[flyer5200]

Changelog category

• New Feature

Changelog entry (Details of this change)

• Support application administrators scoped to designated applications.
• Improve resource tree navigation and bulk deletion.

Affected version

• Latest development version

Background

Managing an application's resource catalog and OAuth clients previously required
platform administrator access. This made it difficult to delegate day-to-day
application configuration without also granting broader platform privileges.

Resource tree cleanup also needed more precise controls: administrators may want
to remove the children of one top-level resource without clearing the entire
application catalog.

Changes

Scoped application administration

• Add an application administrator system role and an administrator field on
  applications. Platform administrators can designate an existing user when
  creating or editing an application.
• Automatically manage the user's application administrator role as application
  assignments change.
• Allow application administrators to manage the resource tree and OAuth clients
  only for their designated applications. Application creation and deletion remain
  restricted to platform administrators; tenant administrator permissions are unchanged.
• Enforce application scope in backend services and catalog endpoints, including
  resource import, dependencies, field usage, and OAuth client operations.
• Add a searchable administrator selector to the application form and update
  the OpenAPI schema and localized UI.

Resource tree management

• Start resource trees collapsed to make large catalogs easier to navigate.
• Change the long-press action on a top-level resource to clear its descendants
  while preserving the top-level resource.
• Add a separate button to clear the entire application resource tree.
• Keep deletion transactional and block it when resources have grants or other
  protected references. Show the relevant roles and users when grants prevent
  deletion.

Validation

• Java tests on JDK 17, 21, 25, and 27; Java 21 coverage, Checkstyle,
  SpotBugs, and PMD checks.
• Frontend unit tests, browser tests, and PostgreSQL full-stack tests.
• Database integration tests for H2, PostgreSQL, MySQL, MariaDB, and Oracle.
• Docker smoke tests for H2, PostgreSQL, MySQL, MariaDB, Oracle, and SQL Server.
• CodeQL scans for Java, JavaScript/TypeScript, Python, and GitHub Actions.

The local SQL Server Testcontainers integration test could not be completed
because of Docker environment compatibility. The nightly performance benchmark
also exceeded the cached authorization snapshot P99 threshold locally; the cause
has not been established.