Skip to content

Commit 9c35252

Browse files
devondragondevondragon
committed
[Gradle Release Plugin] - pre tag commit: '4.1.0'.
1 parent e50d5c5 commit 9c35252

2 files changed

Lines changed: 86 additions & 1 deletion

File tree

‎CHANGELOG.md‎

Lines changed: 85 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,88 @@
1+
## [4.1.0] - 2026-02-02
2+
### Features
3+
- GDPR compliance (opt‑in, disabled by default)
4+
- New REST API under /user/gdpr/* (auth required; 404 when disabled):
5+
- GET /user/gdpr/export – Full JSON export of user data (account, audit history, consents, token metadata, and custom data via contributors)
6+
- POST /user/gdpr/delete – Orchestrated account deletion (hard delete)
7+
- POST /user/gdpr/consent – Record consent grant/withdrawal (built‑in types + custom)
8+
- GET /user/gdpr/consent/status – Current consent state
9+
- Services and types:
10+
- GdprExportService – Aggregates export data (Article 15), includes audit events and consent history
11+
- GdprDeletionService – Executes deletion workflow (Article 17) and publishes lifecycle events
12+
- ConsentAuditService – Tracks consent changes via audit logging
13+
- GdprDataContributor – Extension point for apps to contribute domain data to exports and to clean up during deletion
14+
- DTOs and enums: GdprExportDTO, ConsentRecord, ConsentType, ConsentExtraData, ConsentRequestDto (validated)
15+
- Audit log query infrastructure:
16+
- AuditLogQueryService + FileAuditLogQueryService – Streamed, filterable file‑based audit reader for GDPR export
17+
- Supports filtering by user, timestamp, and action; handles pipe‑delimited format, unescaped pipes, zone‑less timestamps
18+
- Application events for GDPR lifecycle:
19+
- UserDataExportedEvent, UserDeletedEvent (post‑transaction), ConsentChangedEvent; plus existing UserPreDeleteEvent usage
20+
- Configuration (defaults in dsspringuserconfig.properties):
21+
- user.gdpr.enabled=false, user.gdpr.exportBeforeDeletion=true, user.gdpr.consentTracking=true
22+
- user.audit.maxQueryResults=10000 (cap for file‑based audit queries)
23+
- Deletion flow hardens security and consistency:
24+
- Invalidates all sessions across all devices before deletion
25+
- Publishes pre/post deletion events, deletes framework artifacts (tokens, password history), logs out current session
26+
- ObjectMapper is injected (respects app Jackson config) for stable JSON handling across services
27+
28+
### Fixes
29+
- Security and data integrity
30+
- Replaced manual string JSON handling with Jackson serialization/deserialization to remove injection risks
31+
- Removed PII (emails) from GDPR logs; log user IDs; sanitized custom consent type names in logs (avoid leaking identifiers)
32+
- Added strict input validation for custom consent types in ConsentRequestDto:
33+
- @Size(max = 100), @Pattern allowing only alphanumeric, underscore, hyphen; regex updated to require non‑empty value
34+
- Invalidate all user sessions (not just current) on GDPR deletion via SessionInvalidationService
35+
- Preserve user identity in GDPR deletion audit event; pass user object during audit logging
36+
- Use getSession(false) for GDPR audit logging to avoid creating sessions during logging
37+
- Performance and stability
38+
- FileAuditLogQueryService now streams file lines (Files.lines) to avoid unbounded memory usage
39+
- Added configurable query cap user.audit.maxQueryResults (default 10000) and enforced it in stream processing
40+
- Defensive parsing for unescaped pipes in audit lines; tolerant timestamp parsing:
41+
- Fallback from ZonedDateTime to LocalDateTime (system default zone) for zone‑less dates
42+
- Correctness
43+
- When a consent is re‑granted, withdrawnAt is cleared to reflect active consent
44+
- Javadoc and docs fixes (see Documentation)
45+
46+
### Breaking Changes
47+
- None. GDPR features are disabled by default and are only exposed when explicitly enabled. Existing APIs and behavior remain unchanged.
48+
49+
### Refactoring
50+
- Code quality improvements:
51+
- Centralized JSON handling via Spring‑configured ObjectMapper in GdprExportService and ConsentAuditService
52+
- Shared client IP resolution via UserUtils.getClientIP()
53+
54+
### Documentation
55+
- Comprehensive GDPR documentation added to README and CONFIG:
56+
- Enabling features, configuration examples, endpoint usage, consent management, export/deletion flows, events
57+
- Extending exports via GdprDataContributor with transaction safety guidance (perform external cleanup after commit using UserDeletedEvent)
58+
- Rate limiting recommendations for export/delete endpoints
59+
- README improvements:
60+
- “GDPR Compliance” added to Features
61+
- Updated dependency coordinates to 4.1.0 in Maven/Gradle snippets for Spring Boot 4.0
62+
- New anchors: Spring Boot 4.0 Key Changes; Admin Password Reset; table formatting consistency
63+
- Javadoc fix:
64+
- Corrected ConsentType CUSTOM reference to ConsentRecord#customType
65+
66+
### Testing
67+
- New unit test suites:
68+
- GdprAPI – Auth flows, GDPR toggle behavior, consent validation, export and deletion endpoints
69+
- FileAuditLogQueryService – Streaming, filtering, timestamp parsing, cap enforcement
70+
- ConsentChangedEvent, UserDeletedEvent – Event publication/fields
71+
- ConsentAuditService – Parsing and aggregation logic
72+
- GdprDeletionService – Deletion orchestration and edge cases
73+
- GdprExportService – Export composition, consent re‑grant behavior
74+
- Test dependency update:
75+
- org.assertj:assertj-core bumped 3.27.6 → 3.27.7
76+
77+
### Other Changes
78+
- Build and tooling
79+
- Gradle Wrapper updated: 9.1.0 → 9.3.0 → 9.3.1
80+
- Spring Boot Gradle plugin updated: 4.0.1 → 4.0.2
81+
- Version bumps:
82+
- gradle.properties: 4.0.3 → 4.0.4-SNAPSHOT, then 4.1.0-SNAPSHOT
83+
- Repository housekeeping
84+
- Added context7.json verification file (service verification; no runtime impact)
85+
186
## [4.0.3] - 2026-01-26
287
### Features
388
- Internationalization resilience and defaults

‎gradle.properties‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,3 @@
1-
version=4.1.0-SNAPSHOT
1+
version=4.1.0
22
mavenCentralPublishing=true
33
mavenCentralAutomaticPublishing=true

0 commit comments

Comments
 (0)