Publish the QQQ 4.1 custom-apps integration with session-scoped metadata #17

Closed

james.maes wants to merge 2 commits from feature/kof22-custom-apps-canonical into develop

pull from: feature/kof22-custom-apps-canonical

merge into: QRun-IO:develop

QRun-IO:main

QRun-IO:release/0.2

QRun-IO:develop

QRun-IO:release/0.1

QRun-IO:kof22/release-1.0-prep

QRun-IO:fix/codeql-develop-20261029

QRun-IO:fix/codeql-main-20261029

QRun-IO:ci/develop-central-orb

QRun-IO:feature/orb-0.8-track

QRun-IO:feature/orb-0712-stable-gate

QRun-IO:feature/orb-0.7.11

QRun-IO:feature/central-ci

QRun-IO:feature/security-findings-2026-10

QRun-IO:feature/release-rc-automation

QRun-IO:feature/ga-only-release-tags

Conversation 1 Commits 2 Files Changed 10

+1033 -17

2 Commits

Author	SHA1	Message	Date
james.maesandClaude Sonnet 5.5	b732123636	build: fall back to canonical Maven Central for releases the CI mirror lacks ... Native verify 5037 failed solely because qbit-user-role-permissions 0.33.0-RC.1 (published to Maven Central; HEAD repo.maven.apache.org 200) was not yet in the CI's Google-hosted Central mirror (the same path returns 404 and the mirror's metadata omits the version). The CI settings mirror only repository id "central" and Maven has no mirror failover. Declare the canonical Central URL as a second, release-only repository with the id the platform's own fallback profile uses (canonical-maven-central). It is tried only when central misses; it adds no credential and no private or snapshot repository, and the dependency version and every other pin are unchanged. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>	2026-11-05 10:23:32 -06:00
james.maesandClaude Sonnet 5.5	2b95715c35	feat: per-session custom apps, a local widget backend and restricted permissions on QQQ 4.1 ... Port the host-proven Custom Apps work onto upstream develop (9ba3336f): - LOCAL_WIDGET backend for custom screens that show a widget over local data, and the allowed-component-hosts and backend-name settings in CustomAppsQBitConfig (https hosts only, lower-cased, no embedded credentials); - CustomAppsMetaDataActionCustomizer, which gives each session exactly the containers, apps and widgets whose "<name>.hasAccess" permission it holds; - permission widgets for custom apps and custom app containers (the roles that hold the permission, as a child record list) and the metadata producer changes behind them; - CustomAppsPostgresTest and TestDdl: the schema owner creates the tables, the application runs as a DML-only role, on a real PostgreSQL 17 (Testcontainers, UTC surefire argLine). Build against the published QQQ 4.1 core (qqq-bom-pom 4.1.0-RC.21) and qbit-user-role-permissions 0.33.0-RC.1 (canonical registry and Maven Central; its core dependency is excluded so the QQQ BOM governs). The only SNAPSHOT left is the project's own development revision. Every qqq class the sources import exists in the published RC.21 and URP jars and every QQQ-style call name resolves in them (read-only javap); not compiled here. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>	2026-11-05 09:07:08 -06:00