equals(existing.getName())))
+      {
+         return;
+      }
+      registry.withCheck(new HealthCheckMetaData()
+         .withName(name)
+         .withLabel(label)
+         .withComponent(COMPONENT)
+         .withCategory(category)
+         .withKind(HealthCheckKind.DEPENDENCY)
+         .withSeverity(AlertSeverity.WARNING)
+         .withIntervalSeconds(intervalSeconds)
+         .withTimeoutMs(5000)
+         .withCheckInstance(check(name)));
+   }
+
+
+
    /*******************************************************************************
     ** An unconfigured transport is degraded, not a claim that email can be sent.
     *******************************************************************************/
-   private HealthCheckResult email() throws QException
+   private HealthCheckOutcome email() throws QException
    {
-      return (new HealthCheckResult().withStatus(transport.readiness() == CrmReadiness.NOT_CONFIGURED ? HealthStatus.DEGRADED : HealthStatus.UP));
+      return (transport.readiness() == CrmReadiness.NOT_CONFIGURED
+         ? HealthCheckOutcome.degraded("Email transport not configured")
+         : HealthCheckOutcome.up("Email transport ready"));
    }
 
 
+
    /*******************************************************************************
     ** Query just the oldest active due enrollment.
     *******************************************************************************/
-   private HealthCheckResult sequenceLag() throws QException
+   private HealthCheckOutcome sequenceLag() throws QException
    {
       List<QRecord> rows = new QueryAction().execute(new QueryInput("crm_sequence_enrollment").withFilter(new QQueryFilter()
          .withCriteria(new QFilterCriteria("status", QCriteriaOperator.EQUALS, CrmEnrollmentStatus.ACTIVE.getId()))
          .withCriteria(new QFilterCriteria("nextStepDate", QCriteriaOperator.LESS_THAN, Instant.now().minus(30, ChronoUnit.MINUTES)))
          .withOrderBy(new QFilterOrderBy("nextStepDate")).withLimit(1))).getRecords();
-      return (new HealthCheckResult().withStatus(rows.isEmpty() ? HealthStatus.UP : HealthStatus.DEGRADED));
+      return (rows.isEmpty()
+         ? HealthCheckOutcome.up("No sequence step is more than 30 minutes late")
+         : HealthCheckOutcome.degraded("A sequence step is more than 30 minutes late"));
    }
 
 
+
    /*******************************************************************************
     ** No successful score pass, or one more than three hours old, needs attention.
     *******************************************************************************/
-   private HealthCheckResult leadScore() throws QException
+   private HealthCheckOutcome leadScore() throws QException
    {
       List<QRecord> rows = new QueryAction().execute(new QueryInput(JobState.TABLE_NAME).withFilter(new QQueryFilter(
          new QFilterCriteria("name", QCriteriaOperator.EQUALS, CalculateLeadScoresProcess.NAME)).withLimit(1))).getRecords();
       Instant last = rows.isEmpty() ? null : rows.getFirst().getValueInstant("lastSuccess");
-      return (new HealthCheckResult().withStatus(last == null || last.isBefore(Instant.now().minus(3, ChronoUnit.HOURS))
-         ? HealthStatus.DEGRADED : HealthStatus.UP));
+      return (last == null || last.isBefore(Instant.now().minus(3, ChronoUnit.HOURS))
+         ? HealthCheckOutcome.degraded("No lead score pass succeeded in the last 3 hours")
+         : HealthCheckOutcome.up("Lead scores are current"));
    }
 }

src/main/java/com/kingsrook/qbits/crm/scoring/processes/CalculateLeadScoresProcess.java

@@ -105,7 +105,11 @@ public class CalculateLeadScoresProcess implements BackendStep, MetaDataProducer
    @Override
    public void run(RunBackendStepInput input, RunBackendStepOutput output) throws QException
    {
-      Instant startedAt = Instant.now();
+      ////////////////////////////////////////////////////////////////////////
+      // modifyDate is kept at millisecond precision; a microsecond watermark //
+      // would skip a change made in the same millisecond the pass started.   //
+      ////////////////////////////////////////////////////////////////////////
+      Instant startedAt = Instant.now().truncatedTo(ChronoUnit.MILLIS);
       List<QRecord> states = new QueryAction().execute(new QueryInput(JobState.TABLE_NAME)
          .withFilter(new QQueryFilter(new QFilterCriteria("name", QCriteriaOperator.EQUALS, NAME)))).getRecords();
       QRecord state = states.isEmpty() ? new QRecord().withValue("name", NAME) : states.getFirst();

src/main/resources/db/liquibase/qbit-crm/crm-product-catalog.changelog.sql

@@ -1,7 +0,0 @@
---liquibase formatted sql
--- Run after the existing CRM base schema, before deploying shared catalog metadata.
--- Existing product identities, prices, deal-line amounts and tenant keys are preserved.
---changeset qbit-crm:crm_product_shared_catalog
-ALTER TABLE crm_product ADD COLUMN slug VARCHAR(64);
-ALTER TABLE crm_product ADD CONSTRAINT uq_crm_product_slug UNIQUE (slug);
-ALTER TABLE crm_product ALTER COLUMN unit_price DROP NOT NULL;

src/main/resources/help/qbit-crm.yaml

@@ -521,7 +521,7 @@ entries:
     content: |
       Use **{{label:crm_product}}** to review products and services available as deal line items.
 
-      **How rows get created:** Add your products or services with **New**, with a price and currency when known. Informational products may leave the catalog price blank; a deal line still requires its own agreed unit price.
+      **How rows get created:** Add your products or services with **New**, including their prices and currencies. You can then select them on deal product lines.
   - key: table:crm_product;section:identity
     summary: "The identifying details for this record."
   - key: table:crm_product;section:pricing
@@ -545,9 +545,7 @@ entries:
   - key: table:crm_product;field:modifyDate
     summary: "When this record was last changed."
   - key: table:crm_product;field:unitPrice
-    summary: "Optional catalog price per unit. Leave blank when not priced; deal lines require an agreed price."
-  - key: table:crm_product;field:slug
-    summary: "Optional unique stable identifier for this shared catalog product, up to 64 characters."
+    summary: "The price for one unit of the product."
   - key: table:crm_product;field:sku
     summary: "The product code used to identify the item."
   - key: table:crm_deal_stage_history;slot:help

src/test/java/com/kingsrook/qbits/crm/CrmHealthBulkLoadTest.java

@@ -33,14 +33,19 @@ import com.kingsrook.qbits.crm.health.CrmHealthChecks;
 import com.kingsrook.qbits.crm.scoring.processes.CalculateLeadScoresProcess;
 import com.kingsrook.qqq.backend.core.actions.tables.QueryAction;
 import com.kingsrook.qqq.backend.core.context.QContext;
+import com.kingsrook.qqq.backend.core.health.HealthCheckInput;
+import com.kingsrook.qqq.backend.core.health.HealthCheckMetaData;
+import com.kingsrook.qqq.backend.core.health.HealthChecksMetaData;
+import com.kingsrook.qqq.backend.core.health.HealthStatus;
 import com.kingsrook.qqq.backend.core.model.actions.tables.query.QueryInput;
 import com.kingsrook.qqq.backend.core.model.data.QRecord;
 import com.kingsrook.qqq.backend.core.model.metadata.QAuthenticationType;
+import com.kingsrook.qqq.backend.core.model.metadata.QInstance;
 import com.kingsrook.qqq.backend.core.model.metadata.authentication.QAuthenticationMetaData;
 import com.kingsrook.qqq.backend.core.model.metadata.code.QCodeReference;
 import com.kingsrook.qqq.backend.core.model.savedbulkloadprofiles.SavedBulkLoadProfileMetaDataProvider;
+import com.kingsrook.qqq.backend.core.model.session.QSystemUserSession;
 import com.kingsrook.qqq.backend.core.processes.implementations.bulk.insert.model.BulkLoadProfile;
-import com.kingsrook.qqq.middleware.health.model.metadata.HealthStatus;
 import org.junit.jupiter.api.Test;
 import static org.assertj.core.api.Assertions.assertThat;
 
@@ -51,27 +56,41 @@ import static org.assertj.core.api.Assertions.assertThat;
 class CrmHealthBulkLoadTest extends BaseTest
 {
    /*******************************************************************************
-    ** No transport or score run needs attention.
+    ** No transport or score run needs attention; the producer registered the
+    ** same checks with the core health registry.
     *******************************************************************************/
    @Test
    void noTransportOrScoreRunNeedsAttention() throws Exception
    {
       var checks = new CrmHealthChecks(new CrmQBitConfig());
       var results = checks.run();
-      assertThat(results.get("crm.email").getStatus()).isEqualTo(HealthStatus.DEGRADED);
-      assertThat(results.get("crm.leadScore").getStatus()).isEqualTo(HealthStatus.DEGRADED);
-      assertThat(results.get("crm.sequenceLag").getStatus()).isEqualTo(HealthStatus.UP);
-      checks.indicators().forEach(indicator ->
+      assertThat(results.get(CrmHealthChecks.EMAIL).getStatus()).isEqualTo(HealthStatus.DEGRADED);
+      assertThat(results.get(CrmHealthChecks.LEAD_SCORE).getStatus()).isEqualTo(HealthStatus.DEGRADED);
+      assertThat(results.get(CrmHealthChecks.SEQUENCE_LAG).getStatus()).isEqualTo(HealthStatus.UP);
+      for(HealthCheckMetaData registered : crmChecks(QContext.getQInstance()))
       {
-         try
-         {
-            assertThat(indicator.check(QContext.getQInstance()).getStatus()).isEqualTo(results.get(indicator.getName()).getStatus());
-         }
-         catch(Exception e)
-         {
-            throw (new AssertionError(e));
-         }
+         assertThat(registered.getCheckInstance().run(new HealthCheckInput()).getStatus()).isEqualTo(results.get(registered.getName()).getStatus());
+      }
+   }
+
+
+   /*******************************************************************************
+    ** The producer registers exactly the three CRM checks as valid core
+    ** definitions, and re-registration does not duplicate them.
+    *******************************************************************************/
+   @Test
+   void producerRegistersCoreHealthChecks()
+   {
+      QInstance instance = QContext.getQInstance();
+      assertThat(crmChecks(instance)).extracting(HealthCheckMetaData::getName)
+         .containsExactlyInAnyOrder(CrmHealthChecks.EMAIL, CrmHealthChecks.SEQUENCE_LAG, CrmHealthChecks.LEAD_SCORE);
+      assertThat(crmChecks(instance)).allSatisfy(check ->
+      {
+         assertThat(check.getCheckInstance()).isNotNull();
+         assertThat(check.getTimeoutMs()).isLessThan(check.getIntervalSeconds() * 1000);
       });
+      CrmHealthChecks.register(instance, new CrmQBitConfig());
+      assertThat(crmChecks(instance)).hasSize(3);
    }
 
 
@@ -101,8 +120,8 @@ class CrmHealthBulkLoadTest extends BaseTest
          .withValue("lastSuccess", Instant.now().minus(181, ChronoUnit.MINUTES)));
       com.kingsrook.qbits.crm.core.CrmRecords.update("crm_sequence_enrollment", new QRecord().withValue("id", 1)
          .withValue("nextStepDate", Instant.now().minus(31, ChronoUnit.MINUTES)));
-      assertThat(checks.run().get("crm.sequenceLag").getStatus()).isEqualTo(HealthStatus.DEGRADED);
-      assertThat(checks.run().get("crm.leadScore").getStatus()).isEqualTo(HealthStatus.DEGRADED);
+      assertThat(checks.run().get(CrmHealthChecks.SEQUENCE_LAG).getStatus()).isEqualTo(HealthStatus.DEGRADED);
+      assertThat(checks.run().get(CrmHealthChecks.LEAD_SCORE).getStatus()).isEqualTo(HealthStatus.DEGRADED);
    }
 
 
@@ -120,7 +139,7 @@ class CrmHealthBulkLoadTest extends BaseTest
             throw (new IllegalStateException("unavailable"));
          }
       });
-      assertThat(checks.indicators().getFirst().check(QContext.getQInstance()).getStatus()).isEqualTo(HealthStatus.UNKNOWN);
+      assertThat(checks.check(CrmHealthChecks.EMAIL).run(new HealthCheckInput()).getStatus()).isEqualTo(HealthStatus.UNKNOWN);
    }
 
 
@@ -163,27 +182,36 @@ class CrmHealthBulkLoadTest extends BaseTest
    }
 
    /*******************************************************************************
-    ** Health middleware invokes checks in worker threads without a caller QContext.
+    ** The core HealthRunner runs each check on a worker thread with no caller
+    ** QContext, as a QSystemUserSession. A registered CRM check must succeed that
+    ** way on a host whose authentication rejects tokenless sessions (OAuth2, Auth0).
     *******************************************************************************/
    @Test
-   void indicatorsCarryMonitoringSessionAndRestoreWorkerContext() throws Exception
+   void registeredChecksRunAsCoreSystemUserOnTokenRequiredHost() throws Exception
    {
       var instance = QContext.getQInstance();
-      var indicator = new CrmHealthChecks(new CrmQBitConfig()).indicators(QContext.getQSession()).get(1);
+      instance.withInstanceDefaultAuthentication(new QAuthenticationMetaData()
+         .withName("token-required")
+         .withType(QAuthenticationType.MOCK)
+         .withModuleCodeReference(new QCodeReference(TokenRequiredAuthenticationModule.class)));
+      HealthCheckMetaData sequenceLag = crmChecks(instance).stream()
+         .filter(check -> CrmHealthChecks.SEQUENCE_LAG.equals(check.getName())).findFirst().orElseThrow();
       var status = java.util.concurrent.CompletableFuture.supplyAsync(() ->
       {
+         assertThat(QContext.getQInstance()).isNull();
+         QContext.init(instance, new QSystemUserSession(instance));
          try
          {
-            assertThat(QContext.getQInstance()).isNull();
-            var result = indicator.check(instance);
-            assertThat(QContext.getQInstance()).isNull();
-            assertThat(QContext.getQSession()).isNull();
-            return (result.getStatus());
+            return (sequenceLag.getCheckInstance().run(new HealthCheckInput().withQInstance(instance)).getStatus());
          }
          catch(Exception e)
          {
             throw (new AssertionError(e));
          }
+         finally
+         {
+            QContext.clear();
+         }
       }).get();
       assertThat(status).isEqualTo(HealthStatus.UP);
       assertThat(QContext.getQInstance()).isSameAs(instance);
@@ -192,32 +220,12 @@ class CrmHealthBulkLoadTest extends BaseTest
 
 
    /*******************************************************************************
-    ** Regression: indicators registered with no caller session (at host startup)
-    ** must still run on a host whose authentication rejects tokenless sessions
-    ** (OAuth2, Auth0). They used a plain new QSession(), so every check failed
-    ** session validation and reported UNKNOWN.
+    ** The CRM definitions in the core health registry.
     *******************************************************************************/
-   @Test
-   void contextlessIndicatorsRunOnTokenRequiredHost() throws Exception
+   private static List<HealthCheckMetaData> crmChecks(QInstance instance)
    {
-      var instance = QContext.getQInstance();
-      instance.withInstanceDefaultAuthentication(new QAuthenticationMetaData()
-         .withName("token-required")
-         .withType(QAuthenticationType.MOCK)
-         .withModuleCodeReference(new QCodeReference(TokenRequiredAuthenticationModule.class)));
-      var status = java.util.concurrent.CompletableFuture.supplyAsync(() ->
-      {
-         try
-         {
-            var indicator = new CrmHealthChecks(new CrmQBitConfig()).indicators().get(1);
-            return (indicator.check(instance).getStatus());
-         }
-         catch(Exception e)
-         {
-            throw (new AssertionError(e));
-         }
-      }).get();
-      assertThat(status).isEqualTo(HealthStatus.UP);
+      return (HealthChecksMetaData.ofOrWithNew(instance).getChecks().stream()
+         .filter(check -> "crm".equals(check.getComponent())).toList());
    }
 
 }

src/test/java/com/kingsrook/qbits/crm/CrmPermissionsTest.java

@@ -37,52 +37,6 @@ import static org.assertj.core.api.Assertions.assertThat;
  *******************************************************************************/
 class CrmPermissionsTest extends BaseTest
 {
-   /*******************************************************************************
-    ** Legacy hosts retain management access; the shared catalog is opt-in.
-    *******************************************************************************/
-   @Test
-   void testDefaultCatalogPermissions()
-   {
-      QueryInput input = new QueryInput("crm_product");
-      QContext.getQSession().setPermissions(Set.of(CrmPermissions.MANAGE_READ, CrmPermissions.MANAGE_WRITE));
-      assertThat(PermissionsHelper.hasTablePermission(input, "crm_product", TablePermissionSubType.READ)).isTrue();
-      assertThat(PermissionsHelper.hasTablePermission(input, "crm_product", TablePermissionSubType.EDIT)).isTrue();
-      QContext.getQSession().setPermissions(Set.of("crm.product.read"));
-      assertThat(PermissionsHelper.hasTablePermission(input, "crm_product", TablePermissionSubType.READ)).isFalse();
-   }
-
-
-
-   /*******************************************************************************
-    ** Native catalog read grants cannot write or open unrelated CRM settings.
-    *******************************************************************************/
-   @Test
-   void testSharedCatalogPermissions() throws Exception
-   {
-      com.kingsrook.qqq.backend.core.model.metadata.QInstance instance = new com.kingsrook.qqq.backend.core.model.metadata.QInstance();
-      instance.withInstanceDefaultAuthentication(new com.kingsrook.qqq.backend.core.model.metadata.authentication.QAuthenticationMetaData()
-         .withName("anonymous").withType(com.kingsrook.qqq.backend.core.model.metadata.QAuthenticationType.FULLY_ANONYMOUS));
-      instance.addBackend(QContext.getQInstance().getBackend(BACKEND_NAME));
-      new CrmQBitProducer().withQBitConfig(new CrmQBitConfig().withDefaultBackendNameForTables(BACKEND_NAME)
-         .withProductPermissionBase("crm.product")).produce(instance).addSelfToInstance(instance);
-      QContext.init(instance, QContext.getQSession());
-      QueryInput input = new QueryInput("crm_product");
-      QContext.getQSession().setPermissions(Set.of("crm.product.read"));
-      assertThat(PermissionsHelper.hasTablePermission(input, "crm_product", TablePermissionSubType.READ)).isTrue();
-      for(TablePermissionSubType write : Set.of(TablePermissionSubType.INSERT, TablePermissionSubType.EDIT, TablePermissionSubType.DELETE))
-      {
-         assertThat(PermissionsHelper.hasTablePermission(input, "crm_product", write)).isFalse();
-      }
-      assertThat(PermissionsHelper.hasTablePermission(input, "crm_pipeline", TablePermissionSubType.READ)).isFalse();
-      assertThat(PermissionsHelper.hasTablePermission(input, "crm_contact", TablePermissionSubType.READ)).isFalse();
-      assertThat(PermissionsHelper.hasProcessPermission(input, "crm_merge_contacts")).isFalse();
-      QContext.getQSession().setPermissions(Set.of(CrmPermissions.MANAGE_READ, CrmPermissions.MANAGE_WRITE, "crm.product.read", "crm.product.write"));
-      assertThat(PermissionsHelper.hasTablePermission(input, "crm_product", TablePermissionSubType.EDIT)).isTrue();
-      assertThat(PermissionsHelper.hasTablePermission(input, "crm_pipeline", TablePermissionSubType.EDIT)).isTrue();
-   }
-
-
-
    /*******************************************************************************
     ** A read grant does not allow writes or settings access.
     *******************************************************************************/

src/test/java/com/kingsrook/qbits/crm/CrmQBitConfigTest.java

@@ -41,22 +41,6 @@ import static org.assertj.core.api.Assertions.assertThat;
 class CrmQBitConfigTest
 {
 
-   /*******************************************************************************
-    ** Catalog permission bases must be explicit; legacy behavior is the default.
-    *******************************************************************************/
-   @Test
-   void testCatalogPermissionBase()
-   {
-      CrmQBitConfig config = new CrmQBitConfig().withDefaultBackendNameForTables("memory");
-      assertThat(config.getProductPermissionBase()).isEqualTo("crm.manage");
-      config.setProductPermissionBase(" ");
-      List<String> errors = new ArrayList<>();
-      config.validate(new QInstance(), errors);
-      assertThat(errors).contains("CrmQBitConfig.productPermissionBase is required");
-   }
-
-
-
    /*******************************************************************************
     ** Test all fluent setters and corresponding getters.
     *******************************************************************************/

src/test/java/com/kingsrook/qbits/crm/CrmRdbmsTest.java

@@ -281,7 +281,6 @@ class CrmRdbmsTest
       var freshColumns = schemaColumns();
       executeSql("DROP ALL OBJECTS;");
       executeSql(changelog);
-      executeSql(Files.readString(Path.of("src/main/resources/db/liquibase/qbit-crm/crm-product-catalog.changelog.sql")));
       assertThat(schemaColumns()).isEqualTo(freshColumns);
       insert("crm_contact", new QRecord().withValue("email", "email-only@example.test"));
    }

src/test/java/com/kingsrook/qbits/crm/deals/DealProductTest.java

@@ -52,25 +52,6 @@ import static org.junit.jupiter.api.Assertions.assertNotNull;
 class DealProductTest extends BaseTest
 {
 
-   /*******************************************************************************
-    ** Optional catalog pricing does not make the agreed line price optional.
-    *******************************************************************************/
-   @Test
-   void testUnpricedCatalogStillRequiresLinePrice() throws QException
-   {
-      Integer productId = insertProduct("Unpriced service", "UNPRICED", null);
-      InsertOutput missing = new InsertAction().execute(new InsertInput(DealProduct.TABLE_NAME)
-         .withRecordEntity(new DealProduct().withDealId(1).withProductId(productId).withQuantity(BigDecimal.ONE)));
-      assertThat(missing.getRecords().get(0).getErrors()).isNotEmpty();
-      InsertOutput agreed = new InsertAction().execute(new InsertInput(DealProduct.TABLE_NAME)
-         .withRecordEntity(new DealProduct().withDealId(1).withProductId(productId).withQuantity(new BigDecimal("2"))
-            .withUnitPrice(new BigDecimal("12.50"))));
-      assertThat(agreed.getRecords().get(0).getErrors()).isEmpty();
-      assertThat(new QueryAction().execute(new QueryInput(DealProduct.TABLE_NAME)).getRecords().get(0).getValueBigDecimal("totalAmount")).isEqualByComparingTo("25.00");
-   }
-
-
-
    /*******************************************************************************
     ** Verify the table is registered with the correct icon.
     *******************************************************************************/

src/test/java/com/kingsrook/qbits/crm/deals/ProductCatalogMigrationTest.java

@@ -1,76 +0,0 @@
-/*
- * QQQ - Low-code Application Framework for Engineers.
- * Copyright (C) 2021-2026.  Kingsrook, LLC
- * 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
- * contact@kingsrook.com
- * https://github.com/Kingsrook/
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     https://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-
-package com.kingsrook.qbits.crm.deals;
-
-
-import java.sql.Connection;
-import java.sql.DriverManager;
-import java.sql.SQLException;
-import java.util.UUID;
-import liquibase.Liquibase;
-import liquibase.database.jvm.JdbcConnection;
-import liquibase.resource.ClassLoaderResourceAccessor;
-import org.junit.jupiter.api.Test;
-import static org.assertj.core.api.Assertions.assertThat;
-import static org.assertj.core.api.Assertions.assertThatThrownBy;
-
-
-/*******************************************************************************
- ** Upgrade an existing catalog without changing prices or product identities.
- *******************************************************************************/
-class ProductCatalogMigrationTest
-{
-   /*******************************************************************************
-    ** The real additive changeset preserves priced rows and permits unpriced
-    ** products while enforcing non-null slug uniqueness.
-    *******************************************************************************/
-   @Test
-   void upgradesPopulatedCatalog() throws Exception
-   {
-      try(Connection connection = DriverManager.getConnection("jdbc:h2:mem:catalog_" + UUID.randomUUID() + ";MODE=PostgreSQL"))
-      {
-         connection.createStatement().execute("CREATE TABLE crm_product (id INTEGER GENERATED BY DEFAULT AS IDENTITY PRIMARY KEY, name VARCHAR(250) NOT NULL, unit_price DECIMAL(20,6) NOT NULL)");
-         connection.createStatement().execute("INSERT INTO crm_product(id,name,unit_price) VALUES (42,'Existing product',77.25)");
-         try(Liquibase liquibase = new Liquibase("db/liquibase/qbit-crm/crm-product-catalog.changelog.sql",
-            new ClassLoaderResourceAccessor(), new JdbcConnection(connection)))
-         {
-            liquibase.update();
-            liquibase.update();
-            try(var result = connection.createStatement().executeQuery("SELECT id,unit_price FROM crm_product"))
-            {
-               assertThat(result.next()).isTrue();
-               assertThat(result.getInt("id")).isEqualTo(42);
-               assertThat(result.getBigDecimal("unit_price")).isEqualByComparingTo("77.25");
-            }
-            connection.createStatement().execute("INSERT INTO crm_product(name,slug) VALUES ('Informational','info')");
-            connection.createStatement().execute("INSERT INTO crm_product(name) VALUES ('No slug one'),('No slug two')");
-            assertThatThrownBy(() -> connection.createStatement().execute("INSERT INTO crm_product(name,slug) VALUES ('Duplicate','info')"))
-               .isInstanceOf(SQLException.class);
-            try(var result = connection.createStatement().executeQuery("SELECT unit_price FROM crm_product WHERE slug='info'"))
-            {
-               assertThat(result.next()).isTrue();
-               assertThat(result.getBigDecimal(1)).isNull();
-            }
-         }
-      }
-   }
-}

src/test/java/com/kingsrook/qbits/crm/deals/ProductTest.java

@@ -54,28 +54,6 @@ import static org.junit.jupiter.api.Assertions.assertTrue;
 class ProductTest extends BaseTest
 {
 
-   /*******************************************************************************
-    ** An informational catalog product has no invented price; slugs are unique.
-    *******************************************************************************/
-   @Test
-   void testUnpricedCatalogProductAndSlug() throws QException
-   {
-      InsertOutput first = new InsertAction().execute(new InsertInput(Product.TABLE_NAME)
-         .withRecordEntity(new Product().withName("Documentation toolkit").withSlug("toolkit")));
-      assertThat(first.getRecords().get(0).getErrors()).isEmpty();
-      Product stored = new Product(new QueryAction().execute(new QueryInput(Product.TABLE_NAME)).getRecords().get(0));
-      assertThat(stored.getSlug()).isEqualTo("toolkit");
-      assertThat(stored.getUnitPrice()).isNull();
-      InsertOutput duplicate = new InsertAction().execute(new InsertInput(Product.TABLE_NAME)
-         .withRecordEntity(new Product().withName("Other toolkit").withSlug("toolkit")));
-      assertThat(duplicate.getRecords().get(0).getErrors()).isNotEmpty();
-      InsertOutput optional = new InsertAction().execute(new InsertInput(Product.TABLE_NAME)
-         .withRecords(List.of(new Product().withName("No slug one").toQRecord(), new Product().withName("No slug two").toQRecord())));
-      assertThat(optional.getRecords()).allSatisfy(record -> assertThat(record.getErrors()).isEmpty());
-   }
-
-
-
    /*******************************************************************************
     ** Verify the table and PVS are registered.
     *******************************************************************************/