chore(server): bump REST API version

.editorconfig

@@ -21,9 +21,9 @@ root = true
 charset = utf-8
 end_of_line = lf
 insert_final_newline = true
-max_line_length = 100
+max_line_length = 120
 ij_wrap_on_typing = true
-ij_visual_guides = 100
+ij_visual_guides = 120
 
 
 [*.{java,xml,py}]

.github/workflows/check-dependencies.yml

@@ -47,7 +47,7 @@ jobs:
       - name: 'Checkout Repository'
         uses: actions/checkout@v4
       - name: 'Dependency Review'
-        uses: actions/dependency-review-action@v3
+        uses: actions/dependency-review-action@v5
         # Refer: https://github.com/actions/dependency-review-action
         with:
           # TODO: reset critical to low before releasing

.github/workflows/docker-build-ci.yml

@@ -24,10 +24,17 @@ on:
       - 'release-*'
   pull_request:
     paths:
-      - '**/Dockerfile*'
+      - '.github/workflows/docker-build-ci.yml'
       - '.dockerignore'
-      - 'hugegraph-server/hugegraph-dist/docker/**'
-      - 'hugegraph-server/hugegraph-dist/src/assembly/static/bin/util.sh'
+      - '.mvn/**'
+      - 'pom.xml'
+      - 'hugegraph-commons/**'
+      - 'hugegraph-cluster-test/**'
+      - 'hugegraph-pd/**'
+      - 'hugegraph-store/**'
+      - 'hugegraph-struct/**'
+      - 'hugegraph-server/**'
+      - 'install-dist/**'
 
 jobs:
   docker-build:
@@ -47,7 +54,8 @@ jobs:
 
       - name: Build ${{ matrix.dockerfile }}
         run: |
-          IMAGE_ID=$(docker build -q -f ${{ matrix.dockerfile }} .)
+          IMAGE_ID=$(docker build -q --build-arg SOURCE_REVISION="$GITHUB_SHA" \
+            -f ${{ matrix.dockerfile }} .)
           echo "Built: $IMAGE_ID"
           echo "IMAGE_ID=$IMAGE_ID" >> "$GITHUB_ENV"
           HC=$(docker inspect --format='{{json .Config.Healthcheck}}' "$IMAGE_ID")
@@ -78,3 +86,34 @@ jobs:
             echo "ERROR: no usable socket-table tool (ss/netstat) in ${{ matrix.dockerfile }}"
             exit 1
           }
+
+      - name: Server image API versions match source
+        if: ${{ startsWith(matrix.dockerfile, 'hugegraph-server/') }}
+        run: |
+          CHECK_DIR=$(mktemp -d)
+          trap 'rm -rf "$CHECK_DIR"' EXIT
+          docker run --rm --entrypoint bash \
+            -v "$CHECK_DIR:/check" "$IMAGE_ID" -c \
+            'cp /hugegraph-server/lib/hugegraph-api-*.jar \
+                /hugegraph-server/lib/hugegraph-common-*.jar /check/'
+
+          API_JAR=$(find "$CHECK_DIR" -name 'hugegraph-api-*.jar' -print -quit)
+          COMMON_JAR=$(find "$CHECK_DIR" -name 'hugegraph-common-*.jar' -print -quit)
+          EXPECTED_MANIFEST=$(sed -n \
+            's|.*<Implementation-Version>\([^<]*\)</Implementation-Version>.*|\1|p' \
+            hugegraph-server/hugegraph-api/pom.xml)
+          ACTUAL_MANIFEST=$(unzip -p "$API_JAR" META-INF/MANIFEST.MF |
+            sed -n 's/^Implementation-Version: *//p' | tr -d '\r')
+          EXPECTED_PROPERTY=$(sed -n 's/^ApiVersion=//p' \
+            hugegraph-commons/hugegraph-common/src/main/resources/version.properties)
+          ACTUAL_PROPERTY=$(unzip -p "$COMMON_JAR" version.properties |
+            sed -n 's/^ApiVersion=//p' | tr -d '\r')
+
+          [[ "$ACTUAL_MANIFEST" == "$EXPECTED_MANIFEST" ]] || {
+            echo "ERROR: API manifest is $ACTUAL_MANIFEST; expected $EXPECTED_MANIFEST"
+            exit 1
+          }
+          [[ "$ACTUAL_PROPERTY" == "$EXPECTED_PROPERTY" ]] || {
+            echo "ERROR: API property is $ACTUAL_PROPERTY; expected $EXPECTED_PROPERTY"
+            exit 1
+          }

.serena/memories/code_style_and_conventions.md

@@ -6,7 +6,7 @@
 - `.licenserc.yaml` + apache-rat-plugin + skywalking-eyes — License header validation
 
 ## Core Rules
-- **Line length**: 100 chars (120 for XML)
+- **Line length**: 120 chars
 - **Indent**: 4 spaces, continuation 8 spaces
 - **Charset**: UTF-8, LF line endings, final newline
 - **Imports**: Sorted `$*` → `java` → `javax` → `org` → `com` → `*`, no star imports (threshold 100)

AGENTS.md

@@ -85,7 +85,7 @@ Before writing new tests, check existing suites under `hugegraph-server/hugegrap
 
 ## Style & Pre-commit
 
-- Line 100, 4-space indent, LF, UTF-8, **no star imports**
+- Line 120, 4-space indent, LF, UTF-8, **no star imports**
 - Commit format: `feat|fix|refactor(module): msg`
 - Run before pushing:
   ```bash

README.md

@@ -342,7 +342,7 @@ For detailed architecture and development guidance, see [AGENTS.md](AGENTS.md).
    - Try modifying a test and see what breaks
 
 5. **Code Standards**
-   - Line length: 100 characters
+   - Line length: 120 characters
    - Indentation: 4 spaces
    - No star imports
    - Commit format: `feat|fix|refactor(module): description`

hugegraph-commons/hugegraph-common/src/main/resources/version.properties

@@ -17,7 +17,7 @@
 # hugegraph-common follows the project version defined by ${revision} in the root pom.xml,
 # and VersionInBash needs to be updated in this file.
 Version=${revision}
-ApiVersion=0.71
+ApiVersion=0.72
 ApiCheckBeginVersion=1.0
 ApiCheckEndVersion=2.0
 VersionInBash=1.7.0

hugegraph-pd/docs/development.md

@@ -282,7 +282,7 @@ HugeGraph PD follows Apache HugeGraph code style.
 
 **Key Style Rules**:
 - **Indentation**: 4 spaces (no tabs)
-- **Line length**: 100 characters (Java), 120 characters (comments)
+- **Line length**: 120 characters
 - **Braces**: K&R style (opening brace on same line)
 - **Imports**: No wildcard imports (`import java.util.*`)
 

hugegraph-server/Dockerfile

@@ -25,9 +25,10 @@ WORKDIR /pkg
 COPY . .
 
 ARG MAVEN_ARGS
+ARG SOURCE_REVISION=local
 
-RUN --mount=type=cache,target=/root/.m2 \
-    mvn package $MAVEN_ARGS -e -B -ntp -Dmaven.test.skip=true -Dmaven.javadoc.skip=true \
+RUN --mount=type=cache,id=hugegraph-maven-${SOURCE_REVISION},target=/root/.m2,sharing=locked \
+    mvn install $MAVEN_ARGS -e -B -ntp -Dmaven.test.skip=true -Dmaven.javadoc.skip=true \
     && rm ./hugegraph-server/*.tar.gz ./hugegraph-pd/*.tar.gz ./hugegraph-store/*.tar.gz
 
 # 2nd stage: runtime env

hugegraph-server/Dockerfile-hstore

@@ -25,9 +25,10 @@ WORKDIR /pkg
 COPY . .
 
 ARG MAVEN_ARGS
+ARG SOURCE_REVISION=local
 
-RUN --mount=type=cache,target=/root/.m2 \
-    mvn package $MAVEN_ARGS -e -B -ntp -DskipTests -Dmaven.javadoc.skip=true \
+RUN --mount=type=cache,id=hugegraph-maven-${SOURCE_REVISION},target=/root/.m2,sharing=locked \
+    mvn install $MAVEN_ARGS -e -B -ntp -DskipTests -Dmaven.javadoc.skip=true \
     && rm ./hugegraph-server/*.tar.gz ./hugegraph-pd/*.tar.gz ./hugegraph-store/*.tar.gz
 
 # 2nd stage: runtime env

hugegraph-server/hugegraph-api/pom.xml

@@ -201,8 +201,8 @@
                             </addDefaultSpecificationEntries>
                         </manifest>
                         <manifestEntries>
-                            <!-- TODO: update it -->
-                            <Implementation-Version>0.71.0.0</Implementation-Version>
+                            <!-- Bump when the public REST API contract changes -->
+                            <Implementation-Version>0.72.0.0</Implementation-Version>
                         </manifestEntries>
                     </archive>
                 </configuration>

hugegraph-server/hugegraph-api/src/main/java/org/apache/hugegraph/api/auth/ManagerAPI.java

@@ -287,20 +287,24 @@ public String checkDefaultRole(@Context GraphManager manager,
             defaultRole = null; // unreachable, satisfies compiler
         }
         validGraphSpace(manager, graphSpace);
-        boolean hasGraph = defaultRole.equals(HugeDefaultRole.OBSERVER);
-        E.checkArgument(!hasGraph || StringUtils.isNotEmpty(graph),
-                        "Must set a graph for observer");
+        boolean hasGraph = defaultRole.equals(HugeDefaultRole.OBSERVER) && StringUtils.isNotEmpty(graph);
         if (hasGraph) {
             validGraph(manager, graphSpace, graph);
         }
 
         boolean result;
         if (hasGraph) {
-            result = authManager.isDefaultRole(graphSpace, graph, user,
-                                               defaultRole);
+            result = authManager.isDefaultRole(graphSpace, graph, user, defaultRole);
         } else {
-            result = authManager.isDefaultRole(graphSpace, user,
-                                               defaultRole);
+            result = authManager.isDefaultRole(graphSpace, user, defaultRole);
+            if (!result && defaultRole.equals(HugeDefaultRole.OBSERVER)) {
+                for (String currentGraph : manager.graphs(graphSpace)) {
+                    if (authManager.isDefaultRole(graphSpace, currentGraph, user, defaultRole)) {
+                        result = true;
+                        break;
+                    }
+                }
+            }
         }
         return manager.serializer().writeMap(ImmutableMap.of("check", result));
     }

hugegraph-server/hugegraph-api/src/main/java/org/apache/hugegraph/api/space/GraphSpaceAPI.java

@@ -146,10 +146,7 @@ public String setDefaultRole(@Context GraphManager manager,
             throw new ForbiddenException("Forbidden to set role " + role.toString());
         }
 
-        boolean hasGraph = role.equals(HugeDefaultRole.OBSERVER);
-
-        E.checkArgument(!hasGraph || StringUtils.isNotEmpty(graph),
-                        "Must set a graph for observer");
+        boolean hasGraph = role.equals(HugeDefaultRole.OBSERVER) && StringUtils.isNotEmpty(graph);
         if (hasGraph) {
             validGraph(manager, name, graph);
         }
@@ -164,6 +161,11 @@ public String setDefaultRole(@Context GraphManager manager,
             result.put("graph", graph);
         } else {
             authManager.createSpaceDefaultRole(name, user, role);
+            if (role.equals(HugeDefaultRole.OBSERVER)) {
+                for (String currentGraph : manager.graphs(name)) {
+                    authManager.deleteDefaultRole(name, user, role, currentGraph);
+                }
+            }
         }
 
         return manager.serializer().writeMap(result);
@@ -203,20 +205,25 @@ public String checkDefaultRole(@Context GraphManager manager,
             defaultRole.equals(HugeDefaultRole.SPACE)) {
             throw new ForbiddenException("Forbidden to check role " + role);
         }
-        boolean hasGraph = defaultRole.equals(HugeDefaultRole.OBSERVER);
-        E.checkArgument(!hasGraph || StringUtils.isNotEmpty(graph),
-                        "Must set a graph for observer");
+        boolean hasGraph = defaultRole.equals(HugeDefaultRole.OBSERVER) &&
+                           StringUtils.isNotEmpty(graph);
         if (hasGraph) {
             validGraph(manager, name, graph);
         }
 
         boolean result;
         if (hasGraph) {
-            result = authManager.isDefaultRole(name, graph, user,
-                                               defaultRole);
+            result = authManager.isDefaultRole(name, graph, user, defaultRole);
         } else {
-            result = authManager.isDefaultRole(name, user,
-                                               defaultRole);
+            result = authManager.isDefaultRole(name, user, defaultRole);
+            if (!result && defaultRole.equals(HugeDefaultRole.OBSERVER)) {
+                for (String currentGraph : manager.graphs(name)) {
+                    if (authManager.isDefaultRole(name, currentGraph, user, defaultRole)) {
+                        result = true;
+                        break;
+                    }
+                }
+            }
         }
         return manager.serializer().writeMap(ImmutableMap.of("check", result));
     }
@@ -259,16 +266,19 @@ public void deleteDefaultRole(@Context GraphManager manager,
             E.checkArgument(false, "Invalid role value '%s'", role);
             defaultRole = null; // unreachable, satisfies compiler
         }
-        boolean hasGraph = defaultRole.equals(HugeDefaultRole.OBSERVER);
-        E.checkArgument(!hasGraph || StringUtils.isNotEmpty(graph),
-                        "Must set a graph for observer");
+        boolean hasGraph = defaultRole.equals(HugeDefaultRole.OBSERVER) && StringUtils.isNotEmpty(graph);
         if (hasGraph) {
             validGraph(manager, name, graph);
         }
         if (hasGraph) {
             authManager.deleteDefaultRole(name, user, defaultRole, graph);
         } else {
             authManager.deleteDefaultRole(name, user, defaultRole);
+            if (defaultRole.equals(HugeDefaultRole.OBSERVER)) {
+                for (String currentGraph : manager.graphs(name)) {
+                    authManager.deleteDefaultRole(name, user, defaultRole, currentGraph);
+                }
+            }
         }
     }
 

hugegraph-server/hugegraph-api/src/main/java/org/apache/hugegraph/api/space/SchemaTemplateAPI.java

@@ -20,10 +20,12 @@
 import java.util.Date;
 import java.util.Objects;
 import java.util.Set;
+import java.util.function.Supplier;
 
 import org.apache.commons.lang3.StringUtils;
 import org.apache.hugegraph.HugeException;
 import org.apache.hugegraph.api.API;
+import org.apache.hugegraph.auth.AuthManager;
 import org.apache.hugegraph.api.filter.StatusFilter;
 import org.apache.hugegraph.auth.HugeGraphAuthProxy;
 import org.apache.hugegraph.core.GraphManager;
@@ -134,9 +136,8 @@ public void delete(@Context GraphManager manager,
                         "Schema template '%s' does not exist", name);
 
         String username = HugeGraphAuthProxy.username();
-        boolean isSpace = manager.authManager()
-                                 .isSpaceManager(graphSpace, username);
-        if (Objects.equals(st.creator(), username) || isSpace) {
+        if (canManage(manager::authManager, graphSpace, st.creator(),
+                      username)) {
             manager.dropSchemaTemplate(graphSpace, name);
         } else {
             throw new ForbiddenException("No permission to delete schema template");
@@ -165,9 +166,8 @@ public String update(@Context GraphManager manager,
         }
 
         String username = HugeGraphAuthProxy.username();
-        boolean isSpace = manager.authManager()
-                                 .isSpaceManager(graphSpace, username);
-        if (Objects.equals(old.creator(), username) || isSpace) {
+        if (canManage(manager::authManager, graphSpace, old.creator(),
+                      username)) {
             SchemaTemplate template = jsonSchemaTemplate.build(old);
             template.creator(old.creator());
             template.create(old.create());
@@ -180,6 +180,17 @@ public String update(@Context GraphManager manager,
 
     }
 
+    private static boolean canManage(Supplier<AuthManager> authManagerSupplier,
+                                     String graphSpace, String creator,
+                                     String username) {
+        if (Objects.equals(creator, username)) {
+            return true;
+        }
+        AuthManager authManager = authManagerSupplier.get();
+        return authManager.isAdminManager(username) ||
+               authManager.isSpaceManager(graphSpace, username);
+    }
+
     private static class JsonSchemaTemplate implements Checkable {
 
         @JsonProperty("name")

hugegraph-server/hugegraph-api/src/main/java/org/apache/hugegraph/auth/HugeAuthenticator.java

@@ -290,6 +290,10 @@ private static Object matchedAction(HugePermission action,
             }
             for (Map.Entry<HugePermission, Object> e : perms.entrySet()) {
                 HugePermission permission = e.getKey();
+                if (permission == HugePermission.SPACE ||
+                    permission == HugePermission.SPACE_MEMBER) {
+                    continue;
+                }
                 // Maybe required = ANY
                 if (action.match(permission) ||
                     action.equals(HugePermission.EXECUTE)) {
@@ -359,8 +363,15 @@ public static boolean match(Object role, RolePermission grant,
                 }
             }
 
-            RolePermission rolePerm = RolePermission.fromJson(role);
-            return rolePerm.contains(grant);
+            RolePermission grantedRole = RolePermission.fromJson(grant);
+            RolePerm rolePerm = RolePerm.fromJson(role);
+            if (resourceObject != null &&
+                !RolePermission.isAdmin(grantedRole) &&
+                grantedRole.roles().containsKey(resourceObject.graphSpace()) &&
+                rolePerm.matchSpace(resourceObject.graphSpace(), "space")) {
+                return true;
+            }
+            return RolePermission.fromJson(role).contains(grantedRole);
         }
 
         @SuppressWarnings({"unchecked", "rawtypes"})