Release 9.8.0

New Features

restheart-stripe: Stripe billing and e-commerce, out of the box

A new bundled module adding two independent, opt-in modes on top of Stripe — enable one, both, or neither.

Subscriptions mode — SaaS billing for any entity (team, account, tenant):

• Stripe Checkout and Customer Portal integration, with a Customer lifecycle tied to your existing entities
• Plan catalog (GET /stripe/plans) sourced from Stripe Products/Prices, with a local config layer for what RESTHeart must enforce (default plan, trial days, seat limits)
• Seat licensing with three modes (capped, per-seat, unlimited), enforced directly in ACL predicates
• New @subscription ACL variable for writing plan-aware access rules
• Webhook-driven subscription state sync (created/updated/deleted/trial-will-end/invoice payment succeeded or failed), with a staleness guard so out-of-order webhook delivery can't roll back a newer state
• Billing notification emails (trial ending, payment failed, subscription canceled, over-limit) with overridable templates

Products mode — cart-to-order e-commerce:

• Checkout session creation from a cart, validated against a catalog read from Stripe Products/Prices
• Order lifecycle as an explicit state machine (pending_payment → paid/failed/expired), enforced with monotonic transitions so a delayed or replayed webhook can never move an order backwards
• A money ledger tracking payments, refunds, and disputes per order, idempotent against redelivered Stripe events
• Order and transaction JSON Schema validation, order confirmation/refund notification emails, and optional stock checks against an inventory collection

Multi-tenancy: on-demand per-database initialization, request-level and tenant-level kill switches, so a single deployment can serve tenants with different Stripe configurations or none at all.

GraalVM native image support (#679): restheart-stripe now builds and runs correctly as a native executable. stripe-java deserializes Stripe API objects reflectively via Gson, which native-image doesn't support without explicit configuration — this is now in place, and the full webhook-driven test suite (subscriptions and products, every handled event type) passes against the native binary.

API key authentication (#699, #700)

New apiKeyAuthMechanism and mongoApiKeyAuthenticator, for authenticating requests with a long-lived API key instead of username/password or a JWT.

Optional plugin dependencies (#698)

@Inject now accepts required=false, so a plugin can declare a dependency on a provider that may not be present (e.g. an optional module) without failing to load when it isn't.

New ACL predicate variables

• @roles — lets a predicate distinguish an anonymous caller from an authenticated one by role
• @authenticated — a boolean shorthand for "is this request authenticated at all"

Improvements

• Native image build workflow: builds trigger asynchronously in CI, with improved artifact handling
• Plugin initialization failures are now reported for what they are ("plugin failed to initialize"), rather than the previous message implying a compilation problem
• A refused deployment (e.g. an email that fails validation) now says why, instead of failing silently further down the pipeline

Bug Fixes

• Restricted temp directory permissions and removed a pointless temporary file
• Fixed a request being re-validated against its JSON Schema after it had already been refused
• Fixed numeric comparison predicates after a refactor to array-based parameters

Known Limitations

• restheart-stripe's native-image verification is webhook-driven end to end, but does not exercise the code paths that make live Stripe API calls (Customer creation, Checkout Session creation, Billing Portal Session creation) — those require a real Stripe test-mode key and aren't covered by the current test suite. Tracked as a follow-up; the reflection config for these paths is in place but unverified under native-image.

Dependencies

• GraalVM: 25.1.3
• Java: 25+
• stripe-java: 33.3.0