* chore(docs): remove obsolete Claude Code configurations
Remove outdated and conflicting Claude Code agent and command files:
- jakarta-migration-helper agent (no longer needed for this project phase)
- run_tests command (replaced by test-runner agent)
- commit command (conflicts with commit_guideline.md)
These files were creating confusion and conflicts with the established
workflow guidelines in commit_guideline.md.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
* docs(testing): improve test execution guidance
Update test-runner agent and CLAUDE.md with clearer test execution approach:
- Simplify test-runner agent description to be more direct
- Add tools field (bash_tool, view, str_replace) to agent metadata
- Replace /run_tests command reference with priority-based approach
- Document test execution priority: JetBrains MCP > test-runner agent > Maven
- Clarify when to use each test execution method
- Remove obsolete command from available commands list
This provides clearer guidance on test execution while maintaining flexibility
for different development environments.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
---------
Co-authored-by: Claude <noreply@anthropic.com>
* feat(fileupload): implement dynamic parameter evaluation for file upload validation
- Add WithLazyParams interface to ActionFileUploadInterceptor
- Enable runtime evaluation of ${...} expressions for validation rules
- Add comprehensive JavaDoc with static and dynamic examples
- Add 7 new unit tests for dynamic parameter scenarios
- Create DynamicFileUploadAction showcase with document/image modes
- All 23 tests pass successfully
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
* fix(fileupload): address Sonar quality issues in dynamic upload feature
- Mark uploadConfig field as transient for serialization compliance
- Add @Override annotation to input() method
- Add DOCTYPE html declarations to JSP files
- Add lang="en" attributes to html elements for accessibility
- Fix minor code formatting issues
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
* test(fileupload): add integration tests for dynamic file upload
- Add DynamicFileUploadTest with 7 comprehensive test cases
- Test valid document and image uploads
- Test file type validation (documents reject images, images reject documents)
- Test size limit validation (5MB for documents, 2MB for images)
- Test switching between upload modes
- Add helper methods for creating test files of various sizes
- Follow existing FileUploadTest patterns using HtmlUnit
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
* fix(fileupload): use Preparable to initialize upload config before interceptors
Read uploadType directly from request in prepareUpload() method to ensure
upload validation config is set before WithLazyParams interceptor evaluates
the OGNL expressions. This fixes dynamic file type validation not working.
Also fixes:
- Test file creation using correct File.createTempFile prefix pattern
- Default port changed to 8090 in test utils
- Increased struts.multipart.maxSize for testing
- maximumSize parameter changed to String to support OGNL expressions
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
* refactor(fileupload): simplify maximumSize type from String to Long
- Change maximumSize field type from String to Long for type safety
- Remove NumberUtils dependency and parsing logic
- Remove unused isNonEmpty() method
- Modernize instanceof patterns using Java 16+ pattern matching
- Fix error message key for null content validation
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
* docs(research): add lazy multipart parsing research for WW-5585
Documents investigation into dynamic file upload limits at parsing time.
Conclusion: current approach with global hard limits + WithLazyParams
interceptor validation is sufficient.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
---------
Co-authored-by: Claude <noreply@anthropic.com>
* fix(core): make Preparable.prepare() a default method
Allow actions to implement only per-method variants like prepareInput(),
prepareEdit() without requiring an empty prepare() override.
Fixes WW-5588
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
* docs: add PR guidelines requiring Jira ticket ID and link
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
---------
Co-authored-by: Claude <noreply@anthropic.com>
InterceptorBuilder.constructParameterizedInterceptorReferences() was
creating InterceptorMapping instances without passing the params map,
causing getParams() to return empty and breaking lazy parameter
injection at invocation time.
This fix adds the params map to the InterceptorMapping constructor call,
enabling LazyParamInjector to re-evaluate expression parameters during
action invocation as designed.
Enhanced test to verify params are preserved in InterceptorMapping.
Fixes WW-5587
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-authored-by: Claude <noreply@anthropic.com>
Resolves WW-5586
Previously, interceptors implementing WithLazyParams could not be
configured via interceptor stack parameters because DefaultInterceptorFactory
skipped property setting entirely for these interceptors.
Changes:
- DefaultInterceptorFactory: Always set properties for all interceptors
- WithLazyParams: Updated JavaDoc to clarify dual initialization
- Added test for stack parameter configuration with WithLazyParams
Expression parameters are re-evaluated at invocation time via LazyParamInjector,
while static parameters remain unchanged. This enables both static configuration
(e.g., allowedTypes) and dynamic expressions (e.g., ${maxUploadSize}) in the
same interceptor stack reference.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-authored-by: Claude <noreply@anthropic.com>
* WW-5576 Upgrades commons-lang to version 3.20.0 which is Java 25 compatible
* WW-5576 Defines a new build on Java 25
* WW-5576 Fixes generating TLD file when building on Java 25
* WW-5576 Moves version property to the root pom.xml
This can mask configuration errors and result in a non-working
application.
Extend FetchMetadataInterceptorTest; in order to correctly load all of
the interceptors from struts-testing.xml, it needs additional configuration
providers.
* [maven-release-plugin] prepare release STRUTS_7_1_1
* [maven-release-plugin] rollback the release of STRUTS_7_1_1
* [maven-release-plugin] prepare release STRUTS_7_1_1
* [maven-release-plugin] prepare for next development iteration
This commit addresses a long-standing gap in the Struts validation framework where @DoubleRangeFieldValidator
and @ShortRangeFieldValidator annotations could not be used within the @Validations container annotation,
despite being fully functional as standalone annotations.
Changes made:
- Added doubleRangeFields() and shortRangeFields() methods to @Validations annotation interface
- Updated JavaDoc to document the new fields and corrected the parameters table
- Added processing loops for both validators in AnnotationValidationConfigurationBuilder
- Created comprehensive test coverage in AnnotationValidationConfigurationBuilderTest
- Added AnnotationValidationsContainerAction test class demonstrating proper usage
The implementation follows the exact same pattern used by IntRangeFieldValidator and LongRangeFieldValidator,
ensuring consistency across all range validators in the framework.
All existing tests continue to pass, and new tests verify that multiple validators of each type
can be properly configured within the @Validations container.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-authored-by: Claude <noreply@anthropic.com>
This commit addresses recommendation #4 from the visitor pattern research:
"Test repopulation behavior specifically with indexed properties to confirm it works as expected."
Two new test methods have been added to VisitorFieldValidatorTest:
1. testArrayConversionErrorRepopulation()
- Tests conversion errors in indexed array properties (testBeanArray[0].count, etc.)
- Verifies that conversion errors are properly detected with correct indexed notation
- Confirms repopulateField parameter preserves invalid values
2. testListConversionErrorRepopulation()
- Tests conversion errors in indexed list properties (testBeanList[1].count, etc.)
- Verifies proper field error key generation for list elements
- Validates that elements without conversion errors don't generate false positives
Supporting validation configuration files:
- TestBean-validateArrayWithConversion-validation.xml
- TestBean-validateListWithConversion-validation.xml
- VisitorValidatorTestAction-validateArrayWithConversion-validation.xml
- VisitorValidatorTestAction-validateListWithConversion-validation.xml
These tests verify the VisitorFieldValidator correctly handles:
- Conversion error detection for indexed properties
- Field name construction with proper index notation
- Error message generation for specific indexed elements
- Selective validation (only elements with conversion errors fail)
Research notes documenting the visitor pattern investigation are included
in thoughts/lukaszlenart/notes/2025-10-17-struts2-iterator-validation-visitor-pattern.md
Also updated .claude/settings.json to refine permissions:
- More specific WebFetch domain (struts.apache.org vs apache.org)
- Added git checkout and git log permissions for better workflow
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-authored-by: Claude <noreply@anthropic.com>
- Add 5 specialized agents: security-analyzer, test-runner, code-quality-checker, config-validator, jakarta-migration-helper
- Add 4 new commands: security_scan, run_tests, quality_check, config_analyze
- Reduce CLAUDE.md from 271 to ~120 lines (55% reduction) by extracting procedural knowledge into automation
- Maintain all security principles and quality standards while improving developer workflow
- Enable guided, consistent application of Apache Struts best practices through intelligent automation
The new system provides expert-level guidance without requiring developers to memorize complex procedures,
improving both productivity and code quality consistency across the project.
- Replace hardcoded user paths with dynamic $USER environment variable
- Update ticket patterns from eng_XXXX to Apache Struts WW-XXXX format
- Create thoughts/ directory structure for research documentation
- Add Maven build commands (mvn test -DskipAssembly) to agents
- Enhance security analysis with CVE-specific patterns (CVE-2017-5638, CVE-2018-11776)
- Improve Struts-specific knowledge in codebase analysis agents
- Add Jakarta module support and OGNL security focus
- Enable portable configuration across all developers
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
dependabot[bot]