Publish the QQQ 4.1 custom-apps integration with session-scoped metadata #17

Closed

james.maes wants to merge 2 commits from feature/kof22-custom-apps-canonical into develop

pull from: feature/kof22-custom-apps-canonical

merge into: QRun-IO:develop

QRun-IO:main

QRun-IO:release/0.2

QRun-IO:develop

QRun-IO:release/0.1

QRun-IO:kof22/release-1.0-prep

QRun-IO:fix/codeql-develop-20261029

QRun-IO:fix/codeql-main-20261029

QRun-IO:ci/develop-central-orb

QRun-IO:feature/orb-0.8-track

QRun-IO:feature/orb-0712-stable-gate

QRun-IO:feature/orb-0.7.11

QRun-IO:feature/central-ci

QRun-IO:feature/security-findings-2026-10

QRun-IO:feature/release-rc-automation

QRun-IO:feature/ga-only-release-tags

Conversation 1 Commits 2 Files Changed 10

+1033 -17

james.maes commented 2026-11-05 15:30:34 +00:00

Owner

Copy link

Copy source

Move KOF22's custom-apps integration into the owning library: preserve per-session metadata, local-widget backends, restricted permissions and allowed component hosts. Build against published QQQ 4.1.0-RC.21 and the newly verified permissions artifact 0.33.0-RC.1.

The source matches the deployed host's feature port. Existing PostgreSQL coverage is carried with it; no new test framework or local full-suite run. Static published-API checks found no missing imported classes or changed method names; native compilation and tests run on this PR. The permissions dependency is confirmed available from public Maven Central.

Move KOF22's custom-apps integration into the owning library: preserve per-session metadata, local-widget backends, restricted permissions and allowed component hosts. Build against published QQQ 4.1.0-RC.21 and the newly verified permissions artifact 0.33.0-RC.1. The source matches the deployed host's feature port. Existing PostgreSQL coverage is carried with it; no new test framework or local full-suite run. Static published-API checks found no missing imported classes or changed method names; native compilation and tests run on this PR. The permissions dependency is confirmed available from public Maven Central.

james.maes added 1 commit 2026-11-05 15:30:34 +00:00

feat: per-session custom apps, a local widget backend and restricted permissions on QQQ 4.1 ... 2b95715c35

Port the host-proven Custom Apps work onto upstream develop (9ba3336f):
- LOCAL_WIDGET backend for custom screens that show a widget over local data, and the
  allowed-component-hosts and backend-name settings in CustomAppsQBitConfig (https hosts
  only, lower-cased, no embedded credentials);
- CustomAppsMetaDataActionCustomizer, which gives each session exactly the containers,
  apps and widgets whose "<name>.hasAccess" permission it holds;
- permission widgets for custom apps and custom app containers (the roles that hold the
  permission, as a child record list) and the metadata producer changes behind them;
- CustomAppsPostgresTest and TestDdl: the schema owner creates the tables, the application
  runs as a DML-only role, on a real PostgreSQL 17 (Testcontainers, UTC surefire argLine).

Build against the published QQQ 4.1 core (qqq-bom-pom 4.1.0-RC.21) and
qbit-user-role-permissions 0.33.0-RC.1 (canonical registry and Maven Central; its core
dependency is excluded so the QQQ BOM governs). The only SNAPSHOT left is the project's own
development revision. Every qqq class the sources import exists in the published RC.21 and
URP jars and every QQQ-style call name resolves in them (read-only javap); not compiled here.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

james.maes added 1 commit 2026-11-05 16:26:22 +00:00

build: fall back to canonical Maven Central for releases the CI mirror lacks ... b732123636

Native verify 5037 failed solely because qbit-user-role-permissions 0.33.0-RC.1 (published
to Maven Central; HEAD repo.maven.apache.org 200) was not yet in the CI's Google-hosted
Central mirror (the same path returns 404 and the mirror's metadata omits the version).
The CI settings mirror only repository id "central" and Maven has no mirror failover.

Declare the canonical Central URL as a second, release-only repository with the id the
platform's own fallback profile uses (canonical-maven-central). It is tried only when
central misses; it adds no credential and no private or snapshot repository, and the
dependency version and every other pin are unchanged.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

james.maes referenced this pull request 2026-11-06 23:20:17 +00:00

feat: per-session custom apps, local widget backend, restricted permissions on QQQ 4.1.0-RC.22 #22

james.maes commented 2026-11-06 23:28:09 +00:00

Author

Owner

Copy link

Copy source

Superseded by #22 (cherry-picked work, Gitea-only publishing, QQQ 4.1.0-RC.22).

Superseded by #22 (cherry-picked work, Gitea-only publishing, QQQ 4.1.0-RC.22).

james.maes closed this pull request 2026-11-06 23:28:14 +00:00

Pull request closed

Please reopen this pull request to perform a merge.

Sign in to join this conversation.

Reviewers

No Reviewers

Labels

Clear labels

bug

Something isn't working

dependencies

documentation

Improvements or additions to documentation

duplicate

This issue or pull request already exists

enhancement

New feature or request

good first issue

Good for newcomers

help wanted

Extra attention is needed

invalid

This doesn't seem right

java

Pull requests that update java code

question

Further information is requested

secuurity

wontfix

This will not be worked on

No labels

Milestone

No items

No Milestone

Projects

Clear projects

No projects

Assignees

Clear assignees

forge-recovery (Forge Recovery) james.maes (James Maes)

No Assignees

1 Participants

Notifications

Subscribe

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: QRun-IO/qbit-custom-apps#17