Update

- Upgrade to Spring-Boot 2.2.1 (better performances, fix security issues, ...)

- Update core dependencies

- Switch from Fongo to Mongo Server for unit tests

Security

- Fix 2 high severity vulnerabilities:

- Remote Code Execution

Older releases are vulnerable to Remote Code Execution due to a bug in the way the underlying Java Runtime Environment (JRE) passes command line arguments to windows systems.

- Denial of Service (DoS)

Older releases are vulnerable to Denial of Service (DoS).

Fix

Fix some bugs

Changelog of the last past months.

New:

Routes

Events

• GET /api/events | Parameters: page and limit

Get all the events ordered by eventTime (Pagination) - Default: 1000 last tuples

• GET /api/events/sources/:id | Parameters: page and limit

Get the events with a specific edApp.id (source of events) (Pagination) - Default: 1000 last tuples

Enrollments

• GET /api/enrollments | Parameters: page , limit and orderBy

Get all the enrollments (ordered or not by beginDate or endDate) (Pagination) - Default: 1000 last tuples

Results

• GET /api/results | Parameters: page , limit and orderBy

Get all the results (ordered or not by beginDate or endDate) (Pagination) - Default: 1000 last tuples

---

Models

Some attributes are not stored anymore into the objects, they become a Link object (making a link to the actual object). We also added some new attributes to OpenLRW models for fitting with the new OneRoster standard.

User

New attributes:

• dateLastModified
• UserIds
• userEnabled
• grades
• password
• middleName

Enrollment

New attributes:

• dateLastModified
• beginDate
• endDate

LineItem

New attributes:

• resultValueMin
• resultValueMax

Fix:

Routes

Classes

GET /api/classes/:id/results is now working

Draft

New

• Custom Health indicator, more details

• Route DELETE /enrollments/:id

• Route DELETE /classes/:id

• Route DELETE /classes

• Route DELETE /enrollments

Fix

• Inserting MongoResult when the result already exist (created an error)

Core

• Upgrade to Spring-Boot 2.0.9

Security

• Fix Remote Code Execution
• Fix Insecure Randomness

Eco-system

• Docker images released

Release 1.2.0

What's new?

• TimeZoneOffset attribute to MongoEvents

Previously added onto the MongoRisk collection, it is now available on Events more details here.

• New Continuous Integration Tools

snyk.io and SonarQube are now checking the code quality in order to find vulnerabilities in the project dependencies and in the classes.

• Upgrade to Spring Boot 2.0.8

OpenLRW was based on Spring-Boot 1.4.7, it is now using the 2.0.8 release.

This upgrade includes an higher security (fixed 18 high severity vulnerabilities), most of the routes are now faster cf the below table.

Action	Spring-Boot 1.4.7	Spring-Boot 2.0.8
Authentication	24ms	10ms
Token Expired	30ms	9ms
Post Result	44ms	28ms
Post Event	12ms	20ms
Events Not Found	13ms	26ms
Find User	300ms	106ms

• Update Maven Dependencies

Some dependencies have been updated (Fongo, Swagger).

• New route

A route to get a lineitem by its id has been added

• GET /lineitems/:id

The actuator route has changed (due to Spring-Boot 2), it is now http://localhost:9966/actuator/health

• Route updated

The logic behind the GET /api/risks/classes/:class_id/users/:user_id?date=yyyy-MM-dd hh:mm has changed, it is now GET /api/risks/classes/:class_id/users/:user_id?date=yyyy-MM-dd (without hours and minutes).

GET /api/risks/classes/:class_id/users/:user_id will now return the risks sorted by the DateTime attribute.

• Scripts updated

Installation scripts and settings file template have been updated for Spring-Boot 2

What's new?

• MongoRisk for adding a score risk to a user on a class :

  • Endpoint /api/risks
  • Route: GET /api/risks/classes/:class_id/users/:user_id
  • Route: GET /api/risks/classes/:class_id/users/:user_id?date=yyyy-MM-dd hh:mm
  • Route: GET /api/risks/classes/:class_id/users/:user_id?date=latest
  • Route: POST /api/risks

{
    "active":  boolean,
    "name": "string",
    "classSourcedId": "string",
    "modelType": "string",
    "score": "string",
    "userSourcedId": "string",
    "velocity": "string",
    "metadata": {
        "key": "value"
    }
}

// You also can add the field 'DateTime' with a value following this pattern yyyy-MM-ddThh:mm:ss

• Introducing TimeZoneOffset

  • MongoRisk is the first collection to get this new feature, it allows you to reconstruct the local dateTime stored in MongoDB (more details)

An Alpha Release of Apereo OpenLRW