Broadleaf Microservices
  • v1.0.0-latest-prod

Release Notes for 1.8.2-GA

New Features & Notable Changes

  • Introduced property to control the value of x-frame-options. See Added Properties

  • Added missing permissions and guest access for SkuInventoryShopEndpoint

  • Added error code for when user is not found from a password reset request

  • Introduced property to control whether embedded login and registration is enabled

  • Added missing SharedCodeAuditSummary permissions and scopes

  • Removed READ_ACCOUNT_ORDER from account member role in RoleDataInitializer

  • Added condition to only validate password confirmation field if provided

  • Added support for PKCE flow. See Authorization Docs

Bug Fixes

  • Fixed an issue where the permissions are not displayed in the admin

  • Fixed ModelMapper maintenance of collections that are Hibernate orphan aware

New Permissions and Scopes

New permissions and scopes have been added and should be inserted into the auth database with the following SQL:

INSERT INTO blc_security_scope ("id", "name", "open")VALUES ('-1100', 'SHARED_CODE_AUDIT_SUMMARY', 'N');

INSERT INTO blc_permission_scope (id, "permission", is_permission_root, scope_id)
VALUES('-1500', 'SHARED_CODE_AUDIT_SUMMARY', 'Y', '-1100');

INSERT INTO blc_user_permission ("id", "archived", "last_updated", "name", "is_account_perm")
VALUES('-105', 'N', '1970-01-01 00:00:00.000', 'ALL_INVENTORY_SUMMARY', 'N');
INSERT INTO blc_user_permission ("id", "archived", "last_updated", "name", "is_account_perm")
VALUES('-106', 'N', '1970-01-01 00:00:00.000', 'READ_INVENTORY_SUMMARY', 'N');
INSERT INTO blc_user_permission ("id", "archived", "last_updated", "name", "is_account_perm")
VALUES('-830', 'N', '1970-01-01 00:00:00.000', 'ALL_SHARED_CODE_AUDIT_SUMMARY', 'N');
INSERT INTO blc_user_permission ("id", "archived", "last_updated", "name", "is_account_perm")
VALUES('-831', 'N', '1970-01-01 00:00:00.000', 'READ_SHARED_CODE_AUDIT_SUMMARY', 'N');

-- Admin Roles
--- READ_SHARED_CODE_AUDIT_SUMMARY to PARTIAL_ACCESS role
INSERT INTO blc_role_permission_xref (role_id, permission_id) VALUES ('-1', '-831');

--- ALL_SHARED_CODE_AUDIT_SUMMARY to FULL_ACCESS, APPLICATION_ACCESS, and MARKETPLACE_OPERATOR roles
INSERT INTO blc_role_permission_xref (role_id, permission_id) VALUES ('-2', '-830');
INSERT INTO blc_role_permission_xref (role_id, permission_id) VALUES ('-7', '-830');
INSERT INTO blc_role_permission_xref (role_id, permission_id) VALUES ('-200', '-830');

--- ALL_INVENTORY_SUMMARY to FULL_ACCESS, VENDOR_ADMIN, and VENDOR_MERCHANDISER roles
INSERT INTO blc_role_permission_xref (role_id, permission_id) VALUES ('-2', '-105');
INSERT INTO blc_role_permission_xref (role_id, permission_id) VALUES ('-201', '-105');
INSERT INTO blc_role_permission_xref (role_id, permission_id) VALUES ('-202', '-105');

--- READ_SHARED_CODE_AUDIT_SUMMARY to APPLICATION_ACCESS, MARKETPLACE_OPERATOR, and ROLE_CUSTOMER_USER roles
INSERT INTO blc_role_permission_xref (role_id, permission_id) VALUES ('-7', '-106');
INSERT INTO blc_role_permission_xref (role_id, permission_id) VALUES ('-200', '-106');
INSERT INTO blc_role_permission_xref (role_id, permission_id) VALUES ('-100', '-106');

--- Remove READ_ACCOUNT_ORDER from ACCOUNT_MEMBER role
DELETE FROM blc_role_permission_xref WHERE role_id = '-1000' AND permission_id = '-501';

-- Anonymous Client
INSERT INTO blc_client_scopes ("id", "scope") VALUES ('anonymous', 'INVENTORY_SUMMARY');
INSERT INTO blc_client_permissions ("id", "permission") VALUES ('anonymous', 'READ_INVENTORY_SUMMARY');

If you’re consuming the openapi client for use with OpenAPI, the following permission updates are necessary:

INSERT INTO blc_client_scopes (id, "scope") VALUES('openapi', 'SHARED_CODE_AUDIT_SUMMARY');
INSERT INTO blc_client_permissions (id, "permission") VALUES('openapi', 'ALL_SHARED_CODE_AUDIT_SUMMARY');

Configuration Properties

Added Properties

  • broadleaf.auth.security.frame-options

    • Description: Determines the value and presence of the X-Frame-Options header

    • Default value: DENY

  • broadleaf.auth.security.pkce-enabled

    • Description: Whether the Proof-Key-for-Code-Exchange enhancement for the Authorization Code Flow should be enabled. Read more here

    • Default value: false