WebAPI 3.0 Changes Summary

WebAPI 3.0 is a major upgrade to the legacy JDK8, Spring Boot 1.5 application.

Major Changes

1. Internationalization (i18n) Removal

• Removed internationalization from WebAPI
• i18n handling will be a UI concern in the future
• WebAPI may introduce i18n support in the future only for WebAPI-specific concerns (error messages, etc.)

2. OAuth/OIDC & Authentication

• Google OAuth/OIDC and OneTimeCode implementation
• Role mapping on login
• OIDC token exchange endpoints
• Spring Security migration (replaced SHIRO)

3. Authorization & Security

Complete SHIRO to Spring Security Migration

• Replaced SHIRO security framework with Spring Security
• Introduced new security architecture with dedicated packages for authentication, authorization, identity, and provisioning

Entity-Level Permission Model with Access Tables

• Created new sec_* entity tables for fine-grained, role-based access control per resource:
  • sec_cohort_definition - Cohort definition access control
  • sec_concept_set - Concept set access control
  • sec_ir_analysis - Incidence rate analysis access control
  • sec_fe_analysis - Feature analysis access control
  • sec_cohort_characterization - Characterization access control
  • sec_pathway_analysis - Pathway analysis access control
  • sec_reusable - Reusable component access control

Legacy Permission Migration

• Implemented SQL-based migration to convert old SHIRO permission patterns into new Spring Security entity-level permissions
• Automatic pattern matching and transformation (e.g., cohort:%s:get → entity-level READ permissions)

Anonymous System User

• Introduced system user anonymous (user_id: -1) with personal role
• Handles unauthenticated access and permission defaults

Method-level Authorization Model

• Allows enforcement of authorization on every endpoint
• Complete @PreAuthorize coverage across all endpoints that require authroization

API Keys

• Added programmatic authentication support via API keys

RunAs and Cascade Deletes

• Implemented administrative RunAs capability
• Cascading permission cleanup

ETag Support

• Added ETag annotations for HTTP content caching from browser

4. Data & Features

• Pathway Characterization re-introduced
• Cohort Characterization, Feature Analysis, and IR re-introduced
• Person service migration for patient profiles
• User management functions added to WebAPI

5. Infrastructure & Framework

Spring Framework & Ecosystem

• Spring Boot upgrade (3.2.11 → 3.5.6)
• Switched to Spring MVC
• Spring Batch 5 migration
• YAML-based configuration with external files

Application Server

• Tomcat Embed upgrade to 10.1
• Jakarta EE compatibility

Database

• Flyway upgrade (4.2.0 → 11.7.0)
• Cleanup of database migrations
• Embedded PostgreSQL in CI

6. Database Changes

• New security tables (sec_* schema)
• Baseline migration includes new permission structure
• Default permissions and roles initialization
• Migration scripts for Spring Batch and Spring Security

Commit Statistics

• Total commits: 100+ commits in webapi-3.0 branch
• Base commit: Commits since origin/master
• Branch scope: Comprehensive overhaul covering authentication, authorization, framework upgrades, and feature re-introduction

Documentation

Additional documentation has been added for:

• Database Authentication (DatabaseAuth_HOWTO.md)
• Entity Access Control (EntityAccess_HOWTO.md)
• SSL Configuration (Ssl_HOWTO.md)
• Spring Micrometer (SpringMicrometer_HOWTO.md)