feat: per-session custom apps, local widget backend, restricted permissions on QQQ 4.1.0-RC.22 #22

Merged

james.maes merged 2 commits from kof22/release-1.0-prep into develop 2026-11-06 23:28:05 +00:00

Conversation 0 Commits 2 Files Changed 11

+1022 -22

james.maes commented 2026-11-06 23:20:16 +00:00

Owner

Copy link

Copy source

Supersedes #17. Cherry-picks the KOF22 work (2b95715), drops the Maven Central fallback (Gitea-only publishing), pins QQQ BOM 4.1.0-RC.22 and qbit-user-role-permissions 0.33.0-RC.1, updates README status.

🤖 Generated with Claude Code

Supersedes #17. Cherry-picks the KOF22 work (2b95715), drops the Maven Central fallback (Gitea-only publishing), pins QQQ BOM 4.1.0-RC.22 and qbit-user-role-permissions 0.33.0-RC.1, updates README status. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

james.maes added 2 commits 2026-11-06 23:20:17 +00:00

feat: per-session custom apps, a local widget backend and restricted permissions on QQQ 4.1 ... 0d876645b9

Port the host-proven Custom Apps work onto upstream develop (9ba3336f):
- LOCAL_WIDGET backend for custom screens that show a widget over local data, and the
  allowed-component-hosts and backend-name settings in CustomAppsQBitConfig (https hosts
  only, lower-cased, no embedded credentials);
- CustomAppsMetaDataActionCustomizer, which gives each session exactly the containers,
  apps and widgets whose "<name>.hasAccess" permission it holds;
- permission widgets for custom apps and custom app containers (the roles that hold the
  permission, as a child record list) and the metadata producer changes behind them;
- CustomAppsPostgresTest and TestDdl: the schema owner creates the tables, the application
  runs as a DML-only role, on a real PostgreSQL 17 (Testcontainers, UTC surefire argLine).

Build against the published QQQ 4.1 core (qqq-bom-pom 4.1.0-RC.21) and
qbit-user-role-permissions 0.33.0-RC.1 (canonical registry and Maven Central; its core
dependency is excluded so the QQQ BOM governs). The only SNAPSHOT left is the project's own
development revision. Every qqq class the sources import exists in the published RC.21 and
URP jars and every QQQ-style call name resolves in them (read-only javap); not compiled here.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

build: pin QQQ 4.1.0-RC.22 from the Gitea registry and update README status ... a389bfb8b0

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

james.maes merged commit 0447f6ebad into develop 2026-11-06 23:28:05 +00:00

james.maes referenced this pull request 2026-11-06 23:28:09 +00:00

Publish the QQQ 4.1 custom-apps integration with session-scoped metadata #17

Sign in to join this conversation.

Reviewers

No Reviewers

Labels

Clear labels

bug

Something isn't working

dependencies

documentation

Improvements or additions to documentation

duplicate

This issue or pull request already exists

enhancement

New feature or request

good first issue

Good for newcomers

help wanted

Extra attention is needed

invalid

This doesn't seem right

java

Pull requests that update java code

question

Further information is requested

secuurity

wontfix

This will not be worked on

No labels

Milestone

No items

No Milestone

Projects

Clear projects

No projects

Assignees

Clear assignees

forge-recovery (Forge Recovery) james.maes (James Maes)

No Assignees

1 Participants

Notifications

Subscribe

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: QRun-IO/qbit-custom-apps#22