fix: value resolver 403, CamundaTask modify action, and register the freemarker plugins (v12)

.github/workflows/frontend_build_push_docker_image.yml

@@ -125,29 +125,9 @@ jobs:
           name: ${{ inputs.frontend_libraries_build_artifact_name }}
           path: frontend/dist/
 
-      - name: Add release plugin dependencies
-        shell: bash
-        run: |
-          set -euo pipefail
-
-          # Plugin packages live outside package.json so local dev (npm start)
-          # doesn't pull them in — the workspace symlinks would break Vite's
-          # pre-bundling of their @valtimo/* transitive imports. Release builds
-          # use fileReplacements to swap src/app/app-plugins.ts -> .prod.ts,
-          # which imports these packages; CI installs them here per-branch
-          # using the pins in release-plugins.json.
-          if [ ! -f "release-plugins.json" ]; then
-            echo "::notice::release-plugins.json not found; skipping release plugin pin"
-            exit 0
-          fi
-
-          jq -r 'to_entries[] | "dependencies.\(.key)=\(.value)"' release-plugins.json \
-            | while IFS= read -r entry; do
-                npm pkg set "$entry"
-              done
-
-          echo "Release plugin pins applied:"
-          jq -r 'to_entries[] | "  \(.key)@\(.value)"' release-plugins.json
+      # The @valtimo-plugins/* packages are plain dependencies in package.json and
+      # are imported directly by the apps, so no per-branch pinning step is needed
+      # here; the install below brings them in.
 
       - name: "Rewrite local @valtimo/* deps to file: links and install"
         shell: bash

backend/apps/valtimo/src/main/resources/config/application.yml

@@ -163,9 +163,6 @@ valtimo:
         secret: dummy
         rsin: dummy
     database: postgres
-    changelog:
-        pbac:
-            clear-tables: true
     security:
         whitelist:
             hosts:

backend/core/src/main/kotlin/com/ritense/valtimo/camunda/authorization/CamundaTaskActionProvider.kt

@@ -22,7 +22,7 @@ import com.ritense.valtimo.camunda.domain.CamundaTask
 
 class CamundaTaskActionProvider : ResourceActionProvider<CamundaTask> {
     override fun getAvailableActions(): List<Action<CamundaTask>> {
-        return listOf(ASSIGN, ASSIGNABLE, CLAIM, COMPLETE, VIEW_LIST, VIEW)
+        return listOf(ASSIGN, ASSIGNABLE, CLAIM, COMPLETE, VIEW_LIST, VIEW, MODIFY)
     }
 
     companion object {

backend/value-resolver/build.gradle

@@ -36,6 +36,12 @@ dockerCompose {
 }
 
 dependencies {
+    // Only the @RunWithoutAuthorization annotation is needed; the aspect that acts
+    // on it lives in :backend:authorization and is present in every application.
+    // Keeping this compileOnly avoids putting AuthorizationAutoConfiguration on the
+    // runtime classpath of consumers that do not have the authorization tables — the
+    // module's own integration test context being the first of them.
+    compileOnly(project(":backend:authorization"))
     implementation(project(":backend:contract"))
     implementation(project(":backend:logging"))
 

backend/value-resolver/src/main/kotlin/com/ritense/valueresolver/web/rest/ValueResolverResource.kt

@@ -16,6 +16,7 @@
 
 package com.ritense.valueresolver.web.rest
 
+import com.ritense.authorization.annotation.RunWithoutAuthorization
 import com.ritense.valtimo.contract.annotation.SkipComponentScan
 import com.ritense.valtimo.contract.domain.ValtimoMediaType.APPLICATION_JSON_UTF8_VALUE
 import com.ritense.valueresolver.ValueResolverOption
@@ -36,11 +37,13 @@ import org.springframework.web.bind.annotation.RestController
 class ValueResolverResource(
     private val valueResolverService: ValueResolverService
 ) {
+    @RunWithoutAuthorization
     @GetMapping("/management/v1/value-resolver")
     fun getValueResolvers(): ResponseEntity<List<String>> {
         return ResponseEntity.ok(valueResolverService.getValueResolvers())
     }
 
+    @RunWithoutAuthorization
     @PostMapping("/management/v1/value-resolver/document-definition/{documentDefinitionName}/keys")
     fun getResolvableKeys(
         @PathVariable documentDefinitionName: String,
@@ -53,6 +56,7 @@ class ValueResolverResource(
         return ResponseEntity.ok(options.map { it.path })
     }
 
+    @RunWithoutAuthorization
     @PostMapping("/management/v2/value-resolver/document-definition/{documentDefinitionName}/keys")
     fun getResolvableKeys(
         @PathVariable documentDefinitionName: String,
@@ -61,6 +65,7 @@ class ValueResolverResource(
         return ResponseEntity.ok(valueResolverService.getResolvableKeys(request, documentDefinitionName))
     }
 
+    @RunWithoutAuthorization
     @PostMapping("/management/v1/value-resolver/document-definition/{documentDefinitionName}/version/{version}/keys")
     fun getResolvableKeys(
         @PathVariable documentDefinitionName: String,
@@ -75,6 +80,7 @@ class ValueResolverResource(
         return ResponseEntity.ok(options.map { it.path })
     }
 
+    @RunWithoutAuthorization
     @PostMapping("/management/v2/value-resolver/document-definition/{documentDefinitionName}/version/{version}/keys")
     fun getResolvableKeys(
         @PathVariable documentDefinitionName: String,

frontend/apps/gzac/src/app/app.module.ts

@@ -102,6 +102,15 @@ import {
   ZgwModule
 } from '@valtimo/zgw';
 import {LoggingModule} from '@valtimo/logging';
+import {SmtpMailPluginModule, smtpmailPluginSpecification} from '@valtimo-plugins/smtpmail';
+import {
+  DocumentGeneratorPluginModule,
+  documentGeneratorPluginSpecification,
+  MailTemplatePluginModule,
+  mailTemplatePluginSpecification,
+  TextTemplatePluginModule,
+  textTemplatePluginSpecification,
+} from '@valtimo-plugins/freemarker';
 
 export function tabsFactory() {
   return new Map<string, object>([
@@ -188,7 +197,11 @@ export function tabsFactory() {
     TranslationManagementModule,
     TaskManagementModule,
     ZgwModule,
-    LoggingModule
+    LoggingModule,
+    SmtpMailPluginModule,
+    MailTemplatePluginModule,
+    TextTemplatePluginModule,
+    DocumentGeneratorPluginModule,
   ],
   providers: [{
     provide: PLUGINS_TOKEN,
@@ -205,7 +218,11 @@ export function tabsFactory() {
       notificatiesApiPluginSpecification,
       openNotificatiesPluginSpecification,
       portaaltaakPluginSpecification,
-      verzoekPluginSpecification
+      verzoekPluginSpecification,
+      smtpmailPluginSpecification,
+      mailTemplatePluginSpecification,
+      textTemplatePluginSpecification,
+      documentGeneratorPluginSpecification,
     ]
   }],
   bootstrap: [AppComponent]

frontend/apps/valtimo/src/app/app.module.ts

@@ -78,7 +78,6 @@ import {DashboardManagementModule} from '@valtimo/dashboard-management';
 import {TaskManagementModule} from '@valtimo/task-management';
 import {CaseMigrationModule} from '@valtimo/case-migration';
 import {LoggingModule} from '@valtimo/logging';
-import {pluginImports, pluginSpecifications} from './app-plugins';
 
 export function tabsFactory() {
   return new Map<string, object>([
@@ -155,15 +154,13 @@ export function tabsFactory() {
     TranslationManagementModule,
     TaskManagementModule,
     LoggingModule,
-    ...pluginImports,
   ],
   providers: [{
     provide: PLUGINS_TOKEN,
     useValue: [
       objectenApiPluginSpecification,
       objecttypenApiPluginSpecification,
       objectTokenAuthenticationPluginSpecification,
-      ...pluginSpecifications,
     ]
   }],
   bootstrap: [AppComponent]

frontend/package.json

@@ -239,6 +239,8 @@
     "@types/topojson": "3.2.6",
     "@typescript-eslint/eslint-plugin": "8.0.1",
     "@typescript-eslint/parser": "8.0.1",
+    "@valtimo-plugins/freemarker": "8.5.3-V12",
+    "@valtimo-plugins/smtpmail": "1.0.2",
     "@webcomponents/custom-elements": "1.6.0",
     "angular-split": "18.0.0-beta.1",
     "bootstrap": "4.6.2",

gradle.properties

@@ -61,7 +61,7 @@ sonarqubePluginVersion=4.4.1.3373
 dockerComposePluginVersion=0.17.10
 dependencyLicenseReportVersion=2.8
 jreleaserPluginVersion=1.23.0
-freemarkerPluginVersion=8.5.1-V12
+freemarkerPluginVersion=8.5.3-V12
 smtpmailPluginVersion=1.0.2
 
 groovyVersion=4.0.22