RESTHeart 9.7.0

RESTHeart 9.7.0 strengthens the accounts and security layers introduced in previous releases. It delivers pluggable ACL variables, collection-level JSON Schema enforcement for user registration and updates, a centralized JWT issuance pipeline with proper nested claims handling, and token renewal from the user document. The ermes-mail library is upgraded to 3.0.0 with emails now sent off the request path.

Breaking Changes

• ermes-mail upgraded to 3.0.0 — SmtpEmailSender now dispatches asynchronously off the request path. If your code depends on synchronous email delivery within the request cycle, it must be updated.
• /users self-service PATCH uses a denylist — the previous profile-only whitelist is replaced by a denylist of fields regular users cannot write. Deployments relying on the old whitelist behavior must verify their field restrictions.
• JWT issuance refactored into JwtIssuer — custom token managers or interceptors that constructed JWTs directly should migrate to JwtIssuer.

Highlights

Pluggable ACL variables via VarResolver SPI (#660)

A new VarResolver SPI in restheart-security lets plugins register custom variables for ACL interpolation. Built-in variables (${now}, ${request.authenticated}, ${request.remoteIp}, etc.) are migrated to the same SPI. Third-party plugins can now extend the ACL variable namespace without touching core code.

Collection JSON Schema enforcement for accounts (#656, #657, #658)

The JSON Schema store is now exposed as a Provider usable outside the MongoService pipeline. When a JSON Schema is defined on the users collection, restheart-accounts validates user documents against it during registration and updates. This also fixes #662: a JSON Schema on the users collection can now require fields that /auth/register does not produce.

Per-tenant overrides for accounts and JWT denylist (#659, #661)

Terms-of-service and privacy-version settings, along with account-properties-claims, can now be overridden per tenant. A JWT denylist controls which claims regular users cannot set on their own tokens.

Centralized JWT issuance with nested claims support

All token creation now flows through JwtIssuer. Nested JWT claims are merged rather than overwritten on renewal. Required claims are properly resolved from account properties. Basic-auth token renewal no longer leaks the full user document into the token payload.

Token renewal from user document

Token renewal now re-reads the user document from the database, ensuring claims stay in sync with the current account state. This also fixes a verify() cache key mismatch when authDb differs from the default.

restheart-emails module improvements

• ermes-mail upgraded from 2.1.0 to 3.0.0
• Emails are now dispatched asynchronously, off the request path
• New EmailSender SPI interface extracted for external plugin reuse

Bug Fixes

• Fix JS plugins not loading in Docker image due to GraalVM version mismatch (#663) — Docker base image aligned from 25.0.2 to 25.1.3 to match the js-language dependency
• Fix null httpStatusText in error responses (5eedd95)
• Fix conflicting update operators in MergeRequest (965f29f)
• Fix account claims not resolving from account properties (55bb7fe)
• Fix JWT claim override for required claims (9ea379c)
• Exclude mapped body fields from user document (a96f757)

Other Improvements

• HTTP 451 (Unavailable For Legal Reasons) status code support
• SimpleDateFormat replaced with java.time API in token expiry parsing
• GraalVM and Truffle updated to 25.1.3
• Dependency updates: jspecify 1.0.1, commons-codec 1.22.1, tika-core 3.3.2, classgraph 4.8.188, junit-jupiter 6.1.3
• OpenRewrite Maven plugin added for code formatting and unused import removal
• MongoRealmAccount test updated to verify stored profile data

Full Changelog: https://github.com/SoftInstigate/restheart/compare/9.6.0...9.7.0