[maven-release-plugin][skip ci] prepare release 23.3.14.1

Co-authored-by: Belal Ansari <belal.ansari@hyland.com>

.github/workflows/ci.yml

@@ -42,9 +42,9 @@ jobs:
       !contains(github.event.head_commit.message, '[force')
     steps:
       - uses: actions/checkout@v4
-      - uses: Alfresco/alfresco-build-tools/.github/actions/get-build-info@v7.0.0
-      - uses: Alfresco/alfresco-build-tools/.github/actions/free-hosted-runner-disk-space@v7.0.0
-      - uses: Alfresco/alfresco-build-tools/.github/actions/setup-java-build@v7.0.0
+      - uses: Alfresco/alfresco-build-tools/.github/actions/get-build-info@v8.16.0
+      - uses: Alfresco/alfresco-build-tools/.github/actions/free-hosted-runner-disk-space@v8.16.0
+      - uses: Alfresco/alfresco-build-tools/.github/actions/setup-java-build@v8.16.0
       - uses: actions/checkout@v4
         with:
           fetch-depth: 0
@@ -70,12 +70,12 @@ jobs:
       !contains(github.event.head_commit.message, '[force')
     steps:
       - uses: actions/checkout@v4
-      - uses: Alfresco/alfresco-build-tools/.github/actions/get-build-info@v7.0.0
-      - uses: Alfresco/alfresco-build-tools/.github/actions/free-hosted-runner-disk-space@v7.0.0
-      - uses: Alfresco/alfresco-build-tools/.github/actions/setup-java-build@v7.0.0
+      - uses: Alfresco/alfresco-build-tools/.github/actions/get-build-info@v8.16.0
+      - uses: Alfresco/alfresco-build-tools/.github/actions/free-hosted-runner-disk-space@v8.16.0
+      - uses: Alfresco/alfresco-build-tools/.github/actions/setup-java-build@v8.16.0
       - name: "Init"
         run: bash ./scripts/ci/init.sh
-      - uses: Alfresco/alfresco-build-tools/.github/actions/veracode@v7.0.0
+      - uses: Alfresco/alfresco-build-tools/.github/actions/veracode@v8.16.0
         continue-on-error: true
         with:
           srcclr-api-token: ${{ secrets.SRCCLR_API_TOKEN }}
@@ -93,10 +93,10 @@ jobs:
       !contains(github.event.head_commit.message, '[force')
     steps:
       - uses: actions/checkout@v4
-      - uses: Alfresco/alfresco-build-tools/.github/actions/get-build-info@v7.0.0
-      - uses: Alfresco/alfresco-build-tools/.github/actions/free-hosted-runner-disk-space@v7.0.0
-      - uses: Alfresco/alfresco-build-tools/.github/actions/setup-java-build@v7.0.0
-      - uses: Alfresco/alfresco-build-tools/.github/actions/github-download-file@v7.0.0
+      - uses: Alfresco/alfresco-build-tools/.github/actions/get-build-info@v8.16.0
+      - uses: Alfresco/alfresco-build-tools/.github/actions/free-hosted-runner-disk-space@v8.16.0
+      - uses: Alfresco/alfresco-build-tools/.github/actions/setup-java-build@v8.16.0
+      - uses: Alfresco/alfresco-build-tools/.github/actions/github-download-file@v8.16.0
         with:
           token: ${{ secrets.BOT_GITHUB_TOKEN }}
           repository: "Alfresco/veracode-baseline-archive"
@@ -143,9 +143,9 @@ jobs:
       !contains(github.event.head_commit.message, '[skip tests]') &&
       !contains(github.event.head_commit.message, '[force]')
     steps:
-      - uses: Alfresco/alfresco-build-tools/.github/actions/get-build-info@v7.0.0
-      - uses: Alfresco/alfresco-build-tools/.github/actions/free-hosted-runner-disk-space@v7.0.0
-      - uses: Alfresco/alfresco-build-tools/.github/actions/setup-java-build@v7.0.0
+      - uses: Alfresco/alfresco-build-tools/.github/actions/get-build-info@v8.16.0
+      - uses: Alfresco/alfresco-build-tools/.github/actions/free-hosted-runner-disk-space@v8.16.0
+      - uses: Alfresco/alfresco-build-tools/.github/actions/setup-java-build@v8.16.0
       - uses: Alfresco/ya-pmd-scan@v4.0.0
         with:
           classpath-build-command: "mvn test-compile -ntp -Pags -pl \"-:alfresco-community-repo-docker\""
@@ -176,14 +176,14 @@ jobs:
             testAttributes: "-Dtest=AllMmtUnitTestSuite"
     steps:
       - uses: actions/checkout@v4
-      - uses: Alfresco/alfresco-build-tools/.github/actions/get-build-info@v7.0.0
-      - uses: Alfresco/alfresco-build-tools/.github/actions/free-hosted-runner-disk-space@v7.0.0
-      - uses: Alfresco/alfresco-build-tools/.github/actions/setup-java-build@v7.0.0
+      - uses: Alfresco/alfresco-build-tools/.github/actions/get-build-info@v8.16.0
+      - uses: Alfresco/alfresco-build-tools/.github/actions/free-hosted-runner-disk-space@v8.16.0
+      - uses: Alfresco/alfresco-build-tools/.github/actions/setup-java-build@v8.16.0
       - name: "Init"
         run: bash ./scripts/ci/init.sh
       - name: "Prepare Report Portal"
         if: github.ref_name == 'master'
-        uses: Alfresco/alfresco-build-tools/.github/actions/reportportal-prepare@v7.0.0
+        uses: Alfresco/alfresco-build-tools/.github/actions/reportportal-prepare@v8.16.0
         id: rp-prepare
         with:
           rp-launch-prefix: ${{ env.RP_LAUNCH_PREFIX }} - ${{ matrix.testModule }}
@@ -214,7 +214,7 @@ jobs:
         continue-on-error: true
       - name: "Summarize Report Portal"
         if: github.ref_name == 'master'
-        uses: Alfresco/alfresco-build-tools/.github/actions/reportportal-summarize@v7.0.0
+        uses: Alfresco/alfresco-build-tools/.github/actions/reportportal-summarize@v8.16.0
         id: rp-summarize
         with:
           tests-outcome: ${{ steps.run-tests.outcome }}
@@ -256,9 +256,9 @@ jobs:
       REQUIRES_INSTALLED_ARTIFACTS: true
     steps:
       - uses: actions/checkout@v4
-      - uses: Alfresco/alfresco-build-tools/.github/actions/get-build-info@v7.0.0
-      - uses: Alfresco/alfresco-build-tools/.github/actions/free-hosted-runner-disk-space@v7.0.0
-      - uses: Alfresco/alfresco-build-tools/.github/actions/setup-java-build@v7.0.0
+      - uses: Alfresco/alfresco-build-tools/.github/actions/get-build-info@v8.16.0
+      - uses: Alfresco/alfresco-build-tools/.github/actions/free-hosted-runner-disk-space@v8.16.0
+      - uses: Alfresco/alfresco-build-tools/.github/actions/setup-java-build@v8.16.0
       - name: "Build"
         timeout-minutes: ${{ fromJSON(env.GITHUB_ACTIONS_DEPLOY_TIMEOUT) }}
         run: |
@@ -270,7 +270,7 @@ jobs:
         run: docker compose -f ./scripts/ci/docker-compose/docker-compose.yaml --profile ${{ matrix.compose-profile }} up -d
       - name: "Prepare Report Portal"
         if: github.ref_name == 'master'
-        uses: Alfresco/alfresco-build-tools/.github/actions/reportportal-prepare@v7.0.0
+        uses: Alfresco/alfresco-build-tools/.github/actions/reportportal-prepare@v8.16.0
         id: rp-prepare
         with:
           rp-launch-prefix: ${{ env.RP_LAUNCH_PREFIX }} - ${{ matrix.testSuite }}
@@ -301,7 +301,7 @@ jobs:
         continue-on-error: true
       - name: "Summarize Report Portal"
         if: github.ref_name == 'master'
-        uses: Alfresco/alfresco-build-tools/.github/actions/reportportal-summarize@v7.0.0
+        uses: Alfresco/alfresco-build-tools/.github/actions/reportportal-summarize@v8.16.0
         id: rp-summarize
         with:
           tests-outcome: ${{ steps.run-tests.outcome }}
@@ -334,9 +334,9 @@ jobs:
         version: ['10.2.18', '10.4', '10.5']
     steps:
       - uses: actions/checkout@v4
-      - uses: Alfresco/alfresco-build-tools/.github/actions/get-build-info@v7.0.0
-      - uses: Alfresco/alfresco-build-tools/.github/actions/free-hosted-runner-disk-space@v7.0.0
-      - uses: Alfresco/alfresco-build-tools/.github/actions/setup-java-build@v7.0.0
+      - uses: Alfresco/alfresco-build-tools/.github/actions/get-build-info@v8.16.0
+      - uses: Alfresco/alfresco-build-tools/.github/actions/free-hosted-runner-disk-space@v8.16.0
+      - uses: Alfresco/alfresco-build-tools/.github/actions/setup-java-build@v8.16.0
       - name: "Init"
         run: bash ./scripts/ci/init.sh
       - name: Run MariaDB ${{ matrix.version }} database
@@ -345,7 +345,7 @@ jobs:
           MARIADB_VERSION: ${{ matrix.version }}
       - name: "Prepare Report Portal"
         if: github.ref_name == 'master'
-        uses: Alfresco/alfresco-build-tools/.github/actions/reportportal-prepare@v7.0.0
+        uses: Alfresco/alfresco-build-tools/.github/actions/reportportal-prepare@v8.16.0
         id: rp-prepare
         with:
           rp-launch-prefix: ${{ env.RP_LAUNCH_PREFIX }} - ${{ matrix.version }}
@@ -376,7 +376,7 @@ jobs:
         continue-on-error: true
       - name: "Summarize Report Portal"
         if: github.ref_name == 'master'
-        uses: Alfresco/alfresco-build-tools/.github/actions/reportportal-summarize@v7.0.0
+        uses: Alfresco/alfresco-build-tools/.github/actions/reportportal-summarize@v8.16.0
         id: rp-summarize
         with:
           tests-outcome: ${{ steps.run-tests.outcome }}
@@ -405,9 +405,9 @@ jobs:
       !contains(github.event.head_commit.message, '[force')
     steps:
       - uses: actions/checkout@v4
-      - uses: Alfresco/alfresco-build-tools/.github/actions/get-build-info@v7.0.0
-      - uses: Alfresco/alfresco-build-tools/.github/actions/free-hosted-runner-disk-space@v7.0.0
-      - uses: Alfresco/alfresco-build-tools/.github/actions/setup-java-build@v7.0.0
+      - uses: Alfresco/alfresco-build-tools/.github/actions/get-build-info@v8.16.0
+      - uses: Alfresco/alfresco-build-tools/.github/actions/free-hosted-runner-disk-space@v8.16.0
+      - uses: Alfresco/alfresco-build-tools/.github/actions/setup-java-build@v8.16.0
       - name: "Init"
         run: bash ./scripts/ci/init.sh
       - name: "Run MariaDB 10.6 database"
@@ -416,7 +416,7 @@ jobs:
           MARIADB_VERSION: 10.6
       - name: "Prepare Report Portal"
         if: github.ref_name == 'master'
-        uses: Alfresco/alfresco-build-tools/.github/actions/reportportal-prepare@v7.0.0
+        uses: Alfresco/alfresco-build-tools/.github/actions/reportportal-prepare@v8.16.0
         id: rp-prepare
         with:
           rp-launch-prefix: ${{ env.RP_LAUNCH_PREFIX }}
@@ -447,7 +447,7 @@ jobs:
         continue-on-error: true
       - name: "Summarize Report Portal"
         if: github.ref_name == 'master'
-        uses: Alfresco/alfresco-build-tools/.github/actions/reportportal-summarize@v7.0.0
+        uses: Alfresco/alfresco-build-tools/.github/actions/reportportal-summarize@v8.16.0
         id: rp-summarize
         with:
           tests-outcome: ${{ steps.run-tests.outcome }}
@@ -476,9 +476,9 @@ jobs:
       !contains(github.event.head_commit.message, '[force')
     steps:
       - uses: actions/checkout@v4
-      - uses: Alfresco/alfresco-build-tools/.github/actions/get-build-info@v7.0.0
-      - uses: Alfresco/alfresco-build-tools/.github/actions/free-hosted-runner-disk-space@v7.0.0
-      - uses: Alfresco/alfresco-build-tools/.github/actions/setup-java-build@v7.0.0
+      - uses: Alfresco/alfresco-build-tools/.github/actions/get-build-info@v8.16.0
+      - uses: Alfresco/alfresco-build-tools/.github/actions/free-hosted-runner-disk-space@v8.16.0
+      - uses: Alfresco/alfresco-build-tools/.github/actions/setup-java-build@v8.16.0
       - name: "Init"
         run: bash ./scripts/ci/init.sh
       - name: "Run MySQL 8 database"
@@ -487,7 +487,7 @@ jobs:
           MYSQL_VERSION: 8
       - name: "Prepare Report Portal"
         if: github.ref_name == 'master'
-        uses: Alfresco/alfresco-build-tools/.github/actions/reportportal-prepare@v7.0.0
+        uses: Alfresco/alfresco-build-tools/.github/actions/reportportal-prepare@v8.16.0
         id: rp-prepare
         with:
           rp-launch-prefix: ${{ env.RP_LAUNCH_PREFIX }}
@@ -518,7 +518,7 @@ jobs:
         continue-on-error: true
       - name: "Summarize Report Portal"
         if: github.ref_name == 'master'
-        uses: Alfresco/alfresco-build-tools/.github/actions/reportportal-summarize@v7.0.0
+        uses: Alfresco/alfresco-build-tools/.github/actions/reportportal-summarize@v8.16.0
         id: rp-summarize
         with:
           tests-outcome: ${{ steps.run-tests.outcome }}
@@ -546,9 +546,9 @@ jobs:
       !contains(github.event.head_commit.message, '[force')
     steps:
       - uses: actions/checkout@v4
-      - uses: Alfresco/alfresco-build-tools/.github/actions/get-build-info@v7.0.0
-      - uses: Alfresco/alfresco-build-tools/.github/actions/free-hosted-runner-disk-space@v7.0.0
-      - uses: Alfresco/alfresco-build-tools/.github/actions/setup-java-build@v7.0.0
+      - uses: Alfresco/alfresco-build-tools/.github/actions/get-build-info@v8.16.0
+      - uses: Alfresco/alfresco-build-tools/.github/actions/free-hosted-runner-disk-space@v8.16.0
+      - uses: Alfresco/alfresco-build-tools/.github/actions/setup-java-build@v8.16.0
       - name: "Init"
         run: bash ./scripts/ci/init.sh
       - name: "Run PostgreSQL 13.12 database"
@@ -557,7 +557,7 @@ jobs:
           POSTGRES_VERSION: 13.12
       - name: "Prepare Report Portal"
         if: github.ref_name == 'master'
-        uses: Alfresco/alfresco-build-tools/.github/actions/reportportal-prepare@v7.0.0
+        uses: Alfresco/alfresco-build-tools/.github/actions/reportportal-prepare@v8.16.0
         id: rp-prepare
         with:
           rp-launch-prefix: ${{ env.RP_LAUNCH_PREFIX }}
@@ -588,7 +588,7 @@ jobs:
         continue-on-error: true
       - name: "Summarize Report Portal"
         if: github.ref_name == 'master'
-        uses: Alfresco/alfresco-build-tools/.github/actions/reportportal-summarize@v7.0.0
+        uses: Alfresco/alfresco-build-tools/.github/actions/reportportal-summarize@v8.16.0
         id: rp-summarize
         with:
           tests-outcome: ${{ steps.run-tests.outcome }}
@@ -616,9 +616,9 @@ jobs:
       !contains(github.event.head_commit.message, '[force')
     steps:
       - uses: actions/checkout@v4
-      - uses: Alfresco/alfresco-build-tools/.github/actions/get-build-info@v7.0.0
-      - uses: Alfresco/alfresco-build-tools/.github/actions/free-hosted-runner-disk-space@v7.0.0
-      - uses: Alfresco/alfresco-build-tools/.github/actions/setup-java-build@v7.0.0
+      - uses: Alfresco/alfresco-build-tools/.github/actions/get-build-info@v8.16.0
+      - uses: Alfresco/alfresco-build-tools/.github/actions/free-hosted-runner-disk-space@v8.16.0
+      - uses: Alfresco/alfresco-build-tools/.github/actions/setup-java-build@v8.16.0
       - name: "Init"
         run: bash ./scripts/ci/init.sh
       - name: "Run PostgreSQL 14.9 database"
@@ -627,7 +627,7 @@ jobs:
           POSTGRES_VERSION: 14.9
       - name: "Prepare Report Portal"
         if: github.ref_name == 'master'
-        uses: Alfresco/alfresco-build-tools/.github/actions/reportportal-prepare@v7.0.0
+        uses: Alfresco/alfresco-build-tools/.github/actions/reportportal-prepare@v8.16.0
         id: rp-prepare
         with:
           rp-launch-prefix: ${{ env.RP_LAUNCH_PREFIX }}
@@ -658,7 +658,7 @@ jobs:
         continue-on-error: true
       - name: "Summarize Report Portal"
         if: github.ref_name == 'master'
-        uses: Alfresco/alfresco-build-tools/.github/actions/reportportal-summarize@v7.0.0
+        uses: Alfresco/alfresco-build-tools/.github/actions/reportportal-summarize@v8.16.0
         id: rp-summarize
         with:
           tests-outcome: ${{ steps.run-tests.outcome }}
@@ -686,9 +686,9 @@ jobs:
       !contains(github.event.head_commit.message, '[force')
     steps:
       - uses: actions/checkout@v4
-      - uses: Alfresco/alfresco-build-tools/.github/actions/get-build-info@v7.0.0
-      - uses: Alfresco/alfresco-build-tools/.github/actions/free-hosted-runner-disk-space@v7.0.0
-      - uses: Alfresco/alfresco-build-tools/.github/actions/setup-java-build@v7.0.0
+      - uses: Alfresco/alfresco-build-tools/.github/actions/get-build-info@v8.16.0
+      - uses: Alfresco/alfresco-build-tools/.github/actions/free-hosted-runner-disk-space@v8.16.0
+      - uses: Alfresco/alfresco-build-tools/.github/actions/setup-java-build@v8.16.0
       - name: "Init"
         run: bash ./scripts/ci/init.sh
       - name: "Run PostgreSQL 15.4 database"
@@ -697,7 +697,7 @@ jobs:
           POSTGRES_VERSION: 15.4
       - name: "Prepare Report Portal"
         if: github.ref_name == 'master'
-        uses: Alfresco/alfresco-build-tools/.github/actions/reportportal-prepare@v7.0.0
+        uses: Alfresco/alfresco-build-tools/.github/actions/reportportal-prepare@v8.16.0
         id: rp-prepare
         with:
           rp-launch-prefix: ${{ env.RP_LAUNCH_PREFIX }}
@@ -728,7 +728,7 @@ jobs:
         continue-on-error: true
       - name: "Summarize Report Portal"
         if: github.ref_name == 'master'
-        uses: Alfresco/alfresco-build-tools/.github/actions/reportportal-summarize@v7.0.0
+        uses: Alfresco/alfresco-build-tools/.github/actions/reportportal-summarize@v8.16.0
         id: rp-summarize
         with:
           tests-outcome: ${{ steps.run-tests.outcome }}
@@ -754,16 +754,16 @@ jobs:
       !contains(github.event.head_commit.message, '[force')
     steps:
       - uses: actions/checkout@v4
-      - uses: Alfresco/alfresco-build-tools/.github/actions/get-build-info@v7.0.0
-      - uses: Alfresco/alfresco-build-tools/.github/actions/free-hosted-runner-disk-space@v7.0.0
-      - uses: Alfresco/alfresco-build-tools/.github/actions/setup-java-build@v7.0.0
+      - uses: Alfresco/alfresco-build-tools/.github/actions/get-build-info@v8.16.0
+      - uses: Alfresco/alfresco-build-tools/.github/actions/free-hosted-runner-disk-space@v8.16.0
+      - uses: Alfresco/alfresco-build-tools/.github/actions/setup-java-build@v8.16.0
       - name: "Init"
         run: bash ./scripts/ci/init.sh
       - name: "Run ActiveMQ"
         run: docker compose -f ./scripts/ci/docker-compose/docker-compose.yaml --profile activemq up -d
       - name: "Prepare Report Portal"
         if: github.ref_name == 'master'
-        uses: Alfresco/alfresco-build-tools/.github/actions/reportportal-prepare@v7.0.0
+        uses: Alfresco/alfresco-build-tools/.github/actions/reportportal-prepare@v8.16.0
         id: rp-prepare
         with:
           rp-launch-prefix: ${{ env.RP_LAUNCH_PREFIX }}
@@ -794,7 +794,7 @@ jobs:
         continue-on-error: true
       - name: "Summarize Report Portal"
         if: github.ref_name == 'master'
-        uses: Alfresco/alfresco-build-tools/.github/actions/reportportal-summarize@v7.0.0
+        uses: Alfresco/alfresco-build-tools/.github/actions/reportportal-summarize@v8.16.0
         id: rp-summarize
         with:
           tests-outcome: ${{ steps.run-tests.outcome }}
@@ -854,9 +854,9 @@ jobs:
             mvn-options: '-Dencryption.ssl.keystore.location=${CI_WORKSPACE}/keystores/alfresco/alfresco.keystore -Dencryption.ssl.truststore.location=${CI_WORKSPACE}/keystores/alfresco/alfresco.truststore'
     steps:
       - uses: actions/checkout@v4
-      - uses: Alfresco/alfresco-build-tools/.github/actions/get-build-info@v7.0.0
-      - uses: Alfresco/alfresco-build-tools/.github/actions/free-hosted-runner-disk-space@v7.0.0
-      - uses: Alfresco/alfresco-build-tools/.github/actions/setup-java-build@v7.0.0
+      - uses: Alfresco/alfresco-build-tools/.github/actions/get-build-info@v8.16.0
+      - uses: Alfresco/alfresco-build-tools/.github/actions/free-hosted-runner-disk-space@v8.16.0
+      - uses: Alfresco/alfresco-build-tools/.github/actions/setup-java-build@v8.16.0
       - name: "Init"
         run: bash ./scripts/ci/init.sh
       - name: "Set transformers tag"
@@ -878,7 +878,7 @@ jobs:
         run: docker compose -f ./scripts/ci/docker-compose/docker-compose.yaml --profile ${{ matrix.compose-profile }} up -d
       - name: "Prepare Report Portal"
         if: github.ref_name == 'master'
-        uses: Alfresco/alfresco-build-tools/.github/actions/reportportal-prepare@v7.0.0
+        uses: Alfresco/alfresco-build-tools/.github/actions/reportportal-prepare@v8.16.0
         id: rp-prepare
         with:
           rp-launch-prefix: ${{ env.RP_LAUNCH_PREFIX }} - ${{ matrix.testSuite }} ${{ matrix.idp }}
@@ -909,7 +909,7 @@ jobs:
         continue-on-error: true
       - name: "Summarize Report Portal"
         if: github.ref_name == 'master'
-        uses: Alfresco/alfresco-build-tools/.github/actions/reportportal-summarize@v7.0.0
+        uses: Alfresco/alfresco-build-tools/.github/actions/reportportal-summarize@v8.16.0
         id: rp-summarize
         with:
           tests-outcome: ${{ steps.run-tests.outcome }}
@@ -967,9 +967,9 @@ jobs:
       REQUIRES_LOCAL_IMAGES: true
     steps:
       - uses: actions/checkout@v4
-      - uses: Alfresco/alfresco-build-tools/.github/actions/get-build-info@v7.0.0
-      - uses: Alfresco/alfresco-build-tools/.github/actions/free-hosted-runner-disk-space@v7.0.0
-      - uses: Alfresco/alfresco-build-tools/.github/actions/setup-java-build@v7.0.0
+      - uses: Alfresco/alfresco-build-tools/.github/actions/get-build-info@v8.16.0
+      - uses: Alfresco/alfresco-build-tools/.github/actions/free-hosted-runner-disk-space@v8.16.0
+      - uses: Alfresco/alfresco-build-tools/.github/actions/setup-java-build@v8.16.0
       - name: "Build"
         timeout-minutes: ${{ fromJSON(env.GITHUB_ACTIONS_DEPLOY_TIMEOUT) }}
         run: |
@@ -984,7 +984,7 @@ jobs:
         run: mvn install -pl :alfresco-community-repo-integration-test -am -DskipTests -Pall-tas-tests
       - name: "Prepare Report Portal"
         if: github.ref_name == 'master'
-        uses: Alfresco/alfresco-build-tools/.github/actions/reportportal-prepare@v7.0.0
+        uses: Alfresco/alfresco-build-tools/.github/actions/reportportal-prepare@v8.16.0
         id: rp-prepare
         with:
           rp-launch-prefix: ${{ env.RP_LAUNCH_PREFIX }} - ${{ matrix.test-name }}
@@ -1022,7 +1022,7 @@ jobs:
         continue-on-error: true
       - name: "Summarize Report Portal"
         if: github.ref_name == 'master'
-        uses: Alfresco/alfresco-build-tools/.github/actions/reportportal-summarize@v7.0.0
+        uses: Alfresco/alfresco-build-tools/.github/actions/reportportal-summarize@v8.16.0
         id: rp-summarize
         with:
           tests-outcome: ${{ steps.tests.outcome }}
@@ -1048,16 +1048,16 @@ jobs:
       !contains(github.event.head_commit.message, '[force')
     steps:
       - uses: actions/checkout@v4
-      - uses: Alfresco/alfresco-build-tools/.github/actions/get-build-info@v7.0.0
-      - uses: Alfresco/alfresco-build-tools/.github/actions/free-hosted-runner-disk-space@v7.0.0
-      - uses: Alfresco/alfresco-build-tools/.github/actions/setup-java-build@v7.0.0
+      - uses: Alfresco/alfresco-build-tools/.github/actions/get-build-info@v8.16.0
+      - uses: Alfresco/alfresco-build-tools/.github/actions/free-hosted-runner-disk-space@v8.16.0
+      - uses: Alfresco/alfresco-build-tools/.github/actions/setup-java-build@v8.16.0
       - name: "Init"
         run: bash ./scripts/ci/init.sh
       - name: "Run Postgres 15.4 database"
         run: docker compose -f ./scripts/ci/docker-compose/docker-compose.yaml --profile postgres up -d
       - name: "Prepare Report Portal"
         if: github.ref_name == 'master'
-        uses: Alfresco/alfresco-build-tools/.github/actions/reportportal-prepare@v7.0.0
+        uses: Alfresco/alfresco-build-tools/.github/actions/reportportal-prepare@v8.16.0
         id: rp-prepare
         with:
           rp-launch-prefix: ${{ env.RP_LAUNCH_PREFIX }}
@@ -1088,7 +1088,7 @@ jobs:
         continue-on-error: true
       - name: "Summarize Report Portal"
         if: github.ref_name == 'master'
-        uses: Alfresco/alfresco-build-tools/.github/actions/reportportal-summarize@v7.0.0
+        uses: Alfresco/alfresco-build-tools/.github/actions/reportportal-summarize@v8.16.0
         id: rp-summarize
         with:
           tests-outcome: ${{ steps.run-tests.outcome }}
@@ -1122,9 +1122,9 @@ jobs:
       REQUIRES_INSTALLED_ARTIFACTS: true
     steps:
       - uses: actions/checkout@v4
-      - uses: Alfresco/alfresco-build-tools/.github/actions/get-build-info@v7.0.0
-      - uses: Alfresco/alfresco-build-tools/.github/actions/free-hosted-runner-disk-space@v7.0.0
-      - uses: Alfresco/alfresco-build-tools/.github/actions/setup-java-build@v7.0.0
+      - uses: Alfresco/alfresco-build-tools/.github/actions/get-build-info@v8.16.0
+      - uses: Alfresco/alfresco-build-tools/.github/actions/free-hosted-runner-disk-space@v8.16.0
+      - uses: Alfresco/alfresco-build-tools/.github/actions/setup-java-build@v8.16.0
       - name: "Build"
         timeout-minutes: ${{ fromJSON(env.GITHUB_ACTIONS_DEPLOY_TIMEOUT) }}
         run: |
@@ -1132,7 +1132,7 @@ jobs:
           bash ./scripts/ci/build.sh
       - name: "Prepare Report Portal"
         if: github.ref_name == 'master'
-        uses: Alfresco/alfresco-build-tools/.github/actions/reportportal-prepare@v7.0.0
+        uses: Alfresco/alfresco-build-tools/.github/actions/reportportal-prepare@v8.16.0
         id: rp-prepare
         with:
           rp-launch-prefix: ${{ env.RP_LAUNCH_PREFIX }} 0${{ matrix.part }} - (PostgreSQL) ${{ matrix.test-name }}
@@ -1168,9 +1168,9 @@ jobs:
       REQUIRES_INSTALLED_ARTIFACTS: true
     steps:
       - uses: actions/checkout@v4
-      - uses: Alfresco/alfresco-build-tools/.github/actions/get-build-info@v7.0.0
-      - uses: Alfresco/alfresco-build-tools/.github/actions/free-hosted-runner-disk-space@v7.0.0
-      - uses: Alfresco/alfresco-build-tools/.github/actions/setup-java-build@v7.0.0
+      - uses: Alfresco/alfresco-build-tools/.github/actions/get-build-info@v8.16.0
+      - uses: Alfresco/alfresco-build-tools/.github/actions/free-hosted-runner-disk-space@v8.16.0
+      - uses: Alfresco/alfresco-build-tools/.github/actions/setup-java-build@v8.16.0
       - name: "Build"
         timeout-minutes: ${{ fromJSON(env.GITHUB_ACTIONS_DEPLOY_TIMEOUT) }}
         run: |
@@ -1178,7 +1178,7 @@ jobs:
           bash ./scripts/ci/build.sh
       - name: "Prepare Report Portal"
         if: github.ref_name == 'master'
-        uses: Alfresco/alfresco-build-tools/.github/actions/reportportal-prepare@v7.0.0
+        uses: Alfresco/alfresco-build-tools/.github/actions/reportportal-prepare@v8.16.0
         id: rp-prepare
         with:
           rp-launch-prefix: ${{ env.RP_LAUNCH_PREFIX }} 0${{ matrix.part }} - (MySQL) ${{ matrix.test-name }}
@@ -1210,9 +1210,9 @@ jobs:
       REQUIRES_LOCAL_IMAGES: true
     steps:
       - uses: actions/checkout@v4
-      - uses: Alfresco/alfresco-build-tools/.github/actions/get-build-info@v7.0.0
-      - uses: Alfresco/alfresco-build-tools/.github/actions/free-hosted-runner-disk-space@v7.0.0
-      - uses: Alfresco/alfresco-build-tools/.github/actions/setup-java-build@v7.0.0
+      - uses: Alfresco/alfresco-build-tools/.github/actions/get-build-info@v8.16.0
+      - uses: Alfresco/alfresco-build-tools/.github/actions/free-hosted-runner-disk-space@v8.16.0
+      - uses: Alfresco/alfresco-build-tools/.github/actions/setup-java-build@v8.16.0
       - name: "Build"
         timeout-minutes: ${{ fromJSON(env.GITHUB_ACTIONS_DEPLOY_TIMEOUT) }}
         run: |
@@ -1226,7 +1226,7 @@ jobs:
           mvn -B install -pl :alfresco-governance-services-automation-community-rest-api -am -Pags -Pall-tas-tests -DskipTests
       - name: "Prepare Report Portal"
         if: github.ref_name == 'master'
-        uses: Alfresco/alfresco-build-tools/.github/actions/reportportal-prepare@v7.0.0
+        uses: Alfresco/alfresco-build-tools/.github/actions/reportportal-prepare@v8.16.0
         id: rp-prepare
         with:
           rp-launch-prefix: ${{ env.RP_LAUNCH_PREFIX }}
@@ -1258,7 +1258,7 @@ jobs:
         continue-on-error: true
       - name: "Summarize Report Portal"
         if: github.ref_name == 'master'
-        uses: Alfresco/alfresco-build-tools/.github/actions/reportportal-summarize@v7.0.0
+        uses: Alfresco/alfresco-build-tools/.github/actions/reportportal-summarize@v8.16.0
         id: rp-summarize
         with:
           tests-outcome: ${{ steps.run-tests.outcome }}
@@ -1300,9 +1300,9 @@ jobs:
       !contains(github.event.head_commit.message, '[force]')
     steps:
       - uses: actions/checkout@v4
-      - uses: Alfresco/alfresco-build-tools/.github/actions/get-build-info@v7.0.0
-      - uses: Alfresco/alfresco-build-tools/.github/actions/free-hosted-runner-disk-space@v7.0.0
-      - uses: Alfresco/alfresco-build-tools/.github/actions/setup-java-build@v7.0.0
+      - uses: Alfresco/alfresco-build-tools/.github/actions/get-build-info@v8.16.0
+      - uses: Alfresco/alfresco-build-tools/.github/actions/free-hosted-runner-disk-space@v8.16.0
+      - uses: Alfresco/alfresco-build-tools/.github/actions/setup-java-build@v8.16.0
       - name: "Build"
         timeout-minutes: ${{ fromJSON(env.GITHUB_ACTIONS_DEPLOY_TIMEOUT) }}
         run: |

.github/workflows/master_release.yml

@@ -34,12 +34,12 @@ jobs:
       - uses: actions/checkout@v4
         with:
           persist-credentials: false
-      - uses: Alfresco/alfresco-build-tools/.github/actions/get-build-info@v7.0.0
-      - uses: Alfresco/alfresco-build-tools/.github/actions/free-hosted-runner-disk-space@v7.0.0      
-      - uses: Alfresco/alfresco-build-tools/.github/actions/setup-java-build@v7.0.0
+      - uses: Alfresco/alfresco-build-tools/.github/actions/get-build-info@v8.16.0
+      - uses: Alfresco/alfresco-build-tools/.github/actions/free-hosted-runner-disk-space@v8.16.0      
+      - uses: Alfresco/alfresco-build-tools/.github/actions/setup-java-build@v8.16.0
       - name: "Init"
         run: bash ./scripts/ci/init.sh
-      - uses: Alfresco/alfresco-build-tools/.github/actions/configure-git-author@v7.0.0
+      - uses: Alfresco/alfresco-build-tools/.github/actions/configure-git-author@v8.16.0
         with:
           username: ${{ env.GIT_USERNAME }}
           email: ${{ env.GIT_EMAIL }}
@@ -63,12 +63,12 @@ jobs:
       - uses: actions/checkout@v4
         with:
           persist-credentials: false
-      - uses: Alfresco/alfresco-build-tools/.github/actions/get-build-info@v7.0.0
-      - uses: Alfresco/alfresco-build-tools/.github/actions/free-hosted-runner-disk-space@v7.0.0      
-      - uses: Alfresco/alfresco-build-tools/.github/actions/setup-java-build@v7.0.0
+      - uses: Alfresco/alfresco-build-tools/.github/actions/get-build-info@v8.16.0
+      - uses: Alfresco/alfresco-build-tools/.github/actions/free-hosted-runner-disk-space@v8.16.0      
+      - uses: Alfresco/alfresco-build-tools/.github/actions/setup-java-build@v8.16.0
       - name: "Init"
         run: bash ./scripts/ci/init.sh
-      - uses: Alfresco/alfresco-build-tools/.github/actions/configure-git-author@v7.0.0
+      - uses: Alfresco/alfresco-build-tools/.github/actions/configure-git-author@v8.16.0
         with:
           username: ${{ env.GIT_USERNAME }}
           email: ${{ env.GIT_EMAIL }}

.secrets.baseline

@@ -1539,7 +1539,7 @@
         "filename": "repository/src/test/java/org/alfresco/repo/rendition2/AbstractRenditionIntegrationTest.java",
         "hashed_secret": "5baa61e4c9b93f3f0682250b6cf8331b7ee68fd8",
         "is_verified": false,
-        "line_number": 127,
+        "line_number": 130,
         "is_secret": false
       }
     ],
@@ -1888,5 +1888,5 @@
       }
     ]
   },
-  "generated_at": "2025-01-10T19:40:38Z"
+  "generated_at": "2025-03-31T12:42:09Z"
 }

amps/ags/pom.xml

@@ -7,7 +7,7 @@
    <parent>
       <groupId>org.alfresco</groupId>
       <artifactId>alfresco-community-repo-amps</artifactId>
-      <version>23.3.5.1</version>
+      <version>23.3.14.1</version>
    </parent>
 
    <modules>

amps/ags/rm-automation/pom.xml

@@ -7,7 +7,7 @@
    <parent>
       <groupId>org.alfresco</groupId>
       <artifactId>alfresco-governance-services-community-parent</artifactId>
-      <version>23.3.5.1</version>
+      <version>23.3.14.1</version>
    </parent>
 
    <modules>

amps/ags/rm-automation/rm-automation-community-rest-api/pom.xml

@@ -7,7 +7,7 @@
    <parent>
       <groupId>org.alfresco</groupId>
       <artifactId>alfresco-governance-services-automation-community-repo</artifactId>
-      <version>23.3.5.1</version>
+      <version>23.3.14.1</version>
    </parent>
 
    <build>

amps/ags/rm-automation/rm-automation-community-rest-api/src/test/java/org/alfresco/rest/rm/community/hold/AddToHoldsBulkV1Tests.java

@@ -134,6 +134,16 @@ public class AddToHoldsBulkV1Tests extends BaseRMRestTest
                 .until(() -> getRestAPIFactory().getSearchAPI(null).search(searchRequest).getPagination()
                         .getTotalItems() == NUMBER_OF_FILES);
 
+        RestRequestQueryModel ancestorReq = getContentFromFolderAndAllSubfoldersQuery(rootFolder.getNodeRefWithoutVersion());
+        SearchRequest ancestorSearchRequest = new SearchRequest();
+        ancestorSearchRequest.setQuery(ancestorReq);
+
+        STEP("Wait until paths are indexed.");
+        // to improve stability on CI - seems that sometimes during big load we need to wait longer for the condition
+        await().atMost(120, TimeUnit.SECONDS)
+                .until(() -> getRestAPIFactory().getSearchAPI(null).search(ancestorSearchRequest).getPagination()
+                        .getTotalItems() == NUMBER_OF_FILES);
+
         holdBulkOperation = HoldBulkOperation.builder()
                 .query(queryReq)
                 .op(HoldBulkOperationType.ADD).build();

amps/ags/rm-community/pom.xml

@@ -7,7 +7,7 @@
    <parent>
       <groupId>org.alfresco</groupId>
       <artifactId>alfresco-governance-services-community-parent</artifactId>
-      <version>23.3.5.1</version>
+      <version>23.3.14.1</version>
    </parent>
 
    <modules>

amps/ags/rm-community/rm-community-repo/config/alfresco/module/org_alfresco_module_rm/alfresco-global.properties

@@ -119,6 +119,11 @@ rm.patch.v35.holdNewChildAssocPatch.batchSize=1000
 rm.haspermissionmap.read=Read
 rm.haspermissionmap.write=WriteProperties,AddChildren,ReadContent
 
+# Extended Permissions
+# Enable matching the given username with the correct casing username when retrieving an IPR group.
+# Only needs to be used if there are owners that don't have the username in the correct casing.
+rm.extendedSecurity.enableUsernameNormalization=false
+
 #
 # Extended auto-version behaviour.  If true and other auto-version properties are satisfied, then
 # a document will be auto-versioned when its type is changed.

amps/ags/rm-community/rm-community-repo/config/alfresco/module/org_alfresco_module_rm/rm-service-context.xml

@@ -611,6 +611,7 @@
         <property name="authorityService" ref="authorityService"/>
         <property name="permissionService" ref="permissionService"/>
         <property name="transactionService" ref="transactionService"/>
+        <property name="enableUsernameNormalization" value="${rm.extendedSecurity.enableUsernameNormalization}" />
     </bean>
 
     <bean id="ExtendedSecurityService" class="org.springframework.aop.framework.ProxyFactoryBean">

amps/ags/rm-community/rm-community-repo/pom.xml

@@ -8,7 +8,7 @@
    <parent>
       <groupId>org.alfresco</groupId>
       <artifactId>alfresco-governance-services-community-repo-parent</artifactId>
-      <version>23.3.5.1</version>
+      <version>23.3.14.1</version>
    </parent>
 
    <properties>

amps/ags/rm-community/rm-community-repo/source/java/org/alfresco/module/org_alfresco_module_rm/security/ExtendedSecurityServiceImpl.java

@@ -34,6 +34,11 @@ import java.util.HashSet;
 import java.util.List;
 import java.util.Set;
 
+import org.springframework.context.ApplicationListener;
+import org.springframework.context.event.ContextRefreshedEvent;
+import org.springframework.extensions.webscripts.ui.common.StringUtils;
+
+import org.alfresco.model.ContentModel;
 import org.alfresco.model.RenditionModel;
 import org.alfresco.module.org_alfresco_module_rm.capability.RMPermissionModel;
 import org.alfresco.module.org_alfresco_module_rm.fileplan.FilePlanService;
@@ -42,7 +47,10 @@ import org.alfresco.module.org_alfresco_module_rm.role.FilePlanRoleService;
 import org.alfresco.module.org_alfresco_module_rm.util.ServiceBaseImpl;
 import org.alfresco.query.PagingRequest;
 import org.alfresco.query.PagingResults;
+import org.alfresco.repo.security.authentication.AuthenticationUtil;
+import org.alfresco.repo.security.authentication.AuthenticationUtil.RunAsWork;
 import org.alfresco.repo.security.authority.RMAuthority;
+import org.alfresco.repo.transaction.RetryingTransactionHelper.RetryingTransactionCallback;
 import org.alfresco.service.cmr.repository.ChildAssociationRef;
 import org.alfresco.service.cmr.repository.DuplicateChildNodeNameException;
 import org.alfresco.service.cmr.repository.NodeRef;
@@ -54,12 +62,6 @@ import org.alfresco.service.namespace.RegexQNamePattern;
 import org.alfresco.service.transaction.TransactionService;
 import org.alfresco.util.Pair;
 import org.alfresco.util.ParameterCheck;
-import org.springframework.context.ApplicationListener;
-import org.springframework.context.event.ContextRefreshedEvent;
-import org.springframework.extensions.webscripts.ui.common.StringUtils;
-import org.alfresco.repo.security.authentication.AuthenticationUtil;
-import org.alfresco.repo.security.authentication.AuthenticationUtil.RunAsWork;
-import org.alfresco.repo.transaction.RetryingTransactionHelper.RetryingTransactionCallback;
 
 /**
  * Extended security service implementation.
@@ -68,9 +70,9 @@ import org.alfresco.repo.transaction.RetryingTransactionHelper.RetryingTransacti
  * @since 2.1
  */
 public class ExtendedSecurityServiceImpl extends ServiceBaseImpl
-                                         implements ExtendedSecurityService,
-                                                    RecordsManagementModel,
-                                                    ApplicationListener<ContextRefreshedEvent>
+        implements ExtendedSecurityService,
+        RecordsManagementModel,
+        ApplicationListener<ContextRefreshedEvent>
 {
     /** ipr group names */
     static final String ROOT_IPR_GROUP = "INPLACE_RECORD_MANAGEMENT";
@@ -95,8 +97,11 @@ public class ExtendedSecurityServiceImpl extends ServiceBaseImpl
     /** transaction service */
     private TransactionService transactionService;
 
+    private boolean enableUsernameNormalization;
+
     /**
-     * @param filePlanService   file plan service
+     * @param filePlanService
+     *            file plan service
      */
     public void setFilePlanService(FilePlanService filePlanService)
     {
@@ -104,7 +109,8 @@ public class ExtendedSecurityServiceImpl extends ServiceBaseImpl
     }
 
     /**
-     * @param filePlanRoleService   file plan role service
+     * @param filePlanRoleService
+     *            file plan role service
      */
     public void setFilePlanRoleService(FilePlanRoleService filePlanRoleService)
     {
@@ -112,7 +118,8 @@ public class ExtendedSecurityServiceImpl extends ServiceBaseImpl
     }
 
     /**
-     * @param authorityService  authority service
+     * @param authorityService
+     *            authority service
      */
     public void setAuthorityService(AuthorityService authorityService)
     {
@@ -120,7 +127,8 @@ public class ExtendedSecurityServiceImpl extends ServiceBaseImpl
     }
 
     /**
-     * @param permissionService permission service
+     * @param permissionService
+     *            permission service
      */
     public void setPermissionService(PermissionService permissionService)
     {
@@ -128,13 +136,23 @@ public class ExtendedSecurityServiceImpl extends ServiceBaseImpl
     }
 
     /**
-     * @param transactionService    transaction service
+     * @param transactionService
+     *            transaction service
      */
     public void setTransactionService(TransactionService transactionService)
     {
         this.transactionService = transactionService;
     }
 
+    /**
+     * @param enableUsernameNormalization
+     *            enable username normalization to ensure correct casing
+     */
+    public void setEnableUsernameNormalization(boolean enableUsernameNormalization)
+    {
+        this.enableUsernameNormalization = enableUsernameNormalization;
+    }
+
     /**
      * Application context refresh event handler
      */
@@ -142,19 +160,17 @@ public class ExtendedSecurityServiceImpl extends ServiceBaseImpl
     public void onApplicationEvent(ContextRefreshedEvent contextRefreshedEvent)
     {
         // run as System on bootstrap
-        AuthenticationUtil.runAs(new RunAsWork<Object>()
-        {
+        AuthenticationUtil.runAs(new RunAsWork<Object>() {
             public Object doWork()
             {
-                RetryingTransactionCallback<Void> callback = new RetryingTransactionCallback<Void>()
-                {
+                RetryingTransactionCallback<Void> callback = new RetryingTransactionCallback<Void>() {
                     public Void execute()
                     {
                         // if the root group doesn't exist then create it
                         if (!authorityService.authorityExists(getRootIRPGroup()))
                         {
                             authorityService.createAuthority(AuthorityType.GROUP, ROOT_IPR_GROUP, ROOT_IPR_GROUP,
-                                        Collections.singleton(RMAuthority.ZONE_APP_RM));
+                                    Collections.singleton(RMAuthority.ZONE_APP_RM));
                         }
                         return null;
                     }
@@ -174,7 +190,7 @@ public class ExtendedSecurityServiceImpl extends ServiceBaseImpl
         return GROUP_PREFIX + ROOT_IPR_GROUP;
     }
 
-	/**
+    /**
      * @see org.alfresco.module.org_alfresco_module_rm.security.ExtendedSecurityService#hasExtendedSecurity(org.alfresco.service.cmr.repository.NodeRef)
      */
     @Override
@@ -224,8 +240,9 @@ public class ExtendedSecurityServiceImpl extends ServiceBaseImpl
     /**
      * Helper to get authorities for a given group
      *
-     * @param group         group name
-     * @return Set<String>  immediate authorities
+     * @param group
+     *            group name
+     * @return Set<String> immediate authorities
      */
     private Set<String> getAuthorities(String group)
     {
@@ -284,8 +301,9 @@ public class ExtendedSecurityServiceImpl extends ServiceBaseImpl
      * <p>
      * Return null if none found.
      *
-     * @param nodeRef                node reference
-     * @return Pair<String, String>  where first is the read group and second if the write group, null if none found
+     * @param nodeRef
+     *            node reference
+     * @return Pair<String, String> where first is the read group and second if the write group, null if none found
      */
     private Pair<String, String> getIPRGroups(NodeRef nodeRef)
     {
@@ -321,17 +339,17 @@ public class ExtendedSecurityServiceImpl extends ServiceBaseImpl
     /**
      * Given a set of readers and writers find or create the appropriate IPR groups.
      * <p>
-     * The IPR groups are named with hashes of the authority lists in order to reduce
-     * the set of groups that require exact match.  A further index is used to handle
-     * a situation where there is a hash clash, but a difference in the authority lists.
+     * The IPR groups are named with hashes of the authority lists in order to reduce the set of groups that require exact match. A further index is used to handle a situation where there is a hash clash, but a difference in the authority lists.
      * <p>
-     * When no match is found the groups are created.  Once created
+     * When no match is found the groups are created. Once created
      *
-     * @param filePlan              file plan
-     * @param readers               authorities with read
-     * @param writers               authorities with write
-     * @return Pair<String, String> where first is the full name of the read group and
-     *                              second is the full name of the write group
+     * @param filePlan
+     *            file plan
+     * @param readers
+     *            authorities with read
+     * @param writers
+     *            authorities with write
+     * @return Pair<String, String> where first is the full name of the read group and second is the full name of the write group
      */
     private Pair<String, String> createOrFindIPRGroups(Set<String> readers, Set<String> writers)
     {
@@ -343,20 +361,28 @@ public class ExtendedSecurityServiceImpl extends ServiceBaseImpl
     /**
      * Create or find an IPR group based on the provided prefix and authorities.
      *
-     * @param groupPrefix   group prefix
-     * @param authorities   authorities
-     * @return String       full group name
+     * @param groupPrefix
+     *            group prefix
+     * @param authorities
+     *            authorities
+     * @return String full group name
      */
     private String createOrFindIPRGroup(String groupPrefix, Set<String> authorities)
     {
         String group = null;
 
+        // If enabled, the authorities are forced to match the correct casing of the usernames in case they were set
+        // with the incorrect casing.
+        // If not, it will just use the authorities as they are.
+        // In normal circumstances, the authorities are in the correct casing, so this is disabled by default.
+        Set<String> authoritySet = normalizeAuthorities(authorities);
+
         // find group or determine what the next index is if no group exists or there is a clash
-        Pair<String, Integer> groupResult = findIPRGroup(groupPrefix, authorities);
+        Pair<String, Integer> groupResult = findIPRGroup(groupPrefix, authoritySet);
 
         if (groupResult.getFirst() == null)
         {
-            group = createIPRGroup(groupPrefix, authorities, groupResult.getSecond());
+            group = createIPRGroup(groupPrefix, authoritySet, groupResult.getSecond());
         }
         else
         {
@@ -369,13 +395,13 @@ public class ExtendedSecurityServiceImpl extends ServiceBaseImpl
     /**
      * Given a group name prefix and the authorities, finds the exact match existing group.
      * <p>
-     * If the group does not exist then the group returned is null and the index shows the next available
-     * group index for creation.
+     * If the group does not exist then the group returned is null and the index shows the next available group index for creation.
      *
-     * @param groupPrefix             group name prefix
-     * @param authorities             authorities
-     * @return Pair<String, Integer>  where first is the name of the found group, null if none found and second
-     *                                if the next available create index
+     * @param groupPrefix
+     *            group name prefix
+     * @param authorities
+     *            authorities
+     * @return Pair<String, Integer> where first is the name of the found group, null if none found and second if the next available create index
      */
     private Pair<String, Integer> findIPRGroup(String groupPrefix, Set<String> authorities)
     {
@@ -391,12 +417,13 @@ public class ExtendedSecurityServiceImpl extends ServiceBaseImpl
         while (hasMoreItems == true)
         {
             // get matching authorities
-            PagingResults<String> results = authorityService.getAuthorities(AuthorityType.GROUP,
-                        RMAuthority.ZONE_APP_RM,
-                        groupShortNamePrefix,
-                        false,
-                        false,
-                        new PagingRequest(MAX_ITEMS*pageCount, MAX_ITEMS));
+            PagingResults<String> results = authorityService.getAuthorities(
+                    AuthorityType.GROUP,
+                    RMAuthority.ZONE_APP_RM,
+                    groupShortNamePrefix,
+                    false,
+                    false,
+                    new PagingRequest(MAX_ITEMS * pageCount, MAX_ITEMS));
 
             // record the total count
             nextGroupIndex = nextGroupIndex + results.getPage().size();
@@ -413,29 +440,88 @@ public class ExtendedSecurityServiceImpl extends ServiceBaseImpl
 
             // determine if there are any more pages to inspect
             hasMoreItems = results.hasMoreItems();
-            pageCount ++;
+            pageCount++;
         }
 
         return new Pair<>(iprGroup, nextGroupIndex);
     }
 
+    /**
+     * Given a set of authorities, normalizes the authority names to ensure correct casing.
+     * 
+     * @param authNames
+     * @return
+     */
+    private Set<String> normalizeAuthorities(Set<String> authNames)
+    {
+        // If disabled or no authorities, return as is
+        if (!enableUsernameNormalization || authNames == null || authNames.isEmpty())
+        {
+            return authNames;
+        }
+
+        Set<String> normalizedAuthorities = new HashSet<>();
+        for (String authorityName : authNames)
+        {
+            normalizedAuthorities.add(normalizeAuthorityName(authorityName));
+        }
+        return normalizedAuthorities;
+    }
+
+    /**
+     * Usernames are case insensitive but affect the IPR group matching when set with different casing. For a given authority of type user, this method normalizes the authority name. If group, it returns the name as-is.
+     *
+     * @param authorityName
+     *            the authority name to normalize
+     * @return the normalized authority name
+     */
+    private String normalizeAuthorityName(String authorityName)
+    {
+        if (authorityName == null || authorityName.startsWith(GROUP_PREFIX))
+        {
+            return authorityName;
+        }
+
+        // For users, attempt to get the correct casing from the username property of the user node
+        if (authorityService.authorityExists(authorityName))
+        {
+            try
+            {
+                NodeRef authorityNodeRef = authorityService.getAuthorityNodeRef(authorityName);
+                if (authorityNodeRef != null)
+                {
+                    String username = (String) nodeService.getProperty(authorityNodeRef, ContentModel.PROP_USERNAME);
+                    return username != null ? username : authorityName;
+                }
+            }
+            catch (Exception e)
+            {
+                // If anything goes wrong, fallback to the original name
+            }
+        }
+
+        return authorityName;
+    }
+
     /**
      * Determines whether a group exactly matches a list of authorities.
      *
-     * @param authorities           list of authorities
-     * @param group                 group
+     * @param authorities
+     *            list of authorities
+     * @param group
+     *            group
      * @return
      */
     private boolean isIPRGroupTrueMatch(String group, Set<String> authorities)
     {
-        //Remove GROUP_EVERYONE for proper comparison as GROUP_EVERYONE is never included in an IPR group
+        // Remove GROUP_EVERYONE for proper comparison as GROUP_EVERYONE is never included in an IPR group
         Set<String> plainAuthorities = new HashSet<String>();
         if (authorities != null)
         {
             plainAuthorities.addAll(authorities);
             plainAuthorities.remove(PermissionService.ALL_AUTHORITIES);
         }
-        Set<String> contained =  authorityService.getContainedAuthorities(null, group, true);
+        Set<String> contained = authorityService.getContainedAuthorities(null, group, true);
         return contained.equals(plainAuthorities);
     }
 
@@ -444,15 +530,17 @@ public class ExtendedSecurityServiceImpl extends ServiceBaseImpl
      * <p>
      * 'package' scope to help testing.
      *
-     * @param prefix        prefix
-     * @param authorities   authorities
-     * @return String       group prefix short name
+     * @param prefix
+     *            prefix
+     * @param authorities
+     *            authorities
+     * @return String group prefix short name
      */
-    /*package*/ String getIPRGroupPrefixShortName(String prefix, Set<String> authorities)
+    /* package */ String getIPRGroupPrefixShortName(String prefix, Set<String> authorities)
     {
         StringBuilder builder = new StringBuilder(128)
-               .append(prefix)
-               .append(getAuthoritySetHashCode(authorities));
+                .append(prefix)
+                .append(getAuthoritySetHashCode(authorities));
 
         return builder.toString();
     }
@@ -464,13 +552,17 @@ public class ExtendedSecurityServiceImpl extends ServiceBaseImpl
      * <p>
      * 'package' scope to help testing.
      *
-     * @param prefix    prefix
-     * @param readers   read authorities
-     * @param writers   write authorities
-     * @param index     group index
-     * @return String   group short name
+     * @param prefix
+     *            prefix
+     * @param readers
+     *            read authorities
+     * @param writers
+     *            write authorities
+     * @param index
+     *            group index
+     * @return String group short name
      */
-    /*package*/ String getIPRGroupShortName(String prefix, Set<String> authorities, int index)
+    /* package */ String getIPRGroupShortName(String prefix, Set<String> authorities, int index)
     {
         return getIPRGroupShortName(prefix, authorities, Integer.toString(index));
     }
@@ -480,17 +572,21 @@ public class ExtendedSecurityServiceImpl extends ServiceBaseImpl
      * <p>
      * Note this excludes the "GROUP_" prefix.
      *
-     * @param prefix    prefix
-     * @param readers   read authorities
-     * @param writers   write authorities
-     * @param index     group index
-     * @return String   group short name
+     * @param prefix
+     *            prefix
+     * @param readers
+     *            read authorities
+     * @param writers
+     *            write authorities
+     * @param index
+     *            group index
+     * @return String group short name
      */
     private String getIPRGroupShortName(String prefix, Set<String> authorities, String index)
     {
         StringBuilder builder = new StringBuilder(128)
-               .append(getIPRGroupPrefixShortName(prefix, authorities))
-               .append(index);
+                .append(getIPRGroupPrefixShortName(prefix, authorities))
+                .append(index);
 
         return builder.toString();
     }
@@ -498,8 +594,9 @@ public class ExtendedSecurityServiceImpl extends ServiceBaseImpl
     /**
      * Gets the hashcode value of a set of authorities.
      *
-     * @param authorities   set of authorities
-     * @return int          hash code
+     * @param authorities
+     *            set of authorities
+     * @return int hash code
      */
     private int getAuthoritySetHashCode(Set<String> authorities)
     {
@@ -514,10 +611,13 @@ public class ExtendedSecurityServiceImpl extends ServiceBaseImpl
     /**
      * Creates a new IPR group.
      *
-     * @param groupNamePrefix   group name prefix
-     * @param children          child authorities
-     * @param index             group index
-     * @return String           full name of created group
+     * @param groupNamePrefix
+     *            group name prefix
+     * @param children
+     *            child authorities
+     * @param index
+     *            group index
+     * @return String full name of created group
      */
     private String createIPRGroup(String groupNamePrefix, Set<String> children, int index)
     {
@@ -547,7 +647,7 @@ public class ExtendedSecurityServiceImpl extends ServiceBaseImpl
                 }
             }
         }
-        catch(DuplicateChildNodeNameException ex)
+        catch (DuplicateChildNodeNameException ex)
         {
             // the group was concurrently created
             group = authorityService.getName(AuthorityType.GROUP, groupShortName);
@@ -559,8 +659,10 @@ public class ExtendedSecurityServiceImpl extends ServiceBaseImpl
     /**
      * Assign IPR groups to a node reference with the correct permissions.
      *
-     * @param iprGroups iprGroups, first read and second write
-     * @param nodeRef   node reference
+     * @param iprGroups
+     *            iprGroups, first read and second write
+     * @param nodeRef
+     *            node reference
      */
     private void assignIPRGroupsToNode(Pair<String, String> iprGroups, NodeRef nodeRef)
     {
@@ -598,7 +700,8 @@ public class ExtendedSecurityServiceImpl extends ServiceBaseImpl
     /**
      * Clear the nodes IPR permissions
      *
-     * @param nodeRef   node reference
+     * @param nodeRef
+     *            node reference
      */
     private void clearPermissions(NodeRef nodeRef, Pair<String, String> iprGroups)
     {
@@ -610,7 +713,9 @@ public class ExtendedSecurityServiceImpl extends ServiceBaseImpl
     /**
      * @see org.alfresco.module.org_alfresco_module_rm.security.DeprecatedExtendedSecurityService#getExtendedReaders(org.alfresco.service.cmr.repository.NodeRef)
      */
-    @Override @Deprecated public Set<String> getExtendedReaders(NodeRef nodeRef)
+    @Override
+    @Deprecated
+    public Set<String> getExtendedReaders(NodeRef nodeRef)
     {
         return getReaders(nodeRef);
     }
@@ -618,7 +723,9 @@ public class ExtendedSecurityServiceImpl extends ServiceBaseImpl
     /**
      * @see org.alfresco.module.org_alfresco_module_rm.security.DeprecatedExtendedSecurityService#getExtendedWriters(org.alfresco.service.cmr.repository.NodeRef)
      */
-    @Override @Deprecated public Set<String> getExtendedWriters(NodeRef nodeRef)
+    @Override
+    @Deprecated
+    public Set<String> getExtendedWriters(NodeRef nodeRef)
     {
         return getWriters(nodeRef);
     }
@@ -626,7 +733,9 @@ public class ExtendedSecurityServiceImpl extends ServiceBaseImpl
     /**
      * @see org.alfresco.module.org_alfresco_module_rm.security.DeprecatedExtendedSecurityService#addExtendedSecurity(org.alfresco.service.cmr.repository.NodeRef, java.util.Set, java.util.Set)
      */
-    @Override @Deprecated public void addExtendedSecurity(NodeRef nodeRef, Set<String> readers, Set<String> writers)
+    @Override
+    @Deprecated
+    public void addExtendedSecurity(NodeRef nodeRef, Set<String> readers, Set<String> writers)
     {
         set(nodeRef, readers, writers);
     }
@@ -634,7 +743,9 @@ public class ExtendedSecurityServiceImpl extends ServiceBaseImpl
     /**
      * @see org.alfresco.module.org_alfresco_module_rm.security.DeprecatedExtendedSecurityService#addExtendedSecurity(org.alfresco.service.cmr.repository.NodeRef, java.util.Set, java.util.Set, boolean)
      */
-    @Override @Deprecated public void addExtendedSecurity(NodeRef nodeRef, Set<String> readers, Set<String> writers, boolean applyToParents)
+    @Override
+    @Deprecated
+    public void addExtendedSecurity(NodeRef nodeRef, Set<String> readers, Set<String> writers, boolean applyToParents)
     {
         set(nodeRef, readers, writers);
     }
@@ -642,7 +753,9 @@ public class ExtendedSecurityServiceImpl extends ServiceBaseImpl
     /**
      * @see org.alfresco.module.org_alfresco_module_rm.security.DeprecatedExtendedSecurityService#removeAllExtendedSecurity(org.alfresco.service.cmr.repository.NodeRef)
      */
-    @Override @Deprecated public void removeAllExtendedSecurity(NodeRef nodeRef)
+    @Override
+    @Deprecated
+    public void removeAllExtendedSecurity(NodeRef nodeRef)
     {
         remove(nodeRef);
     }
@@ -650,7 +763,9 @@ public class ExtendedSecurityServiceImpl extends ServiceBaseImpl
     /**
      * @see org.alfresco.module.org_alfresco_module_rm.security.DeprecatedExtendedSecurityService#removeExtendedSecurity(org.alfresco.service.cmr.repository.NodeRef, java.util.Set, java.util.Set)
      */
-    @Override @Deprecated public void removeExtendedSecurity(NodeRef nodeRef, Set<String> readers, Set<String> writers)
+    @Override
+    @Deprecated
+    public void removeExtendedSecurity(NodeRef nodeRef, Set<String> readers, Set<String> writers)
     {
         remove(nodeRef);
     }
@@ -658,7 +773,9 @@ public class ExtendedSecurityServiceImpl extends ServiceBaseImpl
     /**
      * @see org.alfresco.module.org_alfresco_module_rm.security.DeprecatedExtendedSecurityService#removeExtendedSecurity(org.alfresco.service.cmr.repository.NodeRef, java.util.Set, java.util.Set, boolean)
      */
-    @Override @Deprecated public void removeExtendedSecurity(NodeRef nodeRef, Set<String> readers, Set<String>writers, boolean applyToParents)
+    @Override
+    @Deprecated
+    public void removeExtendedSecurity(NodeRef nodeRef, Set<String> readers, Set<String> writers, boolean applyToParents)
     {
         remove(nodeRef);
     }
@@ -666,7 +783,9 @@ public class ExtendedSecurityServiceImpl extends ServiceBaseImpl
     /**
      * @see org.alfresco.module.org_alfresco_module_rm.security.DeprecatedExtendedSecurityService#removeAllExtendedSecurity(org.alfresco.service.cmr.repository.NodeRef, boolean)
      */
-    @Override @Deprecated public void removeAllExtendedSecurity(NodeRef nodeRef, boolean applyToParents)
+    @Override
+    @Deprecated
+    public void removeAllExtendedSecurity(NodeRef nodeRef, boolean applyToParents)
     {
         remove(nodeRef);
     }

amps/ags/rm-community/rm-community-repo/unit-test/java/org/alfresco/module/org_alfresco_module_rm/security/ExtendedSecurityServiceImplUnitTest.java

@@ -52,6 +52,7 @@ import java.util.Set;
 import java.util.stream.Collectors;
 import java.util.stream.Stream;
 
+import org.alfresco.model.ContentModel;
 import org.alfresco.model.RenditionModel;
 import org.alfresco.module.org_alfresco_module_rm.capability.RMPermissionModel;
 import org.alfresco.module.org_alfresco_module_rm.fileplan.FilePlanService;
@@ -67,6 +68,7 @@ import org.alfresco.repo.transaction.RetryingTransactionHelper.RetryingTransacti
 import org.alfresco.service.cmr.repository.ChildAssociationRef;
 import org.alfresco.service.cmr.repository.NodeRef;
 import org.alfresco.service.cmr.repository.NodeService;
+import org.alfresco.service.cmr.repository.StoreRef;
 import org.alfresco.service.cmr.security.AccessPermission;
 import org.alfresco.service.cmr.security.AccessStatus;
 import org.alfresco.service.cmr.security.AuthorityService;
@@ -522,6 +524,104 @@ public class ExtendedSecurityServiceImplUnitTest
         verify(mockedPermissionService).setPermission(nodeRef, writeGroup, RMPermissionModel.FILING, true);
         
     }
+
+    /**
+     * Given a node with no previous IPR groups assigned
+     * And having pre-existing IPR groups matching the ones we need
+     * When I add some read and write authorities but with a different casing
+     * Then the existing IPR groups are used
+     */
+    @SuppressWarnings("unchecked")
+    @Test public void addExtendedSecurityWithMixedCasingUsernames()
+    {
+        // Have the usernames in the node as the correct usernames but with incorrect casing
+        String user1 = "UseR";
+        String user2 = "UseR_w";
+
+        // Incorrect IPR Group names
+        Set<String> diffCasingReaders = Stream.of(user1, GROUP).collect(Collectors.toSet());
+        Set<String> diffCasingWriters = Stream.of(user2, GROUP_W).collect(Collectors.toSet());
+        String wrongReadGroupPrefix = extendedSecurityService.getIPRGroupPrefixShortName(READER_GROUP_PREFIX, diffCasingReaders);
+        String wrongWriteGroupPrefix = extendedSecurityService.getIPRGroupPrefixShortName(WRITER_GROUP_PREFIX, diffCasingWriters);
+        String wrongReadGroup = wrongReadGroupPrefix + "0";
+        String wrongWriteGroup = wrongWriteGroupPrefix + "0";
+
+        // Correct Group names
+        String correctReadGroup = readGroupPrefix + "0";
+        String correctWriteGroup = writeGroupPrefix + "0";
+
+        // If queried for the correct groups, return the results
+        PagingResults<String> mockedCorrectReadPResults = mock(PagingResults.class);
+        PagingResults<String> mockedCorrectWritePResults = mock(PagingResults.class);
+        when(mockedCorrectReadPResults.getPage())
+            .thenReturn(Stream.of(GROUP_PREFIX + correctReadGroup).collect(Collectors.toList()));
+        when(mockedAuthorityService.getAuthorities(
+                eq(AuthorityType.GROUP), 
+                eq(RMAuthority.ZONE_APP_RM), 
+                eq(readGroupPrefix),
+                eq(false), 
+                eq(false), 
+                any(PagingRequest.class)))
+            .thenReturn(mockedCorrectReadPResults);
+        
+        when(mockedCorrectWritePResults.getPage())
+            .thenReturn(Stream.of(GROUP_PREFIX + correctWriteGroup).collect(Collectors.toList()));
+        when(mockedAuthorityService.getAuthorities(
+                eq(AuthorityType.GROUP), 
+                eq(RMAuthority.ZONE_APP_RM), 
+                eq(writeGroupPrefix),
+                eq(false), 
+                eq(false), 
+                any(PagingRequest.class)))
+            .thenReturn(mockedCorrectWritePResults);
+
+        // Don't return results for the incorrect groups (lenient as these may not be called with normalization enabled)
+        PagingResults<String> mockedWrongReadPResults = mock(PagingResults.class);
+        PagingResults<String> mockedWrongWritePResults = mock(PagingResults.class);
+        lenient().when(mockedWrongReadPResults.getPage())
+            .thenReturn(Collections.emptyList());
+        lenient().when(mockedAuthorityService.getAuthorities(
+                eq(AuthorityType.GROUP), 
+                eq(RMAuthority.ZONE_APP_RM), 
+                eq(wrongReadGroupPrefix),
+                eq(false), 
+                eq(false), 
+                any(PagingRequest.class)))
+            .thenReturn(mockedWrongReadPResults);
+        
+        lenient().when(mockedWrongWritePResults.getPage())
+            .thenReturn(Collections.emptyList());
+        lenient().when(mockedAuthorityService.getAuthorities(
+                eq(AuthorityType.GROUP), 
+                eq(RMAuthority.ZONE_APP_RM), 
+                eq(wrongWriteGroupPrefix),
+                eq(false), 
+                eq(false), 
+                any(PagingRequest.class)))
+            .thenReturn(mockedWrongWritePResults);
+
+        // The users do exist, despite being in a different casing and are able to be retrieved
+        NodeRef noderefUser1 = new NodeRef(StoreRef.STORE_REF_WORKSPACE_SPACESSTORE, USER);
+        when(mockedAuthorityService.authorityExists(user1)).thenReturn(true);
+        when(mockedAuthorityService.getAuthorityNodeRef(user1)).thenReturn(noderefUser1);
+        when(mockedNodeService.getProperty(noderefUser1, ContentModel.PROP_USERNAME)).thenReturn(USER);
+
+        NodeRef noderefUser2 = new NodeRef(StoreRef.STORE_REF_WORKSPACE_SPACESSTORE, USER_W);
+        when(mockedAuthorityService.authorityExists(user2)).thenReturn(true);
+        when(mockedAuthorityService.getAuthorityNodeRef(user2)).thenReturn(noderefUser2);
+        when(mockedNodeService.getProperty(noderefUser2, ContentModel.PROP_USERNAME)).thenReturn(USER_W);
+
+        // Set the extended security service to normalize usernames
+        extendedSecurityService.setEnableUsernameNormalization(true);
+        extendedSecurityService.set(nodeRef, diffCasingReaders, diffCasingWriters);
+
+        // Verify that the incorrect read group is not created
+        verify(mockedAuthorityService, never()).createAuthority(AuthorityType.GROUP, wrongReadGroup, wrongReadGroup, Collections.singleton(RMAuthority.ZONE_APP_RM));
+
+        // Verify that the incorrect write group is not created
+        verify(mockedAuthorityService, never()).createAuthority(AuthorityType.GROUP, wrongWriteGroup, wrongWriteGroup, Collections.singleton(RMAuthority.ZONE_APP_RM));
+
+    }
     
     /**
      * Given a node with no previous IPR groups assigned
@@ -571,7 +671,7 @@ public class ExtendedSecurityServiceImplUnitTest
             .thenReturn(Stream
                 .of(USER_W, AlfMock.generateText())
                 .collect(Collectors.toSet()));
-        
+
         // add extended security
         extendedSecurityService.set(nodeRef, READERS, WRITERS);
         
@@ -895,7 +995,7 @@ public class ExtendedSecurityServiceImplUnitTest
         // group names
         String readGroup = extendedSecurityService.getIPRGroupShortName(READER_GROUP_FULL_PREFIX, READERS, 0);
         String writeGroup = extendedSecurityService.getIPRGroupShortName(WRITER_GROUP_FULL_PREFIX, WRITERS, 0);
-        
+
         // setup renditions
         NodeRef renditionNodeRef = AlfMock.generateNodeRef(mockedNodeService);
         when(mockedNodeService.hasAspect(nodeRef, RecordsManagementModel.ASPECT_RECORD))
@@ -904,7 +1004,7 @@ public class ExtendedSecurityServiceImplUnitTest
             .thenReturn(renditionNodeRef);
         when(mockedNodeService.getChildAssocs(nodeRef, RenditionModel.ASSOC_RENDITION, RegexQNamePattern.MATCH_ALL))
             .thenReturn(Collections.singletonList(mockedChildAssociationRef));        
-        
+
         // setup permissions
         Set<AccessPermission> permissions = Stream
             .of(new AccessPermissionImpl(AlfMock.generateText(), AccessStatus.ALLOWED, readGroup, 0),
@@ -913,17 +1013,17 @@ public class ExtendedSecurityServiceImplUnitTest
             .collect(Collectors.toSet());        
         when(mockedPermissionService.getAllSetPermissions(nodeRef))
             .thenReturn(permissions);      
-        
+
         // remove extended security
         extendedSecurityService.remove(nodeRef);
-        
+
         // verify that the groups permissions have been removed
         verify(mockedPermissionService).clearPermission(nodeRef, readGroup);
         verify(mockedPermissionService).clearPermission(nodeRef, writeGroup);
-        
+
         // verify that the groups permissions have been removed from the rendition
         verify(mockedPermissionService).clearPermission(renditionNodeRef, readGroup);
         verify(mockedPermissionService).clearPermission(renditionNodeRef, writeGroup);
-        
+
     }
-}
+}

amps/ags/rm-community/rm-community-rest-api-explorer/pom.xml

@@ -7,7 +7,7 @@
     <parent>
         <groupId>org.alfresco</groupId>
         <artifactId>alfresco-governance-services-community-repo-parent</artifactId>
-        <version>23.3.5.1</version>
+        <version>23.3.14.1</version>
     </parent>
 
     <build>

amps/pom.xml

@@ -7,7 +7,7 @@
     <parent>
         <groupId>org.alfresco</groupId>
         <artifactId>alfresco-community-repo</artifactId>
-        <version>23.3.5.1</version>
+        <version>23.3.14.1</version>
     </parent>
 
     <modules>

amps/share-services/pom.xml

@@ -8,7 +8,7 @@
     <parent>
         <groupId>org.alfresco</groupId>
         <artifactId>alfresco-community-repo-amps</artifactId>
-        <version>23.3.5.1</version>
+        <version>23.3.14.1</version>
     </parent>
 
     <properties>

core/pom.xml

@@ -7,7 +7,7 @@
    <parent>
       <groupId>org.alfresco</groupId>
       <artifactId>alfresco-community-repo</artifactId>
-      <version>23.3.5.1</version>
+      <version>23.3.14.1</version>
    </parent>
 
    <dependencies>

data-model/pom.xml

@@ -7,7 +7,7 @@
     <parent>
         <groupId>org.alfresco</groupId>
         <artifactId>alfresco-community-repo</artifactId>
-        <version>23.3.5.1</version>
+        <version>23.3.14.1</version>
     </parent>
 
     <properties>

mmt/pom.xml

@@ -7,7 +7,7 @@
     <parent>
         <groupId>org.alfresco</groupId>
         <artifactId>alfresco-community-repo</artifactId>
-        <version>23.3.5.1</version>
+        <version>23.3.14.1</version>
     </parent>
 
     <dependencies>

packaging/distribution/pom.xml

@@ -9,6 +9,6 @@
     <parent>
         <groupId>org.alfresco</groupId>
         <artifactId>alfresco-community-repo-packaging</artifactId>
-        <version>23.3.5.1</version>
+        <version>23.3.14.1</version>
     </parent>
 </project>

packaging/docker-alfresco/pom.xml

@@ -7,7 +7,7 @@
     <parent>
         <groupId>org.alfresco</groupId>
         <artifactId>alfresco-community-repo-packaging</artifactId>
-        <version>23.3.5.1</version>
+        <version>23.3.14.1</version>
     </parent>
 
     <properties>

packaging/pom.xml

@@ -7,7 +7,7 @@
     <parent>
         <groupId>org.alfresco</groupId>
         <artifactId>alfresco-community-repo</artifactId>
-        <version>23.3.5.1</version>
+        <version>23.3.14.1</version>
     </parent>
 
     <modules>

packaging/tests/pom.xml

@@ -6,7 +6,7 @@
     <parent>
         <groupId>org.alfresco</groupId>
         <artifactId>alfresco-community-repo-packaging</artifactId>
-        <version>23.3.5.1</version>
+        <version>23.3.14.1</version>
     </parent>
 
     <modules>

packaging/tests/tas-cmis/pom.xml

@@ -7,7 +7,7 @@
     <parent>
         <groupId>org.alfresco</groupId>
         <artifactId>alfresco-community-repo-tests</artifactId>
-        <version>23.3.5.1</version>
+        <version>23.3.14.1</version>
     </parent>
 
     <organization>

packaging/tests/tas-email/pom.xml

@@ -9,7 +9,7 @@
     <parent>
         <groupId>org.alfresco</groupId>
         <artifactId>alfresco-community-repo-tests</artifactId>
-        <version>23.3.5.1</version>
+        <version>23.3.14.1</version>
     </parent>
 
     <developers>

packaging/tests/tas-integration/pom.xml

@@ -9,7 +9,7 @@
     <parent>
         <groupId>org.alfresco</groupId>
         <artifactId>alfresco-community-repo-tests</artifactId>
-        <version>23.3.5.1</version>
+        <version>23.3.14.1</version>
     </parent>
 
     <developers>

packaging/tests/tas-restapi/pom.xml

@@ -8,7 +8,7 @@
     <parent>
         <groupId>org.alfresco</groupId>
         <artifactId>alfresco-community-repo-tests</artifactId>
-        <version>23.3.5.1</version>
+        <version>23.3.14.1</version>
     </parent>
 
     <properties>

packaging/tests/tas-webdav/pom.xml

@@ -9,7 +9,7 @@
     <parent>
         <groupId>org.alfresco</groupId>
         <artifactId>alfresco-community-repo-tests</artifactId>
-        <version>23.3.5.1</version>
+        <version>23.3.14.1</version>
     </parent>
 
     <developers>

packaging/war/pom.xml

@@ -7,7 +7,7 @@
     <parent>
         <groupId>org.alfresco</groupId>
         <artifactId>alfresco-community-repo-packaging</artifactId>
-        <version>23.3.5.1</version>
+        <version>23.3.14.1</version>
     </parent>
 
     <properties>

pom.xml

@@ -2,7 +2,7 @@
 <project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
     <modelVersion>4.0.0</modelVersion>
     <artifactId>alfresco-community-repo</artifactId>
-    <version>23.3.5.1</version>
+    <version>23.3.14.1</version>
     <packaging>pom</packaging>
     <name>Alfresco Community Repo Parent</name>
 
@@ -25,7 +25,7 @@
     <properties>
         <acs.version.major>23</acs.version.major>
         <acs.version.minor>3</acs.version.minor>
-        <acs.version.revision>5</acs.version.revision>
+        <acs.version.revision>14</acs.version.revision>
         <acs.version.label />
         <amp.min.version>${acs.version.major}.0.0</amp.min.version>
 
@@ -154,7 +154,7 @@
         <connection>scm:git:https://github.com/Alfresco/alfresco-community-repo.git</connection>
         <developerConnection>scm:git:https://github.com/Alfresco/alfresco-community-repo.git</developerConnection>
         <url>https://github.com/Alfresco/alfresco-community-repo</url>
-        <tag>23.3.5.1</tag>
+        <tag>23.3.14.1</tag>
     </scm>
 
     <distributionManagement>

remote-api/pom.xml

@@ -7,7 +7,7 @@
     <parent>
         <groupId>org.alfresco</groupId>
         <artifactId>alfresco-community-repo</artifactId>
-        <version>23.3.5.1</version>
+        <version>23.3.14.1</version>
     </parent>
 
     <dependencies>

repository/pom.xml

@@ -7,7 +7,7 @@
     <parent>
         <groupId>org.alfresco</groupId>
         <artifactId>alfresco-community-repo</artifactId>
-        <version>23.3.5.1</version>
+        <version>23.3.14.1</version>
     </parent>
 
     <dependencies>

repository/src/main/java/org/alfresco/repo/action/executer/AddFeaturesActionExecuter.java

@@ -2,93 +2,96 @@
  * #%L
  * Alfresco Repository
  * %%
- * Copyright (C) 2005 - 2016 Alfresco Software Limited
+ * Copyright (C) 2005 - 2025 Alfresco Software Limited
  * %%
- * This file is part of the Alfresco software. 
- * If the software was purchased under a paid Alfresco license, the terms of 
- * the paid license agreement will prevail.  Otherwise, the software is 
+ * This file is part of the Alfresco software.
+ * If the software was purchased under a paid Alfresco license, the terms of
+ * the paid license agreement will prevail.  Otherwise, the software is
  * provided under the following open source license terms:
- * 
+ *
  * Alfresco is free software: you can redistribute it and/or modify
  * it under the terms of the GNU Lesser General Public License as published by
  * the Free Software Foundation, either version 3 of the License, or
  * (at your option) any later version.
- * 
+ *
  * Alfresco is distributed in the hope that it will be useful,
  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  * GNU Lesser General Public License for more details.
- * 
+ *
  * You should have received a copy of the GNU Lesser General Public License
  * along with Alfresco. If not, see <http://www.gnu.org/licenses/>.
  * #L%
  */
-package org.alfresco.repo.action.executer;
-
-import java.io.Serializable;
-import java.util.HashMap;
-import java.util.List;
-import java.util.Map;
-
-import org.alfresco.repo.action.ParameterDefinitionImpl;
-import org.alfresco.repo.transaction.RetryingTransactionHelper.RetryingTransactionCallback;
-import org.alfresco.service.cmr.action.Action;
-import org.alfresco.service.cmr.action.ParameterDefinition;
-import org.alfresco.service.cmr.dictionary.DataTypeDefinition;
-import org.alfresco.service.cmr.repository.NodeRef;
-import org.alfresco.service.cmr.repository.NodeService;
-import org.alfresco.service.namespace.QName;
-import org.alfresco.service.transaction.TransactionService;
-
-/**
- * Add features action executor implementation.
- * 
- * @author Roy Wetherall
- */
-public class AddFeaturesActionExecuter extends ActionExecuterAbstractBase
-{
-    /**
-     * Action constants
-     */
-    public static final String NAME = "add-features";
-    public static final String PARAM_ASPECT_NAME = "aspect-name";
-    public static final String PARAM_CONSTRAINT = "ac-aspects";
-    
-    /**
-     * The node service
-     */
-    private NodeService nodeService;
-    
-    /** Transaction Service, used for retrying operations */
-    private TransactionService transactionService;
-    
-    /**
-     * Set the node service
-     * 
-     * @param nodeService  the node service 
-     */
-    public void setNodeService(NodeService nodeService) 
-    {
-        this.nodeService = nodeService;
-    }
-    
-    /**
-     * Set the transaction service
-     * 
-     * @param transactionService    the transaction service
-     */
-    public void setTransactionService(TransactionService transactionService)
-    {
-        this.transactionService = transactionService;
-    }
-    
-    /**
-     * Adhoc properties are allowed for this executor
-     */
-    @Override
-    protected boolean getAdhocPropertiesAllowed()
-    {
-        return true;
+package org.alfresco.repo.action.executer;
+
+import java.io.Serializable;
+import java.util.HashMap;
+import java.util.List;
+import java.util.Map;
+
+import org.alfresco.repo.action.ParameterDefinitionImpl;
+import org.alfresco.repo.action.access.ActionAccessRestriction;
+import org.alfresco.repo.transaction.RetryingTransactionHelper.RetryingTransactionCallback;
+import org.alfresco.service.cmr.action.Action;
+import org.alfresco.service.cmr.action.ParameterDefinition;
+import org.alfresco.service.cmr.dictionary.DataTypeDefinition;
+import org.alfresco.service.cmr.repository.NodeRef;
+import org.alfresco.service.cmr.repository.NodeService;
+import org.alfresco.service.namespace.QName;
+import org.alfresco.service.transaction.TransactionService;
+
+/**
+ * Add features action executor implementation.
+ *
+ * @author Roy Wetherall
+ */
+public class AddFeaturesActionExecuter extends ActionExecuterAbstractBase
+{
+    /**
+     * Action constants
+     */
+    public static final String NAME = "add-features";
+    public static final String PARAM_ASPECT_NAME = "aspect-name";
+    public static final String PARAM_CONSTRAINT = "ac-aspects";
+
+    /**
+     * The node service
+     */
+    private NodeService nodeService;
+
+    /** Transaction Service, used for retrying operations */
+    private TransactionService transactionService;
+
+    /**
+     * Set the node service
+     *
+     * @param nodeService
+     *            the node service
+     */
+    public void setNodeService(NodeService nodeService)
+    {
+        this.nodeService = nodeService;
+    }
+
+    /**
+     * Set the transaction service
+     *
+     * @param transactionService
+     *            the transaction service
+     */
+    public void setTransactionService(TransactionService transactionService)
+    {
+        this.transactionService = transactionService;
+    }
+
+    /**
+     * Adhoc properties are allowed for this executor
+     */
+    @Override
+    protected boolean getAdhocPropertiesAllowed()
+    {
+        return true;
     }
 
     /**
@@ -96,55 +99,61 @@ public class AddFeaturesActionExecuter extends ActionExecuterAbstractBase
      */
     public void executeImpl(final Action ruleAction, final NodeRef actionedUponNodeRef)
     {
-        if (this.nodeService.exists(actionedUponNodeRef))
-        {
-           transactionService.getRetryingTransactionHelper().doInTransaction(
-              new RetryingTransactionCallback<Void>()
-              {
-                 public Void execute() throws Throwable
-                 {
-                     Map<QName, Serializable> properties = new HashMap<QName, Serializable>();
-                     QName aspectQName = null;
-
-                     if(! nodeService.exists(actionedUponNodeRef))
-                     {
-                         // Node has gone away, skip
-                         return null;
-                     }
-
-                     // Build the aspect details
-                     Map<String, Serializable> paramValues = ruleAction.getParameterValues();
-                     for (Map.Entry<String, Serializable> entry : paramValues.entrySet())
-                     {
-                         if (entry.getKey().equals(PARAM_ASPECT_NAME) == true)
-                         {
-                             aspectQName = (QName)entry.getValue();
-                         }
-                         else
-                         {
-                             // Must be an adhoc property
-                             QName propertyQName = QName.createQName(entry.getKey());
-                             Serializable propertyValue = entry.getValue();
-                             properties.put(propertyQName, propertyValue);
-                         }
-                     }
-
-                     // Add the aspect
-                     nodeService.addAspect(actionedUponNodeRef, aspectQName, properties);
-                     return null;
-                 }
-              }
-           );
-        }
-    }
-
-    /**
-     * @see org.alfresco.repo.action.ParameterizedItemAbstractBase#addParameterDefinitions(java.util.List)
-     */
-    @Override
-    protected void addParameterDefinitions(List<ParameterDefinition> paramList) 
-    {
-        paramList.add(new ParameterDefinitionImpl(PARAM_ASPECT_NAME, DataTypeDefinition.QNAME, true, getParamDisplayLabel(PARAM_ASPECT_NAME), false, "ac-aspects"));
-    }
-
-}
+        if (this.nodeService.exists(actionedUponNodeRef))
+        {
+            transactionService.getRetryingTransactionHelper().doInTransaction(
+                    new RetryingTransactionCallback<Void>() {
+                        public Void execute() throws Throwable
+                        {
+                            Map<QName, Serializable> properties = new HashMap<QName, Serializable>();
+                            QName aspectQName = null;
+
+                            if (!nodeService.exists(actionedUponNodeRef))
+                            {
+                                // Node has gone away, skip
+                                return null;
+                            }
+
+                            // Build the aspect details
+                            Map<String, Serializable> paramValues = ruleAction.getParameterValues();
+                            removeActionContextParameter(paramValues);
+                            for (Map.Entry<String, Serializable> entry : paramValues.entrySet())
+                            {
+                                if (entry.getKey().equals(PARAM_ASPECT_NAME) == true)
+                                {
+                                    aspectQName = (QName) entry.getValue();
+                                }
+                                else
+                                {
+                                    // Must be an adhoc property
+                                    QName propertyQName = QName.createQName(entry.getKey());
+                                    Serializable propertyValue = entry.getValue();
+                                    properties.put(propertyQName, propertyValue);
+                                }
+                            }
+
+                            // Add the aspect
+                            nodeService.addAspect(actionedUponNodeRef, aspectQName, properties);
+                            return null;
+                        }
+                    });
+        }
+    }
+
+    /**
+     * @see org.alfresco.repo.action.ParameterizedItemAbstractBase#addParameterDefinitions(java.util.List)
+     */
+    @Override
+    protected void addParameterDefinitions(List<ParameterDefinition> paramList)
+    {
+        paramList.add(new ParameterDefinitionImpl(PARAM_ASPECT_NAME, DataTypeDefinition.QNAME, true, getParamDisplayLabel(PARAM_ASPECT_NAME), false, "ac-aspects"));
+    }
+
+    /**
+     * Remove actionContext from the parameter values to declassify as an adhoc property
+     */
+    private void removeActionContextParameter(Map<String, Serializable> paramValues)
+    {
+        paramValues.remove(ActionAccessRestriction.ACTION_CONTEXT_PARAM_NAME);
+    }
+}

repository/src/main/java/org/alfresco/repo/event2/NodeResourceHelper.java

@@ -2,7 +2,7 @@
  * #%L
  * Alfresco Repository
  * %%
- * Copyright (C) 2005 - 2023 Alfresco Software Limited
+ * Copyright (C) 2005 - 2025 Alfresco Software Limited
  * %%
  * This file is part of the Alfresco software.
  * If the software was purchased under a paid Alfresco license, the terms of
@@ -42,6 +42,9 @@ import java.util.Set;
 import java.util.stream.Collectors;
 
 import com.google.common.collect.Sets;
+import org.apache.commons.logging.Log;
+import org.apache.commons.logging.LogFactory;
+import org.springframework.beans.factory.InitializingBean;
 
 import org.alfresco.model.ContentModel;
 import org.alfresco.repo.event.v1.model.ContentInfo;
@@ -50,6 +53,7 @@ import org.alfresco.repo.event.v1.model.UserInfo;
 import org.alfresco.repo.event2.filter.EventFilterRegistry;
 import org.alfresco.repo.event2.filter.NodeAspectFilter;
 import org.alfresco.repo.event2.filter.NodePropertyFilter;
+import org.alfresco.repo.event2.mapper.PropertyMapper;
 import org.alfresco.repo.node.MLPropertyInterceptor;
 import org.alfresco.repo.security.authentication.AuthenticationUtil;
 import org.alfresco.repo.security.permissions.AccessDeniedException;
@@ -68,9 +72,6 @@ import org.alfresco.service.namespace.NamespaceService;
 import org.alfresco.service.namespace.QName;
 import org.alfresco.util.PathUtil;
 import org.alfresco.util.PropertyCheck;
-import org.apache.commons.logging.Log;
-import org.apache.commons.logging.LogFactory;
-import org.springframework.beans.factory.InitializingBean;
 
 /**
  * Helper for {@link NodeResource} objects.
@@ -81,14 +82,15 @@ public class NodeResourceHelper implements InitializingBean
 {
     private static final Log LOGGER = LogFactory.getLog(NodeResourceHelper.class);
 
-    protected NodeService         nodeService;
-    protected DictionaryService   dictionaryService;
-    protected PersonService       personService;
+    protected NodeService nodeService;
+    protected DictionaryService dictionaryService;
+    protected PersonService personService;
     protected EventFilterRegistry eventFilterRegistry;
-    protected NamespaceService    namespaceService;
-    protected PermissionService   permissionService;
+    protected NamespaceService namespaceService;
+    protected PermissionService permissionService;
+    protected PropertyMapper propertyMapper;
 
-    private NodeAspectFilter   nodeAspectFilter;
+    private NodeAspectFilter nodeAspectFilter;
     private NodePropertyFilter nodePropertyFilter;
 
     @Override
@@ -100,6 +102,7 @@ public class NodeResourceHelper implements InitializingBean
         PropertyCheck.mandatory(this, "eventFilterRegistry", eventFilterRegistry);
         PropertyCheck.mandatory(this, "namespaceService", namespaceService);
         PropertyCheck.mandatory(this, "permissionService", permissionService);
+        PropertyCheck.mandatory(this, "propertyMapper", propertyMapper);
 
         this.nodeAspectFilter = eventFilterRegistry.getNodeAspectFilter();
         this.nodePropertyFilter = eventFilterRegistry.getNodePropertyFilter();
@@ -124,7 +127,7 @@ public class NodeResourceHelper implements InitializingBean
     {
         this.permissionService = permissionService;
     }
-    
+
     // To make IntelliJ stop complaining about unused method!
     @SuppressWarnings("unused")
     public void setEventFilterRegistry(EventFilterRegistry eventFilterRegistry)
@@ -137,6 +140,11 @@ public class NodeResourceHelper implements InitializingBean
         this.namespaceService = namespaceService;
     }
 
+    public void setPropertyMapper(PropertyMapper propertyMapper)
+    {
+        this.propertyMapper = propertyMapper;
+    }
+
     public NodeResource.Builder createNodeResourceBuilder(NodeRef nodeRef)
     {
         final QName type = nodeService.getType(nodeRef);
@@ -148,22 +156,22 @@ public class NodeResourceHelper implements InitializingBean
         Map<String, UserInfo> mapUserCache = new HashMap<>(2);
 
         return NodeResource.builder()
-            .setId(nodeRef.getId())
-            .setName((String) properties.get(ContentModel.PROP_NAME))
-            .setNodeType(getQNamePrefixString(type))
-            .setIsFile(isSubClass(type, ContentModel.TYPE_CONTENT))
-            .setIsFolder(isSubClass(type, ContentModel.TYPE_FOLDER))
-            .setCreatedByUser(getUserInfo((String) properties.get(ContentModel.PROP_CREATOR), mapUserCache))
-            .setCreatedAt(getZonedDateTime((Date)properties.get(ContentModel.PROP_CREATED)))
-            .setModifiedByUser(getUserInfo((String) properties.get(ContentModel.PROP_MODIFIER), mapUserCache))
-            .setModifiedAt(getZonedDateTime((Date)properties.get(ContentModel.PROP_MODIFIED)))
-            .setContent(getContentInfo(properties))
-            .setPrimaryAssocQName(getPrimaryAssocQName(nodeRef))
-            .setPrimaryHierarchy(PathUtil.getNodeIdsInReverse(path, false))
-            .setProperties(mapToNodeProperties(properties))
-            .setLocalizedProperties(mapToNodeLocalizedProperties(properties))
-            .setAspectNames(getMappedAspects(nodeRef))
-            .setSecondaryParents(getSecondaryParents(nodeRef));
+                .setId(nodeRef.getId())
+                .setName((String) properties.get(ContentModel.PROP_NAME))
+                .setNodeType(getQNamePrefixString(type))
+                .setIsFile(isSubClass(type, ContentModel.TYPE_CONTENT))
+                .setIsFolder(isSubClass(type, ContentModel.TYPE_FOLDER))
+                .setCreatedByUser(getUserInfo((String) properties.get(ContentModel.PROP_CREATOR), mapUserCache))
+                .setCreatedAt(getZonedDateTime((Date) properties.get(ContentModel.PROP_CREATED)))
+                .setModifiedByUser(getUserInfo((String) properties.get(ContentModel.PROP_MODIFIER), mapUserCache))
+                .setModifiedAt(getZonedDateTime((Date) properties.get(ContentModel.PROP_MODIFIED)))
+                .setContent(getContentInfo(properties))
+                .setPrimaryAssocQName(getPrimaryAssocQName(nodeRef))
+                .setPrimaryHierarchy(PathUtil.getNodeIdsInReverse(path, false))
+                .setProperties(mapToNodeProperties(properties))
+                .setLocalizedProperties(mapToNodeLocalizedProperties(properties))
+                .setAspectNames(getMappedAspects(nodeRef))
+                .setSecondaryParents(getSecondaryParents(nodeRef));
     }
 
     private boolean isSubClass(QName className, QName ofClassQName)
@@ -171,17 +179,18 @@ public class NodeResourceHelper implements InitializingBean
         return dictionaryService.isSubClass(className, ofClassQName);
     }
 
-    private String getPrimaryAssocQName(NodeRef nodeRef) 
+    private String getPrimaryAssocQName(NodeRef nodeRef)
     {
         String result = null;
-        try 
+        try
         {
             ChildAssociationRef primaryParent = nodeService.getPrimaryParent(nodeRef);
-            if(primaryParent != null && primaryParent.getQName() != null) 
+            if (primaryParent != null && primaryParent.getQName() != null)
             {
                 result = primaryParent.getQName().getPrefixedQName(namespaceService).getPrefixString();
             }
-        } catch (NamespaceException namespaceException) 
+        }
+        catch (NamespaceException namespaceException)
         {
             LOGGER.error("Cannot return a valid primary association QName: " + namespaceException.getMessage());
         }
@@ -215,8 +224,8 @@ public class NodeResourceHelper implements InitializingBean
                 {
                     v = ((MLText) v).getDefaultValue();
                 }
-
-                filteredProps.put(getQNamePrefixString(k), v);
+                Serializable mappedValue = propertyMapper.map(k, v);
+                filteredProps.put(getQNamePrefixString(k), mappedValue);
             }
         });
 
@@ -232,7 +241,10 @@ public class NodeResourceHelper implements InitializingBean
             {
                 final MLText mlTextValue = (MLText) v;
                 final HashMap<String, String> localizedValues = new HashMap<>(mlTextValue.size());
-                mlTextValue.forEach((locale, text) -> localizedValues.put(locale.toString(), text));
+                mlTextValue.forEach((locale, text) -> {
+                    Serializable mappedValue = propertyMapper.map(k, text);
+                    localizedValues.put(locale.toString(), (String) mappedValue);
+                });
                 filteredProps.put(getQNamePrefixString(k), localizedValues);
             }
         });
@@ -259,7 +271,7 @@ public class NodeResourceHelper implements InitializingBean
         {
             String sysUserName = AuthenticationUtil.getSystemUserName();
             if (userName.equals(sysUserName) || (AuthenticationUtil.isMtEnabled()
-                        && userName.startsWith(sysUserName + "@")))
+                    && userName.startsWith(sysUserName + "@")))
             {
                 userInfo = new UserInfo(userName, userName, "");
             }
@@ -306,11 +318,11 @@ public class NodeResourceHelper implements InitializingBean
     }
 
     /**
-     * Returns the QName in the format prefix:local, but in the exceptional case where there is no registered prefix
-     * returns it in the form {uri}local.
+     * Returns the QName in the format prefix:local, but in the exceptional case where there is no registered prefix returns it in the form {uri}local.
      *
-     * @param   k QName
-     * @return  a String representing the QName in the format prefix:local or {uri}local.
+     * @param k
+     *            QName
+     * @return a String representing the QName in the format prefix:local or {uri}local.
      */
     public String getQNamePrefixString(QName k)
     {
@@ -342,7 +354,7 @@ public class NodeResourceHelper implements InitializingBean
 
     public QName getNodeType(NodeRef nodeRef)
     {
-       return nodeService.getType(nodeRef);
+        return nodeService.getType(nodeRef);
     }
 
     public Serializable getProperty(NodeRef nodeRef, QName qName)
@@ -352,13 +364,14 @@ public class NodeResourceHelper implements InitializingBean
 
     public Map<QName, Serializable> getProperties(NodeRef nodeRef)
     {
-        //We need to have full MLText properties here. This is why we are marking the current thread as MLAware
+        // We need to have full MLText properties here. This is why we are marking the current thread as MLAware
         final boolean toRestore = MLPropertyInterceptor.isMLAware();
         MLPropertyInterceptor.setMLAware(true);
         try
         {
             return nodeService.getProperties(nodeRef);
-        } finally
+        }
+        finally
         {
             MLPropertyInterceptor.setMLAware(toRestore);
         }
@@ -377,7 +390,7 @@ public class NodeResourceHelper implements InitializingBean
     }
 
     static Map<String, Map<String, String>> getLocalizedPropertiesBefore(Map<String, Map<String, String>> locPropsBefore,
-                                                                         Map<String, Map<String, String>> locPropsAfter)
+            Map<String, Map<String, String>> locPropsAfter)
     {
         final Map<String, Map<String, String>> result = new HashMap<>(locPropsBefore.size());
 
@@ -410,7 +423,7 @@ public class NodeResourceHelper implements InitializingBean
     {
         return mapToNodeAspects(nodeService.getAspects(nodeRef));
     }
-    
+
     public List<String> getPrimaryHierarchy(NodeRef nodeRef, boolean showLeaf)
     {
         final Path path = nodeService.getPath(nodeRef);
@@ -420,16 +433,17 @@ public class NodeResourceHelper implements InitializingBean
     /**
      * Gathers node's secondary parents.
      *
-     * @param nodeRef - node reference
+     * @param nodeRef
+     *            - node reference
      * @return a list of node's secondary parents.
      */
     public List<String> getSecondaryParents(final NodeRef nodeRef)
     {
         return nodeService.getParentAssocs(nodeRef).stream()
-            .filter(not(ChildAssociationRef::isPrimary))
-            .map(ChildAssociationRef::getParentRef)
-            .map(NodeRef::getId)
-            .collect(Collectors.toList());
+                .filter(not(ChildAssociationRef::isPrimary))
+                .map(ChildAssociationRef::getParentRef)
+                .map(NodeRef::getId)
+                .collect(Collectors.toList());
     }
 
     public PermissionService getPermissionService()

repository/src/main/java/org/alfresco/repo/event2/filter/AbstractNodeEventFilter.java

@@ -2,7 +2,7 @@
  * #%L
  * Alfresco Repository
  * %%
- * Copyright (C) 2005 - 2022 Alfresco Software Limited
+ * Copyright (C) 2005 - 2025 Alfresco Software Limited
  * %%
  * This file is part of the Alfresco software.
  * If the software was purchased under a paid Alfresco license, the terms of
@@ -26,160 +26,50 @@
 package org.alfresco.repo.event2.filter;
 
 import java.util.Collection;
-import java.util.Collections;
-import java.util.HashSet;
-import java.util.LinkedList;
 import java.util.List;
 import java.util.Set;
-import java.util.StringTokenizer;
 
-import org.alfresco.service.cmr.dictionary.DictionaryService;
-import org.alfresco.service.namespace.NamespaceException;
-import org.alfresco.service.namespace.NamespaceService;
+import org.alfresco.repo.event2.shared.CSVStringToListParser;
+import org.alfresco.repo.event2.shared.QNameMatcher;
+import org.alfresco.repo.event2.shared.TypeDefExpander;
 import org.alfresco.service.namespace.QName;
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
 
 /**
- * Abstract {@link EventFilter} implementation, containing common event filtering
- * functionality for the {@link QName} type.
+ * Abstract {@link EventFilter} implementation, containing common event filtering functionality for the {@link QName} type.
  *
  * @author Jamal Kaabi-Mofrad
  */
 public abstract class AbstractNodeEventFilter implements EventFilter<QName>
 {
-    private static final Logger LOGGER = LoggerFactory.getLogger(AbstractNodeEventFilter.class);
+    protected TypeDefExpander typeDefExpander;
 
-    private static final String MARKER_INCLUDE_SUBTYPES = "include_subtypes";
-    private static final String WILDCARD = "*";
-
-    protected DictionaryService dictionaryService;
-    protected NamespaceService namespaceService;
-
-    private Set<QName> excludedTypes;
-    private Set<String> excludedNamespaceURI;
-
-    public AbstractNodeEventFilter()
-    {
-        this.excludedTypes = new HashSet<>();
-        this.excludedNamespaceURI = new HashSet<>();
-    }
+    private QNameMatcher qNameMatcher;
 
     public final void init()
     {
-        preprocessExcludedTypes(getExcludedTypes());
+        qNameMatcher = new QNameMatcher(getExcludedTypes());
     }
 
-    public void setDictionaryService(DictionaryService dictionaryService)
+    public void setTypeDefExpander(TypeDefExpander typeDefExpander)
     {
-        this.dictionaryService = dictionaryService;
-    }
-
-    public void setNamespaceService(NamespaceService namespaceService)
-    {
-        this.namespaceService = namespaceService;
+        this.typeDefExpander = typeDefExpander;
     }
 
     @Override
     public boolean isExcluded(QName qName)
     {
-        if (qName != null)
-        {
-            return excludedTypes.contains(qName) || excludedNamespaceURI.contains(qName.getNamespaceURI());
-        }
-        return false;
+        return qNameMatcher.isMatching(qName);
     }
 
     protected abstract Set<QName> getExcludedTypes();
 
     protected List<String> parseFilterList(String unparsedFilterList)
     {
-        List<String> list = new LinkedList<>();
-
-        StringTokenizer st = new StringTokenizer(unparsedFilterList, ",");
-        while (st.hasMoreTokens())
-        {
-            String entry = st.nextToken().trim();
-            if (!entry.isEmpty())
-            {
-                if (!entry.equals("none") && !entry.contains("${"))
-                {
-                    list.add(entry);
-                }
-            }
-        }
-        return list;
-    }
-
-    /**
-     * Processes the user-defined list of types into valid QNames. It
-     * validates them against the dictionary and also supports wildcards
-     */
-    private void preprocessExcludedTypes(Set<QName> excluded)
-    {
-        excluded.forEach(qName -> {
-            if (WILDCARD.equals(qName.getLocalName()))
-            {
-                //excludedPrefixes.add(getPrefix(qName));
-                excludedNamespaceURI.add(qName.getNamespaceURI());
-            }
-            else
-            {
-                excludedTypes.add(qName);
-            }
-        });
-
-        if (LOGGER.isDebugEnabled())
-        {
-            LOGGER.debug("Excluded namespace URIs:" + excludedNamespaceURI);
-            LOGGER.debug("Excluded types:" + excludedTypes);
-        }
-    }
-
-    private QName getQName(String type)
-    {
-        return QName.createQName(type, namespaceService);
+        return CSVStringToListParser.parse(unparsedFilterList);
     }
 
     protected Collection<QName> expandTypeDef(String typeDef)
     {
-        if ((typeDef == null) || typeDef.isEmpty() || typeDef.equals("none") || typeDef.contains("${"))
-        {
-            return Collections.emptyList();
-        }
-
-        if (typeDef.indexOf(' ') < 0)
-        {
-            return Collections.singleton(getQName(typeDef));
-        }
-
-        String[] typeDefParts = typeDef.split(" ");
-        if (typeDefParts.length != 2)
-        {
-            LOGGER.warn("Ignoring invalid blacklist type pattern: " + typeDef);
-            return Collections.emptyList();
-        }
-
-        if (typeDefParts[1].equals(MARKER_INCLUDE_SUBTYPES))
-        {
-            if (typeDefParts[0].indexOf('*') >= 0)
-            {
-                LOGGER.warn("Ignoring invalid blacklist type pattern: " + typeDef);
-                return Collections.emptyList();
-            }
-            QName baseType;
-            try
-            {
-                baseType = getQName(typeDefParts[0]);
-            }
-            catch (NamespaceException ne)
-            {
-                return Collections.emptyList();
-            }
-            return dictionaryService.getSubTypes(baseType, true);
-        }
-
-        LOGGER.warn("Ignoring invalid blacklist type pattern: " + typeDef);
-        return Collections.emptyList();
+        return typeDefExpander.expand(typeDef);
     }
 }

repository/src/main/java/org/alfresco/repo/event2/filter/NodePropertyFilter.java

@@ -2,7 +2,7 @@
  * #%L
  * Alfresco Repository
  * %%
- * Copyright (C) 2005 - 2023 Alfresco Software Limited
+ * Copyright (C) 2005 - 2025 Alfresco Software Limited
  * %%
  * This file is part of the Alfresco software.
  * If the software was purchased under a paid Alfresco license, the terms of
@@ -25,6 +25,7 @@
  */
 package org.alfresco.repo.event2.filter;
 
+import java.util.ArrayList;
 import java.util.HashSet;
 import java.util.List;
 import java.util.Set;
@@ -43,34 +44,37 @@ public class NodePropertyFilter extends AbstractNodeEventFilter
     // These properties are included as top-level info,
     // so exclude them from the properties object
     private static final Set<QName> EXCLUDED_TOP_LEVEL_PROPS = Set.of(ContentModel.PROP_NAME,
-                                                                      ContentModel.PROP_MODIFIER,
-                                                                      ContentModel.PROP_MODIFIED,
-                                                                      ContentModel.PROP_CREATOR,
-                                                                      ContentModel.PROP_CREATED,
-                                                                      ContentModel.PROP_CONTENT);
+            ContentModel.PROP_MODIFIER,
+            ContentModel.PROP_MODIFIED,
+            ContentModel.PROP_CREATOR,
+            ContentModel.PROP_CREATED,
+            ContentModel.PROP_CONTENT);
     // These properties should not be excluded from the properties object
     private static final Set<QName> ALLOWED_PROPERTIES = Set.of(ContentModel.PROP_CASCADE_TX,
-                                                                ContentModel.PROP_CASCADE_CRC);
+            ContentModel.PROP_CASCADE_CRC);
 
-    private final List<String> nodePropertiesBlackList;
+    private final List<String> nodePropertiesBlackList = new ArrayList<>();
 
-    public NodePropertyFilter()
+    public NodePropertyFilter(String userConfiguredProperties)
     {
-        this.nodePropertiesBlackList = parseFilterList(FILTERED_PROPERTIES);
+        super();
+        nodePropertiesBlackList.addAll(parseFilterList(FILTERED_PROPERTIES));
+        nodePropertiesBlackList.addAll(parseFilterList(userConfiguredProperties));
     }
 
     @Override
     public Set<QName> getExcludedTypes()
     {
         Set<QName> result = new HashSet<>(EXCLUDED_TOP_LEVEL_PROPS);
-        nodePropertiesBlackList.forEach(nodeProperty-> result.addAll(expandTypeDef(nodeProperty)));
+        nodePropertiesBlackList.forEach(nodeProperty -> result.addAll(expandTypeDef(nodeProperty)));
         return result;
     }
 
     @Override
     public boolean isExcluded(QName qName)
     {
-        if(qName != null && ALLOWED_PROPERTIES.contains(qName)){
+        if (qName != null && ALLOWED_PROPERTIES.contains(qName))
+        {
             return false;
         }
         return super.isExcluded(qName);

repository/src/main/java/org/alfresco/repo/event2/filter/NodeTypeFilter.java

@@ -2,7 +2,7 @@
  * #%L
  * Alfresco Repository
  * %%
- * Copyright (C) 2005 - 2020 Alfresco Software Limited
+ * Copyright (C) 2005 - 2025 Alfresco Software Limited
  * %%
  * This file is part of the Alfresco software.
  * If the software was purchased under a paid Alfresco license, the terms of
@@ -31,6 +31,7 @@ import java.util.List;
 import java.util.Set;
 
 import org.alfresco.model.ContentModel;
+import org.alfresco.service.cmr.dictionary.DictionaryService;
 import org.alfresco.service.namespace.QName;
 
 /**
@@ -41,10 +42,13 @@ import org.alfresco.service.namespace.QName;
 public class NodeTypeFilter extends AbstractNodeEventFilter
 {
     private final List<String> nodeTypesBlackList;
+    private final DictionaryService dictionaryService;
 
-    public NodeTypeFilter(String filteredNodeTypes)
+    public NodeTypeFilter(String filteredNodeTypes, DictionaryService dictionaryService)
     {
+        super();
         this.nodeTypesBlackList = parseFilterList(filteredNodeTypes);
+        this.dictionaryService = dictionaryService;
     }
 
     @Override

repository/src/main/java/org/alfresco/repo/event2/mapper/PropertyMapper.java

@@ -0,0 +1,37 @@
+/*
+ * #%L
+ * Alfresco Repository
+ * %%
+ * Copyright (C) 2025 - 2025 Alfresco Software Limited
+ * %%
+ * This file is part of the Alfresco software.
+ * If the software was purchased under a paid Alfresco license, the terms of
+ * the paid license agreement will prevail.  Otherwise, the software is
+ * provided under the following open source license terms:
+ *
+ * Alfresco is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Lesser General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * Alfresco is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public License
+ * along with Alfresco. If not, see <http://www.gnu.org/licenses/>.
+ * #L%
+ */
+package org.alfresco.repo.event2.mapper;
+
+import java.io.Serializable;
+
+import org.alfresco.service.namespace.QName;
+
+public interface PropertyMapper
+{
+    PropertyMapper NO_OP = (propertyQName, value) -> value;
+
+    Serializable map(QName propertyQName, Serializable value);
+}

repository/src/main/java/org/alfresco/repo/event2/mapper/PropertyMapperFactory.java

@@ -0,0 +1,58 @@
+/*
+ * #%L
+ * Alfresco Repository
+ * %%
+ * Copyright (C) 2025 - 2025 Alfresco Software Limited
+ * %%
+ * This file is part of the Alfresco software.
+ * If the software was purchased under a paid Alfresco license, the terms of
+ * the paid license agreement will prevail.  Otherwise, the software is
+ * provided under the following open source license terms:
+ *
+ * Alfresco is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Lesser General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * Alfresco is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public License
+ * along with Alfresco. If not, see <http://www.gnu.org/licenses/>.
+ * #L%
+ */
+package org.alfresco.repo.event2.mapper;
+
+import org.alfresco.repo.event2.shared.CSVStringToListParser;
+import org.alfresco.repo.event2.shared.TypeDefExpander;
+import org.alfresco.service.namespace.QName;
+
+import java.util.Optional;
+import java.util.Set;
+import java.util.function.Predicate;
+
+public class PropertyMapperFactory
+{
+    private final TypeDefExpander typeDefExpander;
+
+    public PropertyMapperFactory(TypeDefExpander typeDefExpander)
+    {
+        this.typeDefExpander = typeDefExpander;
+    }
+
+    public PropertyMapper createPropertyMapper(String enabled, String userConfiguredSensitiveProperties, String userConfiguredReplacementText)
+    {
+        if ("false".equalsIgnoreCase(enabled))
+        {
+            return PropertyMapper.NO_OP;
+        }
+        Set<QName> sensitiveProperties = Optional.ofNullable(userConfiguredSensitiveProperties)
+                .filter(Predicate.not(String::isEmpty))
+                .map(CSVStringToListParser::parse)
+                .map(typeDefExpander::expand)
+                .orElse(Set.of());
+        return new ReplaceSensitivePropertyWithTextMapper(sensitiveProperties, userConfiguredReplacementText);
+    }
+}

repository/src/main/java/org/alfresco/repo/event2/mapper/ReplaceSensitivePropertyWithTextMapper.java

@@ -0,0 +1,72 @@
+/*
+ * #%L
+ * Alfresco Repository
+ * %%
+ * Copyright (C) 2025 - 2025 Alfresco Software Limited
+ * %%
+ * This file is part of the Alfresco software.
+ * If the software was purchased under a paid Alfresco license, the terms of
+ * the paid license agreement will prevail.  Otherwise, the software is
+ * provided under the following open source license terms:
+ *
+ * Alfresco is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Lesser General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * Alfresco is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public License
+ * along with Alfresco. If not, see <http://www.gnu.org/licenses/>.
+ * #L%
+ */
+package org.alfresco.repo.event2.mapper;
+
+import org.alfresco.model.ContentModel;
+import org.alfresco.repo.event2.shared.QNameMatcher;
+import org.alfresco.repo.transfer.TransferModel;
+import org.alfresco.service.namespace.QName;
+
+import java.io.Serializable;
+import java.util.Collection;
+import java.util.Optional;
+import java.util.Set;
+import java.util.function.Predicate;
+
+public class ReplaceSensitivePropertyWithTextMapper implements PropertyMapper
+{
+    private static final Set<QName> DEFAULT_SENSITIVE_PROPERTIES = Set.of(
+            ContentModel.PROP_PASSWORD,
+            ContentModel.PROP_SALT,
+            ContentModel.PROP_PASSWORD_HASH,
+            TransferModel.PROP_PASSWORD
+    );
+    private static final String DEFAULT_REPLACEMENT_TEXT = "SENSITIVE_DATA_REMOVED";
+
+    private final QNameMatcher qNameMatcher;
+    private final String replacementText;
+
+    public ReplaceSensitivePropertyWithTextMapper(Set<QName> userConfiguredSensitiveProperties, String userConfiguredReplacementText)
+    {
+        Set<QName> sensitiveProperties = Optional.ofNullable(userConfiguredSensitiveProperties)
+                .filter(Predicate.not(Collection::isEmpty))
+                .orElse(DEFAULT_SENSITIVE_PROPERTIES);
+        qNameMatcher = new QNameMatcher(sensitiveProperties);
+        replacementText = Optional.ofNullable(userConfiguredReplacementText)
+                .filter(Predicate.not(String::isEmpty))
+                .filter(userInput -> !userInput.contains("${"))
+                .orElse(DEFAULT_REPLACEMENT_TEXT);
+    }
+    @Override
+    public Serializable map(QName propertyQName, Serializable value)
+    {
+        if (qNameMatcher.isMatching(propertyQName))
+        {
+            return replacementText;
+        }
+        return value;
+    }
+}

repository/src/main/java/org/alfresco/repo/event2/shared/CSVStringToListParser.java

@@ -0,0 +1,52 @@
+/*
+ * #%L
+ * Alfresco Repository
+ * %%
+ * Copyright (C) 2025 - 2025 Alfresco Software Limited
+ * %%
+ * This file is part of the Alfresco software.
+ * If the software was purchased under a paid Alfresco license, the terms of
+ * the paid license agreement will prevail.  Otherwise, the software is
+ * provided under the following open source license terms:
+ *
+ * Alfresco is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Lesser General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * Alfresco is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public License
+ * along with Alfresco. If not, see <http://www.gnu.org/licenses/>.
+ * #L%
+ */
+package org.alfresco.repo.event2.shared;
+
+import java.util.LinkedList;
+import java.util.List;
+import java.util.StringTokenizer;
+
+public final class CSVStringToListParser
+{
+    private CSVStringToListParser()
+    {}
+
+    public static List<String> parse(String userInputCSV)
+    {
+        List<String> list = new LinkedList<>();
+
+        StringTokenizer st = new StringTokenizer(userInputCSV, ",");
+        while (st.hasMoreTokens())
+        {
+            String entry = st.nextToken().trim();
+            if (!entry.isEmpty() && !entry.equals("none") && !entry.contains("${"))
+            {
+                list.add(entry);
+            }
+        }
+        return list;
+    }
+}

repository/src/main/java/org/alfresco/repo/event2/shared/QNameMatcher.java

@@ -0,0 +1,75 @@
+/*
+ * #%L
+ * Alfresco Repository
+ * %%
+ * Copyright (C) 2025 - 2025 Alfresco Software Limited
+ * %%
+ * This file is part of the Alfresco software.
+ * If the software was purchased under a paid Alfresco license, the terms of
+ * the paid license agreement will prevail.  Otherwise, the software is
+ * provided under the following open source license terms:
+ *
+ * Alfresco is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Lesser General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * Alfresco is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public License
+ * along with Alfresco. If not, see <http://www.gnu.org/licenses/>.
+ * #L%
+ */
+package org.alfresco.repo.event2.shared;
+
+import java.util.HashSet;
+import java.util.Set;
+
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+import org.alfresco.service.namespace.QName;
+
+public class QNameMatcher
+{
+    private static final Logger LOGGER = LoggerFactory.getLogger(QNameMatcher.class);
+    private static final String WILDCARD = "*";
+
+    private final Set<QName> matchingTypes;
+    private final Set<String> matchingNamespaceURIs;
+
+    public QNameMatcher(Set<QName> qNamesToMatch)
+    {
+        matchingTypes = new HashSet<>();
+        matchingNamespaceURIs = new HashSet<>();
+
+        qNamesToMatch.forEach(qName -> {
+            if (WILDCARD.equals(qName.getLocalName()))
+            {
+                matchingNamespaceURIs.add(qName.getNamespaceURI());
+            }
+            else
+            {
+                matchingTypes.add(qName);
+            }
+        });
+
+        if (LOGGER.isDebugEnabled())
+        {
+            LOGGER.debug("Matching namespace URIs:" + matchingNamespaceURIs);
+            LOGGER.debug("Matching types:" + matchingTypes);
+        }
+    }
+
+    public boolean isMatching(QName qName)
+    {
+        if (qName != null)
+        {
+            return matchingTypes.contains(qName) || matchingNamespaceURIs.contains(qName.getNamespaceURI());
+        }
+        return false;
+    }
+}

repository/src/main/java/org/alfresco/repo/event2/shared/TypeDefExpander.java

@@ -0,0 +1,107 @@
+/*
+ * #%L
+ * Alfresco Repository
+ * %%
+ * Copyright (C) 2025 - 2025 Alfresco Software Limited
+ * %%
+ * This file is part of the Alfresco software.
+ * If the software was purchased under a paid Alfresco license, the terms of
+ * the paid license agreement will prevail.  Otherwise, the software is
+ * provided under the following open source license terms:
+ *
+ * Alfresco is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Lesser General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * Alfresco is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public License
+ * along with Alfresco. If not, see <http://www.gnu.org/licenses/>.
+ * #L%
+ */
+package org.alfresco.repo.event2.shared;
+
+import org.alfresco.service.cmr.dictionary.DictionaryService;
+import org.alfresco.service.namespace.NamespaceException;
+import org.alfresco.service.namespace.NamespaceService;
+import org.alfresco.service.namespace.QName;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+import java.util.Collection;
+import java.util.Collections;
+import java.util.HashSet;
+import java.util.Set;
+
+public class TypeDefExpander
+{
+    private static final Logger LOGGER = LoggerFactory.getLogger(TypeDefExpander.class);
+    private static final String MARKER_INCLUDE_SUBTYPES = "include_subtypes";
+
+    private final DictionaryService dictionaryService;
+    private final NamespaceService namespaceService;
+
+    public TypeDefExpander(DictionaryService dictionaryService, NamespaceService namespaceService)
+    {
+        this.dictionaryService = dictionaryService;
+        this.namespaceService = namespaceService;
+    }
+
+    public Set<QName> expand(Collection<String> types){
+        Set<QName> result = new HashSet<>();
+        types.forEach(type -> result.addAll(expand(type)));
+        return result;
+    }
+
+    public Collection<QName> expand(String typeDef)
+    {
+        if ((typeDef == null) || typeDef.isEmpty() || typeDef.equals("none") || typeDef.contains("${"))
+        {
+            return Collections.emptyList();
+        }
+
+        if (typeDef.indexOf(' ') < 0)
+        {
+            return Collections.singleton(getQName(typeDef));
+        }
+
+        String[] typeDefParts = typeDef.split(" ");
+        if (typeDefParts.length != 2)
+        {
+            LOGGER.warn("Ignoring invalid type pattern: " + typeDef);
+            return Collections.emptyList();
+        }
+
+        if (typeDefParts[1].equals(MARKER_INCLUDE_SUBTYPES))
+        {
+            if (typeDefParts[0].indexOf('*') >= 0)
+            {
+                LOGGER.warn("Ignoring invalid type pattern: " + typeDef);
+                return Collections.emptyList();
+            }
+            QName baseType;
+            try
+            {
+                baseType = getQName(typeDefParts[0]);
+            }
+            catch (NamespaceException ne)
+            {
+                return Collections.emptyList();
+            }
+            return dictionaryService.getSubTypes(baseType, true);
+        }
+
+        LOGGER.warn("Ignoring invalid type pattern: " + typeDef);
+        return Collections.emptyList();
+    }
+
+    private QName getQName(String type)
+    {
+        return QName.createQName(type, namespaceService);
+    }
+}
+

repository/src/main/java/org/alfresco/repo/rendition2/LocalTransformClient.java

@@ -37,6 +37,7 @@ import org.alfresco.service.cmr.repository.NodeRef;
 import org.alfresco.service.transaction.TransactionService;
 import org.alfresco.transform.config.CoreFunction;
 import org.alfresco.util.PropertyCheck;
+import com.google.common.util.concurrent.ThreadFactoryBuilder;
 import org.apache.commons.logging.Log;
 import org.apache.commons.logging.LogFactory;
 import org.springframework.beans.factory.InitializingBean;
@@ -46,6 +47,7 @@ import java.util.HashMap;
 import java.util.Map;
 import java.util.concurrent.ExecutorService;
 import java.util.concurrent.Executors;
+import java.util.concurrent.ThreadFactory;
 
 import static org.alfresco.model.ContentModel.PROP_CONTENT;
 import static org.alfresco.transform.common.RequestParamMap.DIRECT_ACCESS_URL;
@@ -68,6 +70,7 @@ public class LocalTransformClient implements TransformClient, InitializingBean
     private ContentService contentService;
     private RenditionService2Impl renditionService2;
     private boolean directAccessUrlEnabled;
+    private int threadPoolSize;
 
     private ExecutorService executorService;
     private ThreadLocal<LocalTransform> transform = new ThreadLocal<>();
@@ -97,6 +100,11 @@ public class LocalTransformClient implements TransformClient, InitializingBean
         this.directAccessUrlEnabled = directAccessUrlEnabled;
     }
 
+    public void setThreadPoolSize(int threadPoolSize)
+    {
+        this.threadPoolSize = threadPoolSize;
+    }
+
     public void setExecutorService(ExecutorService executorService)
     {
         this.executorService = executorService;
@@ -110,9 +118,11 @@ public class LocalTransformClient implements TransformClient, InitializingBean
         PropertyCheck.mandatory(this, "contentService", contentService);
         PropertyCheck.mandatory(this, "renditionService2", renditionService2);
         PropertyCheck.mandatory(this, "directAccessUrlEnabled", directAccessUrlEnabled);
+        PropertyCheck.mandatory(this, "threadPoolSize", threadPoolSize);
         if (executorService == null)
         {
-            executorService = Executors.newCachedThreadPool();
+            ThreadFactory threadFactory = new ThreadFactoryBuilder().setNameFormat("local-transform-%d").build();
+            executorService = Executors.newFixedThreadPool(threadPoolSize, threadFactory);
         }
     }
 

repository/src/main/java/org/alfresco/repo/rendition2/RenditionService2.java

@@ -2,7 +2,7 @@
  * #%L
  * Alfresco Repository
  * %%
- * Copyright (C) 2005 - 2022 Alfresco Software Limited
+ * Copyright (C) 2005 - 2025 Alfresco Software Limited
  * %%
  * This file is part of the Alfresco software.
  * If the software was purchased under a paid Alfresco license, the terms of
@@ -25,35 +25,27 @@
  */
 package org.alfresco.repo.rendition2;
 
+import java.util.List;
+
 import org.alfresco.service.NotAuditable;
 import org.alfresco.service.cmr.repository.ChildAssociationRef;
 import org.alfresco.service.cmr.repository.NodeRef;
 
-import java.util.List;
-
 /**
- * The Async Rendition service. Replaces the original rendition services which included synchronous renditions and
- * asynchronous methods with Java call backs.<p/>
+ * The Async Rendition service. Replaces the original rendition services which included synchronous renditions and asynchronous methods with Java call backs.
+ * <p/>
  *
- * Renditions are defined as {@link RenditionDefinition2}s and may be registered and looked by the associated
- * {@link RenditionDefinitionRegistry2}.<p/>
+ * Renditions are defined as {@link RenditionDefinition2}s and may be registered and looked by the associated {@link RenditionDefinitionRegistry2}.
+ * <p/>
  *
  * Unlike the original RenditionService this service, it:
  * <ul>
- *     <li>Performs async renditions without a Java callback, as another node in the cluster may complete the rendition.
- *     The current node requests a transform, but another node might take the resulting transform and turn it into a
- *     rendition if the external Transform Service is used.</li>
- *     <li>Reduces the configurable options to do with with the associations of rendition nodes, their type. They
- *     are identical to 'hidden' (not normally seen as nodes in their own right in a
- *     UI) renditions produced by the original service. So, they are always directly under the source node connected by a
- *     {@code}rn:rendition{@code} association with the name of the rendition.</li>
- *     <li>The rendition nodes additionally have a {@code}rn:rendition2{@code} aspect and a {@code}contentUrlHashCode{@code}
- *     property. This property contains a value that allows the service to work out if it holds a rendition of the
- *     source node's current content.</li>
- *     <li>Failures are handled by setting the rendition node's content to null.</li>
- *     <li>When a rendition is requested via the REST API, only the newer service is used.</li>
- *     <li>Where possible old service renditions migrate automatically over to the new service when content on a
- *     source node is updated.</li>
+ * <li>Performs async renditions without a Java callback, as another node in the cluster may complete the rendition. The current node requests a transform, but another node might take the resulting transform and turn it into a rendition if the external Transform Service is used.</li>
+ * <li>Reduces the configurable options to do with with the associations of rendition nodes, their type. They are identical to 'hidden' (not normally seen as nodes in their own right in a UI) renditions produced by the original service. So, they are always directly under the source node connected by a {@code}rn:rendition{@code} association with the name of the rendition.</li>
+ * <li>The rendition nodes additionally have a {@code}rn:rendition2{@code} aspect and a {@code}contentUrlHashCode{@code} property. This property contains a value that allows the service to work out if it holds a rendition of the source node's current content.</li>
+ * <li>Failures are handled by setting the rendition node's content to null.</li>
+ * <li>When a rendition is requested via the REST API, only the newer service is used.</li>
+ * <li>Where possible old service renditions migrate automatically over to the new service when content on a source node is updated.</li>
  * </ul>
  *
  * @author adavis
@@ -66,29 +58,30 @@ public interface RenditionService2
     RenditionDefinitionRegistry2 getRenditionDefinitionRegistry2();
 
     /**
-     * This method asynchronously transforms content to a target mimetype with transform options supplied in the
-     * {@code transformDefinition}. A response is set on a message queue once the transform is complete or fails,
-     * together with some client supplied data. The response queue and client data are also included in the
-     * transformDefinition.<p>
+     * This method asynchronously transforms content to a target mimetype with transform options supplied in the {@code transformDefinition}. A response is set on a message queue once the transform is complete or fails, together with some client supplied data. The response queue and client data are also included in the transformDefinition.
+     * <p>
      *
-     * This method does not create a rendition node, but uses the same code as renditions to perform the transform. The
-     * {@code transformDefinition} extends {@link RenditionDefinition2}, but is not stored in a
-     * {@link RenditionDefinitionRegistry2}, as it is transient in nature.
+     * This method does not create a rendition node, but uses the same code as renditions to perform the transform. The {@code transformDefinition} extends {@link RenditionDefinition2}, but is not stored in a {@link RenditionDefinitionRegistry2}, as it is transient in nature.
      *
-     * @param sourceNodeRef the node from which the content is retrieved.
-     * @param transformDefinition which defines the transform, where to sent the response and some client specified data.
-     * @throws UnsupportedOperationException if the transform is not supported.
+     * @param sourceNodeRef
+     *            the node from which the content is retrieved.
+     * @param transformDefinition
+     *            which defines the transform, where to sent the response and some client specified data.
+     * @throws UnsupportedOperationException
+     *             if the transform is not supported.
      */
     @NotAuditable
     public void transform(NodeRef sourceNodeRef, TransformDefinition transformDefinition);
 
     /**
-     * This method asynchronously renders content as specified by the {@code renditionName}. The content to be
-     * rendered is provided by {@code sourceNodeRef}.
+     * This method asynchronously renders content as specified by the {@code renditionName}. The content to be rendered is provided by {@code sourceNodeRef}.
      *
-     * @param sourceNodeRef the node from which the content is retrieved.
-     * @param renditionName the rendition to be performed.
-     * @throws UnsupportedOperationException if the transform is not supported AND the rendition has not been created before.
+     * @param sourceNodeRef
+     *            the node from which the content is retrieved.
+     * @param renditionName
+     *            the rendition to be performed.
+     * @throws UnsupportedOperationException
+     *             if the transform is not supported AND the rendition has not been created before.
      */
     @NotAuditable
     public void render(NodeRef sourceNodeRef, String renditionName);
@@ -104,10 +97,11 @@ public interface RenditionService2
     /**
      * This method gets the rendition of the {@code sourceNodeRef} identified by its name.
      *
-     * @param sourceNodeRef the source node for the renditions
-     * @param renditionName the renditionName used to identify a rendition.
-     * @return the {@link ChildAssociationRef} which links the source node to the
-     *         rendition or <code>null</code> if there is no rendition or it is not up to date.
+     * @param sourceNodeRef
+     *            the source node for the renditions
+     * @param renditionName
+     *            the renditionName used to identify a rendition.
+     * @return the {@link ChildAssociationRef} which links the source node to the rendition or <code>null</code> if there is no rendition or it is not up to date.
      */
     @NotAuditable
     ChildAssociationRef getRenditionByName(NodeRef sourceNodeRef, String renditionName);
@@ -115,7 +109,8 @@ public interface RenditionService2
     /**
      * This method clears source nodeRef rendition content and content hash code using supplied rendition name.
      *
-     * @param renditionNode the rendition node
+     * @param renditionNode
+     *            the rendition node
      */
     @NotAuditable
     void clearRenditionContentDataInTransaction(NodeRef renditionNode);
@@ -124,4 +119,13 @@ public interface RenditionService2
      * Indicates if renditions are enabled. Set using the {@code system.thumbnail.generate} value.
      */
     boolean isEnabled();
-}
+
+    /**
+     * This method forces the content hash code for every {@code sourceNodeRef} renditions.
+     * 
+     * @param sourceNodeRef
+     *            the source node to update renditions hash code
+     */
+    @NotAuditable
+    void forceRenditionsContentHashCode(NodeRef sourceNodeRef);
+}

repository/src/main/java/org/alfresco/repo/rendition2/RenditionService2Impl.java

@@ -2,7 +2,7 @@
  * #%L
  * Alfresco Repository
  * %%
- * Copyright (C) 2005 - 2022 Alfresco Software Limited
+ * Copyright (C) 2005 - 2025 Alfresco Software Limited
  * %%
  * This file is part of the Alfresco software.
  * If the software was purchased under a paid Alfresco license, the terms of
@@ -25,6 +25,24 @@
  */
 package org.alfresco.repo.rendition2;
 
+import static org.alfresco.model.ContentModel.PROP_CONTENT;
+import static org.alfresco.model.RenditionModel.PROP_RENDITION_CONTENT_HASH_CODE;
+import static org.alfresco.service.namespace.QName.createQName;
+
+import java.io.InputStream;
+import java.io.Serializable;
+import java.util.ArrayList;
+import java.util.Collections;
+import java.util.HashMap;
+import java.util.List;
+import java.util.Map;
+import java.util.Set;
+import java.util.concurrent.atomic.AtomicBoolean;
+
+import org.apache.commons.logging.Log;
+import org.apache.commons.logging.LogFactory;
+import org.springframework.beans.factory.InitializingBean;
+
 import org.alfresco.model.ContentModel;
 import org.alfresco.model.RenditionModel;
 import org.alfresco.repo.content.ContentServicePolicies;
@@ -51,23 +69,6 @@ import org.alfresco.service.namespace.QName;
 import org.alfresco.service.namespace.RegexQNamePattern;
 import org.alfresco.service.transaction.TransactionService;
 import org.alfresco.util.PropertyCheck;
-import org.apache.commons.logging.Log;
-import org.apache.commons.logging.LogFactory;
-import org.springframework.beans.factory.InitializingBean;
-
-import java.io.InputStream;
-import java.io.Serializable;
-import java.util.ArrayList;
-import java.util.Collections;
-import java.util.HashMap;
-import java.util.List;
-import java.util.Map;
-import java.util.Set;
-import java.util.concurrent.atomic.AtomicBoolean;
-
-import static org.alfresco.model.ContentModel.PROP_CONTENT;
-import static org.alfresco.model.RenditionModel.PROP_RENDITION_CONTENT_HASH_CODE;
-import static org.alfresco.service.namespace.QName.createQName;
 
 /**
  * The Async Rendition service. Replaces the original deprecated RenditionService.
@@ -80,11 +81,19 @@ public class RenditionService2Impl implements RenditionService2, InitializingBea
 
     public static final QName DEFAULT_RENDITION_CONTENT_PROP = ContentModel.PROP_CONTENT;
     public static final String DEFAULT_MIMETYPE = MimetypeMap.MIMETYPE_TEXT_PLAIN;
+    public static final String MIMETYPE_METADATA_EXTRACT = "alfresco-metadata-extract";
+    public static final String MIMETYPE_METADATA_EMBED = "alfresco-metadata-embed";
     public static final String DEFAULT_ENCODING = "UTF-8";
 
     public static final int SOURCE_HAS_NO_CONTENT = -1;
     public static final int RENDITION2_DOES_NOT_EXIST = -2;
 
+    // Allowed mimetypes to support text or metadata extract transforms when thumbnails are disabled.
+    private static final Set<String> ALLOWED_MIMETYPES = Set.of(
+            MimetypeMap.MIMETYPE_TEXT_PLAIN,
+            MIMETYPE_METADATA_EXTRACT,
+            MIMETYPE_METADATA_EMBED);
+
     private static Log logger = LogFactory.getLog(RenditionService2Impl.class);
 
     // As Async transforms and renditions are so similar, this class provides a way to provide the code that is different.
@@ -95,12 +104,10 @@ public class RenditionService2Impl implements RenditionService2, InitializingBea
         abstract RenditionDefinition2 getRenditionDefinition();
 
         void handleUnsupported(UnsupportedOperationException e)
-        {
-        }
+        {}
 
         void throwIllegalStateExceptionIfAlreadyDone(int sourceContentHashCode)
-        {
-        }
+        {}
     }
 
     private TransactionService transactionService;
@@ -217,8 +224,7 @@ public class RenditionService2Impl implements RenditionService2, InitializingBea
     @Override
     public void transform(NodeRef sourceNodeRef, TransformDefinition transformDefinition)
     {
-        requestAsyncTransformOrRendition(sourceNodeRef, new RenderOrTransformCallBack()
-        {
+        requestAsyncTransformOrRendition(sourceNodeRef, new RenderOrTransformCallBack() {
             @Override
             public String getName()
             {
@@ -237,8 +243,7 @@ public class RenditionService2Impl implements RenditionService2, InitializingBea
     @Override
     public void render(NodeRef sourceNodeRef, String renditionName)
     {
-        requestAsyncTransformOrRendition(sourceNodeRef, new RenderOrTransformCallBack()
-        {
+        requestAsyncTransformOrRendition(sourceNodeRef, new RenderOrTransformCallBack() {
             @Override
             public String getName()
             {
@@ -261,7 +266,7 @@ public class RenditionService2Impl implements RenditionService2, InitializingBea
             @Override
             public void handleUnsupported(UnsupportedOperationException e)
             {
-                // On the initial request for a rendition  throw the exception.
+                // On the initial request for a rendition throw the exception.
                 NodeRef renditionNode = getRenditionNode(sourceNodeRef, renditionName);
                 if (renditionNode == null)
                 {
@@ -277,7 +282,7 @@ public class RenditionService2Impl implements RenditionService2, InitializingBea
                 int renditionContentHashCode = getRenditionContentHashCode(renditionNode);
                 if (logger.isDebugEnabled())
                 {
-                    logger.debug(getName() + ": Source " + sourceContentHashCode + " rendition " + renditionContentHashCode+ " hashCodes");
+                    logger.debug(getName() + ": Source " + sourceContentHashCode + " rendition " + renditionContentHashCode + " hashCodes");
                 }
                 if (renditionContentHashCode == sourceContentHashCode)
                 {
@@ -291,7 +296,7 @@ public class RenditionService2Impl implements RenditionService2, InitializingBea
     {
         try
         {
-            if (!isEnabled())
+            if (!isAsyncAllowed(renderOrTransform))
             {
                 throw new RenditionService2Exception("Async transforms and renditions are disabled " +
                         "(system.thumbnail.generate=false or renditionService2.enabled=false).");
@@ -299,14 +304,14 @@ public class RenditionService2Impl implements RenditionService2, InitializingBea
 
             if (!nodeService.exists(sourceNodeRef))
             {
-                throw new IllegalArgumentException(renderOrTransform.getName()+ ": The supplied sourceNodeRef "+sourceNodeRef+" does not exist.");
+                throw new IllegalArgumentException(renderOrTransform.getName() + ": The supplied sourceNodeRef " + sourceNodeRef + " does not exist.");
             }
 
             RenditionDefinition2 renditionDefinition = renderOrTransform.getRenditionDefinition();
 
             if (logger.isDebugEnabled())
             {
-                logger.debug(renderOrTransform.getName()+ ": transform " +sourceNodeRef);
+                logger.debug(renderOrTransform.getName() + ": transform " + sourceNodeRef);
             }
 
             AtomicBoolean supported = new AtomicBoolean(true);
@@ -328,14 +333,13 @@ public class RenditionService2Impl implements RenditionService2, InitializingBea
             }
 
             String user = AuthenticationUtil.getRunAsUser();
-            RetryingTransactionHelper.RetryingTransactionCallback callback = () ->
-            {
+            RetryingTransactionHelper.RetryingTransactionCallback callback = () -> {
                 int sourceContentHashCode = getSourceContentHashCode(sourceNodeRef);
                 if (!supported.get())
                 {
                     if (logger.isDebugEnabled())
                     {
-                        logger.debug(renderOrTransform.getName() +" is not supported. " +
+                        logger.debug(renderOrTransform.getName() + " is not supported. " +
                                 "The content might be too big or the source mimetype cannot be converted.");
                     }
                     failure(sourceNodeRef, renditionDefinition, sourceContentHashCode);
@@ -372,26 +376,24 @@ public class RenditionService2Impl implements RenditionService2, InitializingBea
     public void failure(NodeRef sourceNodeRef, RenditionDefinition2 renditionDefinition, int transformContentHashCode)
     {
         // The original transaction may have already have failed
-        AuthenticationUtil.runAsSystem((AuthenticationUtil.RunAsWork<Void>) () ->
-                transactionService.getRetryingTransactionHelper().doInTransaction(() ->
-                {
-                    consume(sourceNodeRef, null, renditionDefinition, transformContentHashCode);
-                    return null;
-                }, false, true));
+        AuthenticationUtil.runAsSystem((AuthenticationUtil.RunAsWork<Void>) () -> transactionService.getRetryingTransactionHelper().doInTransaction(() -> {
+            consume(sourceNodeRef, null, renditionDefinition, transformContentHashCode);
+            return null;
+        }, false, true));
     }
 
     public void consume(NodeRef sourceNodeRef, InputStream transformInputStream, RenditionDefinition2 renditionDefinition,
-                        int transformContentHashCode)
+            int transformContentHashCode)
     {
         int sourceContentHashCode = getSourceContentHashCode(sourceNodeRef);
         if (logger.isDebugEnabled())
         {
-            logger.debug("Consume: Source " + sourceContentHashCode + " and transform's source " + transformContentHashCode+" hashcodes");
+            logger.debug("Consume: Source " + sourceContentHashCode + " and transform's source " + transformContentHashCode + " hashcodes");
         }
 
         if (renditionDefinition instanceof TransformDefinition)
         {
-            TransformDefinition transformDefinition = (TransformDefinition)renditionDefinition;
+            TransformDefinition transformDefinition = (TransformDefinition) renditionDefinition;
             String targetMimetype = transformDefinition.getTargetMimetype();
             if (AsynchronousExtractor.isMetadataExtractMimetype(targetMimetype))
             {
@@ -413,7 +415,7 @@ public class RenditionService2Impl implements RenditionService2, InitializingBea
     }
 
     private void consumeExtractedMetadata(NodeRef nodeRef, int sourceContentHashCode, InputStream transformInputStream,
-                                          TransformDefinition transformDefinition, int transformContentHashCode)
+            TransformDefinition transformDefinition, int transformContentHashCode)
     {
         if (transformInputStream == null)
         {
@@ -440,7 +442,7 @@ public class RenditionService2Impl implements RenditionService2, InitializingBea
     }
 
     private void consumeEmbeddedMetadata(NodeRef nodeRef, int sourceContentHashCode, InputStream transformInputStream,
-                                         TransformDefinition transformDefinition, int transformContentHashCode)
+            TransformDefinition transformDefinition, int transformContentHashCode)
     {
         if (transformInputStream == null)
         {
@@ -468,7 +470,7 @@ public class RenditionService2Impl implements RenditionService2, InitializingBea
     }
 
     private void consumeTransformReply(NodeRef sourceNodeRef, InputStream transformInputStream,
-                                       TransformDefinition transformDefinition, int transformContentHashCode)
+            TransformDefinition transformDefinition, int transformContentHashCode)
     {
         if (logger.isDebugEnabled())
         {
@@ -484,12 +486,10 @@ public class RenditionService2Impl implements RenditionService2, InitializingBea
     }
 
     /**
-     *  Takes a transformation (InputStream) and attaches it as a rendition to the source node.
-     *  Does nothing if there is already a newer rendition.
-     *  If the transformInputStream is null, this is taken to be a transform failure.
+     * Takes a transformation (InputStream) and attaches it as a rendition to the source node. Does nothing if there is already a newer rendition. If the transformInputStream is null, this is taken to be a transform failure.
      */
     private void consumeRendition(NodeRef sourceNodeRef, int sourceContentHashCode, InputStream transformInputStream,
-                                  RenditionDefinition2 renditionDefinition, int transformContentHashCode)
+            RenditionDefinition2 renditionDefinition, int transformContentHashCode)
     {
         String renditionName = renditionDefinition.getRenditionName();
         if (transformContentHashCode != sourceContentHashCode)
@@ -507,93 +507,92 @@ public class RenditionService2Impl implements RenditionService2, InitializingBea
                         (transformInputStream == null ? " to null as the transform failed" : " to the transform result"));
             }
 
-            AuthenticationUtil.runAsSystem((AuthenticationUtil.RunAsWork<Void>) () ->
-                    transactionService.getRetryingTransactionHelper().doInTransaction(() ->
+            AuthenticationUtil.runAsSystem((AuthenticationUtil.RunAsWork<Void>) () -> transactionService.getRetryingTransactionHelper().doInTransaction(() -> {
+                // Ensure that the creation of a rendition does not cause updates to the modified, modifier properties on the source node
+                NodeRef renditionNode = getRenditionNode(sourceNodeRef, renditionName);
+                boolean createRenditionNode = renditionNode == null;
+                boolean sourceHasAspectRenditioned = nodeService.hasAspect(sourceNodeRef, RenditionModel.ASPECT_RENDITIONED);
+                try
+                {
+                    ruleService.disableRuleType(RuleType.UPDATE);
+                    behaviourFilter.disableBehaviour(sourceNodeRef, ContentModel.ASPECT_AUDITABLE);
+                    behaviourFilter.disableBehaviour(sourceNodeRef, ContentModel.ASPECT_VERSIONABLE);
+
+                    // If they do not exist create the rendition association and the rendition node.
+                    if (createRenditionNode)
+                    {
+                        renditionNode = createRenditionNode(sourceNodeRef, renditionDefinition);
+                    }
+                    else if (!nodeService.hasAspect(renditionNode, RenditionModel.ASPECT_RENDITION2))
+                    {
+                        nodeService.addAspect(renditionNode, RenditionModel.ASPECT_RENDITION2, null);
+                        if (logger.isDebugEnabled())
+                        {
+                            logger.debug("Added rendition2 aspect to rendition " + renditionName + " on " + sourceNodeRef);
+                        }
+                    }
+                    if (logger.isDebugEnabled())
+                    {
+                        logger.debug("Set ThumbnailLastModified for " + renditionName);
+                    }
+                    setThumbnailLastModified(sourceNodeRef, renditionName);
+
+                    if (transformInputStream != null)
                     {
-                        // Ensure that the creation of a rendition does not cause updates to the modified, modifier properties on the source node
-                        NodeRef renditionNode = getRenditionNode(sourceNodeRef, renditionName);
-                        boolean createRenditionNode = renditionNode == null;
-                        boolean sourceHasAspectRenditioned = nodeService.hasAspect(sourceNodeRef, RenditionModel.ASPECT_RENDITIONED);
                         try
                         {
-                            ruleService.disableRuleType(RuleType.UPDATE);
-                            behaviourFilter.disableBehaviour(sourceNodeRef, ContentModel.ASPECT_AUDITABLE);
-                            behaviourFilter.disableBehaviour(sourceNodeRef, ContentModel.ASPECT_VERSIONABLE);
+                            // Set or replace rendition content
+                            ContentWriter contentWriter = contentService.getWriter(renditionNode, DEFAULT_RENDITION_CONTENT_PROP, true);
+                            String targetMimetype = renditionDefinition.getTargetMimetype();
+                            contentWriter.setMimetype(targetMimetype);
+                            contentWriter.setEncoding(DEFAULT_ENCODING);
+                            ContentWriter renditionWriter = contentWriter;
+                            renditionWriter.putContent(transformInputStream);
 
-                            // If they do not exist create the rendition association and the rendition node.
-                            if (createRenditionNode)
+                            ContentReader contentReader = renditionWriter.getReader();
+                            long sizeOfRendition = contentReader.getSize();
+                            if (sizeOfRendition > 0L)
                             {
-                                renditionNode = createRenditionNode(sourceNodeRef, renditionDefinition);
-                            }
-                            else if (!nodeService.hasAspect(renditionNode, RenditionModel.ASPECT_RENDITION2))
-                            {
-                                nodeService.addAspect(renditionNode, RenditionModel.ASPECT_RENDITION2, null);
                                 if (logger.isDebugEnabled())
                                 {
-                                    logger.debug("Added rendition2 aspect to rendition " + renditionName + " on " + sourceNodeRef);
-                                }
-                            }
-                            if (logger.isDebugEnabled())
-                            {
-                                logger.debug("Set ThumbnailLastModified for " + renditionName);
-                            }
-                            setThumbnailLastModified(sourceNodeRef, renditionName);
-
-                            if (transformInputStream != null)
-                            {
-                                try
-                                {
-                                    // Set or replace rendition content
-                                    ContentWriter contentWriter = contentService.getWriter(renditionNode, DEFAULT_RENDITION_CONTENT_PROP, true);
-                                    String targetMimetype = renditionDefinition.getTargetMimetype();
-                                    contentWriter.setMimetype(targetMimetype);
-                                    contentWriter.setEncoding(DEFAULT_ENCODING);
-                                    ContentWriter renditionWriter = contentWriter;
-                                    renditionWriter.putContent(transformInputStream);
-
-                                    ContentReader contentReader = renditionWriter.getReader();
-                                    long sizeOfRendition = contentReader.getSize();
-                                    if (sizeOfRendition > 0L)
-                                    {
-                                        if (logger.isDebugEnabled()) {
-                                            logger.debug("Set rendition hashcode for " + renditionName);
-                                        }
-                                        nodeService.setProperty(renditionNode, RenditionModel.PROP_RENDITION_CONTENT_HASH_CODE, transformContentHashCode);
-                                    }
-                                    else
-                                    {
-                                        logger.error("Transform was zero bytes for " + renditionName + " on " + sourceNodeRef);
-                                        clearRenditionContentData(renditionNode);
-                                    }
-                                }
-                                catch (Exception e)
-                                {
-                                    logger.error("Failed to copy transform InputStream into rendition " + renditionName + " on " + sourceNodeRef);
-                                    throw e;
+                                    logger.debug("Set rendition hashcode for " + renditionName);
                                 }
+                                nodeService.setProperty(renditionNode, RenditionModel.PROP_RENDITION_CONTENT_HASH_CODE, transformContentHashCode);
                             }
                             else
                             {
+                                logger.error("Transform was zero bytes for " + renditionName + " on " + sourceNodeRef);
                                 clearRenditionContentData(renditionNode);
                             }
-
-                            if (!sourceHasAspectRenditioned)
-                            {
-                                nodeService.addAspect(sourceNodeRef, RenditionModel.ASPECT_RENDITIONED, null);
-                            }
                         }
                         catch (Exception e)
                         {
-                            throw new RenditionService2Exception(TRANSFORMING_ERROR_MESSAGE + e.getMessage(), e);
+                            logger.error("Failed to copy transform InputStream into rendition " + renditionName + " on " + sourceNodeRef);
+                            throw e;
                         }
-                        finally
-                        {
-                            behaviourFilter.enableBehaviour(sourceNodeRef, ContentModel.ASPECT_AUDITABLE);
-                            behaviourFilter.enableBehaviour(sourceNodeRef, ContentModel.ASPECT_VERSIONABLE);
-                            ruleService.enableRuleType(RuleType.UPDATE);
-                        }
-                        return null;
-                    }, false, true));
+                    }
+                    else
+                    {
+                        clearRenditionContentData(renditionNode);
+                    }
+
+                    if (!sourceHasAspectRenditioned)
+                    {
+                        nodeService.addAspect(sourceNodeRef, RenditionModel.ASPECT_RENDITIONED, null);
+                    }
+                }
+                catch (Exception e)
+                {
+                    throw new RenditionService2Exception(TRANSFORMING_ERROR_MESSAGE + e.getMessage(), e);
+                }
+                finally
+                {
+                    behaviourFilter.enableBehaviour(sourceNodeRef, ContentModel.ASPECT_AUDITABLE);
+                    behaviourFilter.enableBehaviour(sourceNodeRef, ContentModel.ASPECT_VERSIONABLE);
+                    ruleService.enableRuleType(RuleType.UPDATE);
+                }
+                return null;
+            }, false, true));
         }
     }
 
@@ -634,14 +633,14 @@ public class RenditionService2Impl implements RenditionService2, InitializingBea
 
         if (logger.isTraceEnabled())
         {
-            logger.trace("Setting thumbnail last modified date to " + lastModifiedValue +" on source node: " + sourceNodeRef);
+            logger.trace("Setting thumbnail last modified date to " + lastModifiedValue + " on source node: " + sourceNodeRef);
         }
 
         if (nodeService.hasAspect(sourceNodeRef, ContentModel.ASPECT_THUMBNAIL_MODIFICATION))
         {
             List<String> thumbnailMods = (List<String>) nodeService.getProperty(sourceNodeRef, ContentModel.PROP_LAST_THUMBNAIL_MODIFICATION_DATA);
             String target = null;
-            for (String currThumbnailMod: thumbnailMods)
+            for (String currThumbnailMod : thumbnailMods)
             {
                 if (currThumbnailMod.startsWith(prefix))
                 {
@@ -665,8 +664,7 @@ public class RenditionService2Impl implements RenditionService2, InitializingBea
     }
 
     /**
-     * Returns the hash code of the source node's content url. As transformations may be returned in a different
-     * sequences to which they were requested, this is used work out if a rendition should be replaced.
+     * Returns the hash code of the source node's content url. As transformations may be returned in a different sequences to which they were requested, this is used work out if a rendition should be replaced.
      */
     private int getSourceContentHashCode(NodeRef sourceNodeRef)
     {
@@ -675,7 +673,7 @@ public class RenditionService2Impl implements RenditionService2, InitializingBea
         if (contentData != null)
         {
             // Originally we used the contentData URL, but that is not enough if the mimetype changes.
-            String contentString = contentData.getContentUrl()+contentData.getMimetype();
+            String contentString = contentData.getContentUrl() + contentData.getMimetype();
             if (contentString != null)
             {
                 hashCode = contentString.hashCode();
@@ -685,13 +683,11 @@ public class RenditionService2Impl implements RenditionService2, InitializingBea
     }
 
     /**
-     * Returns the hash code of source node's content url on the rendition node (node may be null) if it does not exist.
-     * Used work out if a rendition should be replaced. {@code -2} is returned if the rendition does not exist or was
-     * not created by RenditionService2. {@code -1} is returned if there was no source content or the rendition failed.
+     * Returns the hash code of source node's content url on the rendition node (node may be null) if it does not exist. Used work out if a rendition should be replaced. {@code -2} is returned if the rendition does not exist or was not created by RenditionService2. {@code -1} is returned if there was no source content or the rendition failed.
      */
     private int getRenditionContentHashCode(NodeRef renditionNode)
     {
-        if ( renditionNode == null || !nodeService.hasAspect(renditionNode, RenditionModel.ASPECT_RENDITION2))
+        if (renditionNode == null || !nodeService.hasAspect(renditionNode, RenditionModel.ASPECT_RENDITION2))
         {
             return RENDITION2_DOES_NOT_EXIST;
         }
@@ -699,7 +695,7 @@ public class RenditionService2Impl implements RenditionService2, InitializingBea
         Serializable hashCode = nodeService.getProperty(renditionNode, PROP_RENDITION_CONTENT_HASH_CODE);
         return hashCode == null
                 ? SOURCE_HAS_NO_CONTENT
-                : (int)hashCode;
+                : (int) hashCode;
     }
 
     private NodeRef getRenditionNode(NodeRef sourceNodeRef, String renditionName)
@@ -773,11 +769,12 @@ public class RenditionService2Impl implements RenditionService2, InitializingBea
     }
 
     /**
-     * This method checks whether the specified source node is of a content class which has been registered for
-     * rendition prevention.
+     * This method checks whether the specified source node is of a content class which has been registered for rendition prevention.
      *
-     * @param sourceNode the node to check.
-     * @throws RenditionService2PreventedException if the source node is configured for rendition prevention.
+     * @param sourceNode
+     *            the node to check.
+     * @throws RenditionService2PreventedException
+     *             if the source node is configured for rendition prevention.
      */
     // This code is based on the old RenditionServiceImpl.checkSourceNodeForPreventionClass(...)
     private void checkSourceNodeForPreventionClass(NodeRef sourceNode)
@@ -823,7 +820,7 @@ public class RenditionService2Impl implements RenditionService2, InitializingBea
 
         for (ChildAssociationRef childAssoc : childAsocs)
         {
-            NodeRef renditionNode =  childAssoc.getChildRef();
+            NodeRef renditionNode = childAssoc.getChildRef();
             if (isRenditionAvailable(sourceNodeRef, renditionNode))
             {
                 result.add(childAssoc);
@@ -833,8 +830,7 @@ public class RenditionService2Impl implements RenditionService2, InitializingBea
     }
 
     /**
-     * Indicates if the rendition is available. Failed renditions (there was an error) don't have a contentUrl
-     * and out of date renditions or those still being created don't have a matching contentHashCode.
+     * Indicates if the rendition is available. Failed renditions (there was an error) don't have a contentUrl and out of date renditions or those still being created don't have a matching contentHashCode.
      */
     public boolean isRenditionAvailable(NodeRef sourceNodeRef, NodeRef renditionNode)
     {
@@ -852,7 +848,7 @@ public class RenditionService2Impl implements RenditionService2, InitializingBea
                 int renditionContentHashCode = getRenditionContentHashCode(renditionNode);
                 if (logger.isDebugEnabled())
                 {
-                    logger.debug("isRenditionAvailable source " + sourceContentHashCode + " and rendition " + renditionContentHashCode+" hashcodes");
+                    logger.debug("isRenditionAvailable source " + sourceContentHashCode + " and rendition " + renditionContentHashCode + " hashcodes");
                 }
                 if (sourceContentHashCode != renditionContentHashCode)
                 {
@@ -892,19 +888,17 @@ public class RenditionService2Impl implements RenditionService2, InitializingBea
             }
             ChildAssociationRef childAssoc = renditions.get(0);
             NodeRef renditionNode = childAssoc.getChildRef();
-            return !isRenditionAvailable(sourceNodeRef, renditionNode) ? null: childAssoc;
+            return !isRenditionAvailable(sourceNodeRef, renditionNode) ? null : childAssoc;
         }
     }
 
     @Override
     public void clearRenditionContentDataInTransaction(NodeRef renditionNode)
     {
-        AuthenticationUtil.runAsSystem((AuthenticationUtil.RunAsWork<Void>) () ->
-                transactionService.getRetryingTransactionHelper().doInTransaction(() ->
-                {
-                    clearRenditionContentData(renditionNode);
-                    return null;
-                }, false, true));
+        AuthenticationUtil.runAsSystem((AuthenticationUtil.RunAsWork<Void>) () -> transactionService.getRetryingTransactionHelper().doInTransaction(() -> {
+            clearRenditionContentData(renditionNode);
+            return null;
+        }, false, true));
     }
 
     @Override
@@ -950,4 +944,54 @@ public class RenditionService2Impl implements RenditionService2, InitializingBea
         }
     }
 
+    @Override
+    public void forceRenditionsContentHashCode(NodeRef sourceNodeRef)
+    {
+        if (sourceNodeRef != null && nodeService.exists(sourceNodeRef))
+        {
+            List<ChildAssociationRef> renditions = getRenditionChildAssociations(sourceNodeRef);
+            if (renditions != null)
+            {
+                int sourceContentHashCode = getSourceContentHashCode(sourceNodeRef);
+                for (ChildAssociationRef rendition : renditions)
+                {
+                    NodeRef renditionNode = rendition.getChildRef();
+                    if (nodeService.hasAspect(renditionNode, RenditionModel.ASPECT_RENDITION2))
+                    {
+                        int renditionContentHashCode = getRenditionContentHashCode(renditionNode);
+                        String renditionName = rendition.getQName().getLocalName();
+                        if (sourceContentHashCode != renditionContentHashCode)
+                        {
+                            if (logger.isDebugEnabled())
+                            {
+                                logger.debug("Update content hash code for rendition " + renditionName + " of node "
+                                        + sourceNodeRef);
+                            }
+                            nodeService.setProperty(renditionNode, PROP_RENDITION_CONTENT_HASH_CODE,
+                                    sourceContentHashCode);
+                        }
+                    }
+                }
+            }
+        }
+    }
+
+    // Checks if the given transform callback is a text extract transform for content indexing or metadata extract/embed.
+    private boolean isTextOrMetadataExtractTransform(RenderOrTransformCallBack renderOrTransform)
+    {
+        RenditionDefinition2 renditionDefinition = renderOrTransform.getRenditionDefinition();
+        return renditionDefinition != null && ALLOWED_MIMETYPES.contains(renditionDefinition.getTargetMimetype());
+    }
+
+    private boolean isAsyncAllowed(RenderOrTransformCallBack renderOrTransform)
+    {
+        // If enabled is false, all async transforms/renditions must be blocked
+        if (!enabled)
+        {
+            return false;
+        }
+
+        // If thumbnails are disabled, allow only text extract or metadata extract/embed transforms
+        return thumbnailsEnabled || isTextOrMetadataExtractTransform(renderOrTransform);
+    }
 }

repository/src/main/java/org/alfresco/repo/workflow/activiti/script/ActivitiScriptBase.java

@@ -28,11 +28,17 @@ package org.alfresco.repo.workflow.activiti.script;
 
 import java.util.Map;
 
+import org.activiti.engine.RepositoryService;
 import org.activiti.engine.delegate.VariableScope;
 import org.activiti.engine.impl.cfg.ProcessEngineConfigurationImpl;
 import org.activiti.engine.impl.context.Context;
 import org.activiti.engine.impl.el.Expression;
 import org.activiti.engine.impl.persistence.entity.DeploymentEntity;
+import org.activiti.engine.impl.persistence.entity.ExecutionEntity;
+import org.activiti.engine.repository.ProcessDefinition;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
 import org.alfresco.repo.security.authentication.AuthenticationUtil;
 import org.alfresco.repo.security.authentication.AuthenticationUtil.RunAsWork;
 import org.alfresco.repo.workflow.WorkflowDeployer;
@@ -45,13 +51,12 @@ import org.alfresco.service.cmr.security.PersonService;
 import org.alfresco.service.cmr.workflow.WorkflowException;
 
 /**
- * Base class for execution scripts, using {@link ScriptService} as part of
- * activiti workflow.
+ * Base class for execution scripts, using {@link ScriptService} as part of activiti workflow.
  *
  * @author Frederik Heremans
  * @since 3.4.e
  */
-public class ActivitiScriptBase 
+public class ActivitiScriptBase
 {
     protected static final String PERSON_BINDING_NAME = "person";
     protected static final String USERHOME_BINDING_NAME = "userhome";
@@ -61,17 +66,19 @@ public class ActivitiScriptBase
     protected Expression runAs;
     protected Expression scriptProcessor;
 
+    private static final Logger LOGGER = LoggerFactory.getLogger(ActivitiScriptBase.class);
+
     protected Object executeScript(String theScript, Map<String, Object> model, String scriptProcessorName, String runAsUser)
     {
         String user = AuthenticationUtil.getFullyAuthenticatedUser();
-        
+
         Object scriptResult = null;
         if (runAsUser == null && user != null)
         {
             // Just execute the script using the current user
             scriptResult = executeScript(theScript, model, scriptProcessorName);
         }
-        else 
+        else
         {
             if (runAsUser != null)
             {
@@ -87,26 +94,25 @@ public class ActivitiScriptBase
         }
         return scriptResult;
     }
-    
+
     protected Object executeScriptAsUser(final String theScript, final Map<String, Object> model, final String scriptProcessorName, final String runAsUser)
     {
         // execute as specified runAsUser
-        return AuthenticationUtil.runAs(new AuthenticationUtil.RunAsWork<Object>()
-        {
+        return AuthenticationUtil.runAs(new AuthenticationUtil.RunAsWork<Object>() {
             public Object doWork() throws Exception
             {
                 return executeScript(theScript, model, scriptProcessorName);
             }
         }, runAsUser);
     }
-    
+
     protected Object executeScript(String theScript, Map<String, Object> model, String scriptProcessorName)
     {
         // Execute the script using the appropriate processor
         Object scriptResult = null;
 
         // Checks if current workflow is secure
-        boolean secure = isSecure();
+        boolean secure = isSecure(model);
 
         if (scriptProcessorName != null)
         {
@@ -117,11 +123,11 @@ public class ActivitiScriptBase
             // Use default script-processor
             scriptResult = getServiceRegistry().getScriptService().executeScriptString(theScript, model, secure);
         }
-        
+
         return scriptResult;
     }
-    
-    protected String getStringValue(Expression expression, VariableScope scope) 
+
+    protected String getStringValue(Expression expression, VariableScope scope)
     {
         if (expression != null)
         {
@@ -133,15 +139,15 @@ public class ActivitiScriptBase
     protected ServiceRegistry getServiceRegistry()
     {
         ProcessEngineConfigurationImpl config = Context.getProcessEngineConfiguration();
-        if (config != null) 
+        if (config != null)
         {
             // Fetch the registry that is injected in the activiti spring-configuration
             ServiceRegistry registry = (ServiceRegistry) config.getBeans().get(ActivitiConstants.SERVICE_REGISTRY_BEAN_KEY);
             if (registry == null)
             {
                 throw new RuntimeException(
-                            "Service-registry not present in ProcessEngineConfiguration beans, expected ServiceRegistry with key" + 
-                            ActivitiConstants.SERVICE_REGISTRY_BEAN_KEY);
+                        "Service-registry not present in ProcessEngineConfiguration beans, expected ServiceRegistry with key" +
+                                ActivitiConstants.SERVICE_REGISTRY_BEAN_KEY);
             }
             return registry;
         }
@@ -149,42 +155,136 @@ public class ActivitiScriptBase
     }
 
     /**
-     * Checks whether the workflow must be considered secure or not - based on {@link DeploymentEntity} category.
-     * If it is not considered secure, the workflow will be executed in sandbox context with more restrictions
+     * Checks whether the workflow must be considered secure or not - based on {@link DeploymentEntity} category. If it is not considered secure, the workflow will be executed in sandbox context with more restrictions
      *
      * @return true if workflow is considered secure, false otherwise
      */
-    private boolean isSecure()
+    private boolean isSecure(Map<String, Object> model)
+    {
+        String category = getDeploymentCategory(model);
+
+        // iF The deployment category matches the condition (either internal or full access) the workflow is considered secure
+        return category != null && (WorkflowDeployer.CATEGORY_ALFRESCO_INTERNAL.equals(category) || WorkflowDeployer.CATEGORY_FULL_ACCESS.equals(category));
+    }
+
+    /**
+     * Gets the deployment category from the execution context. If no execution context is available, a query to obtain the deployment is performed so the category can be returned.
+     * 
+     * @param model
+     *            a map with workflow model
+     * @return the deployment category
+     */
+    private String getDeploymentCategory(Map<String, Object> model)
+    {
+        String category = getDeploymentCategoryFromContext();
+
+        if (category == null)
+        {
+            String deploymentId = null;
+            String processDefinitionId = null;
+
+            if (model != null && model.containsKey(EXECUTION_BINDING_NAME) && model.get(EXECUTION_BINDING_NAME) instanceof ExecutionEntity)
+            {
+                ExecutionEntity executionEntity = (ExecutionEntity) model.get(EXECUTION_BINDING_NAME);
+                deploymentId = executionEntity.getDeploymentId();
+                processDefinitionId = executionEntity.getProcessDefinitionId();
+            }
+
+            category = getDeploymentCategoryFromQuery(deploymentId, processDefinitionId);
+        }
+
+        return category;
+    }
+
+    /**
+     * Obtains the deployment category from current execution context
+     * 
+     * @return the category for current execution deployment, otherwise null
+     */
+    private String getDeploymentCategoryFromContext()
     {
         String category = null;
-
         try
         {
             if (Context.isExecutionContextActive())
             {
                 category = Context.getExecutionContext().getDeployment().getCategory();
             }
+            else
+            {
+                if (LOGGER.isDebugEnabled())
+                {
+                    LOGGER.debug("No execution context available");
+                }
+            }
         }
         catch (Exception e)
         {
-            // No action required
+            if (LOGGER.isDebugEnabled())
+            {
+                LOGGER.debug("Could not obtain deployment category from execution context: {}", e.getMessage());
+            }
         }
 
-        // If the workflow is considered secure, the deployment entity category matches the condition (either internal or full access)
-        return category != null && (WorkflowDeployer.CATEGORY_ALFRESCO_INTERNAL.equals(category) || WorkflowDeployer.CATEGORY_FULL_ACCESS.equals(category));
+        return category;
     }
 
     /**
-     * Checks that the specified 'runAs' field
-     * specifies a valid username.
+     * Obtains the deployment category through a query
+     * 
+     * @param deploymentId
+     *            the deployment id to obtain the category from
+     * @param processDefinitionId
+     *            if no deployment id is provided, the process definition id can be used to obtain the deployment
+     * @return the category for the obtained deployment, otherwise null
      */
-    private void validateRunAsUser(final String runAsUser) 
+    private String getDeploymentCategoryFromQuery(String deploymentId, String processDefinitionId)
     {
-        Boolean runAsExists = AuthenticationUtil.runAs(new RunAsWork<Boolean>()
+        String category = null;
+
+        try
         {
+            RepositoryService repositoryService = Context.getProcessEngineConfiguration().getRepositoryService();
+
+            if (deploymentId == null && processDefinitionId != null)
+            {
+                ProcessDefinition processDefnition = repositoryService.getProcessDefinition(processDefinitionId);
+                if (processDefnition != null)
+                {
+                    deploymentId = processDefnition.getDeploymentId();
+                }
+            }
+
+            if (deploymentId != null)
+            {
+                DeploymentEntity deployment = (DeploymentEntity) repositoryService.createDeploymentQuery().deploymentId(deploymentId).singleResult();
+                if (deployment != null)
+                {
+                    category = deployment.getCategory();
+                }
+            }
+        }
+        catch (Exception e)
+        {
+            if (LOGGER.isDebugEnabled())
+            {
+                LOGGER.debug("Could not obtain deployment category through a query: {}", e.getMessage());
+            }
+        }
+
+        return category;
+    }
+
+    /**
+     * Checks that the specified 'runAs' field specifies a valid username.
+     */
+    private void validateRunAsUser(final String runAsUser)
+    {
+        Boolean runAsExists = AuthenticationUtil.runAs(new RunAsWork<Boolean>() {
             // Validate using System user to ensure sufficient permissions available to access person node.
 
-            public Boolean doWork() throws Exception 
+            @Override
+            public Boolean doWork() throws Exception
             {
                 return getServiceRegistry().getPersonService().personExists(runAsUser);
             }
@@ -195,21 +295,21 @@ public class ActivitiScriptBase
             throw new WorkflowException("runas user '" + runAsUser + "' does not exist.");
         }
     }
-    
+
     protected ActivitiScriptNode getPersonNode(String runAsUser)
     {
         String userName = null;
-        if (runAsUser != null) 
+        if (runAsUser != null)
         {
             userName = runAsUser;
         }
-        else 
+        else
         {
             userName = AuthenticationUtil.getFullyAuthenticatedUser();
         }
-        
+
         // The "System" user is a special case, which has no person object associated with it.
-        if(userName != null && !AuthenticationUtil.SYSTEM_USER_NAME.equals(userName))
+        if (userName != null && !AuthenticationUtil.SYSTEM_USER_NAME.equals(userName))
         {
             ServiceRegistry services = getServiceRegistry();
             PersonService personService = services.getPersonService();
@@ -221,18 +321,18 @@ public class ActivitiScriptBase
         }
         return null;
     }
-    
-    public void setScript(Expression script) 
+
+    public void setScript(Expression script)
     {
         this.script = script;
     }
 
-    public void setRunAs(Expression runAs) 
+    public void setRunAs(Expression runAs)
     {
         this.runAs = runAs;
     }
 
-    public void setScriptProcessor(Expression scriptProcessor) 
+    public void setScriptProcessor(Expression scriptProcessor)
     {
         this.scriptProcessor = scriptProcessor;
     }

repository/src/main/resources/alfresco/events2-context.xml

@@ -3,23 +3,30 @@
 
 <beans>
 
+    <bean id="event2TypeDefExpander" class="org.alfresco.repo.event2.shared.TypeDefExpander">
+        <constructor-arg ref="dictionaryService"/>
+        <constructor-arg ref="namespaceService"/>
+    </bean>
+
     <!-- Event2 Filters -->
     <bean id="event2FilterRegistry" class="org.alfresco.repo.event2.filter.EventFilterRegistry"/>
 
     <bean id="abstractNodeEventFilter" class="org.alfresco.repo.event2.filter.AbstractNodeEventFilter" abstract="true" init-method="init">
-        <property name="dictionaryService" ref="dictionaryService"/>
-        <property name="namespaceService" ref="namespaceService"/>
+        <property name="typeDefExpander" ref="event2TypeDefExpander"/>
     </bean>
 
     <bean id="event2NodeTypeFilter" class="org.alfresco.repo.event2.filter.NodeTypeFilter" parent="abstractNodeEventFilter">
         <constructor-arg value="${repo.event2.filter.nodeTypes}"/>
+        <constructor-arg ref="dictionaryService"/>
     </bean>
 
     <bean id="event2NodeAspectFilter" class="org.alfresco.repo.event2.filter.NodeAspectFilter" parent="abstractNodeEventFilter">
         <constructor-arg value="${repo.event2.filter.nodeAspects}"/>
     </bean>
 
-    <bean id="event2NodePropertyFilter" class="org.alfresco.repo.event2.filter.NodePropertyFilter" parent="abstractNodeEventFilter"/>
+    <bean id="event2NodePropertyFilter" class="org.alfresco.repo.event2.filter.NodePropertyFilter" parent="abstractNodeEventFilter">
+        <constructor-arg value="${repo.event2.filter.nodeProperties}"/>
+    </bean>
 
     <bean id="event2UserFilter" class="org.alfresco.repo.event2.filter.EventUserFilter">
         <constructor-arg value="${repo.event2.filter.users}"/>
@@ -31,6 +38,16 @@
     </bean>
     <!-- End of Event2 Filters -->
 
+    <bean id="event2PropertyMapperFactory" class="org.alfresco.repo.event2.mapper.PropertyMapperFactory">
+        <constructor-arg ref="event2TypeDefExpander"/>
+    </bean>
+
+    <bean id="event2PropertyMapper" factory-bean="event2PropertyMapperFactory" factory-method="createPropertyMapper">
+        <constructor-arg value="${repo.event2.mapper.enabled}"/>
+        <constructor-arg value="${repo.event2.mapper.overrideDefaultProperties}"/>
+        <constructor-arg value="${repo.event2.mapper.overrideReplacementText}"/>
+    </bean>
+
     <bean id="baseEventGeneratorV2" abstract="true">
         <property name="policyComponent" ref="policyComponent"/>
         <property name="nodeService" ref="nodeService"/>
@@ -53,6 +70,7 @@
         <property name="eventFilterRegistry" ref="event2FilterRegistry"/>
         <property name="namespaceService" ref="namespaceService"/>
         <property name="permissionService" ref="permissionService"/>
+        <property name="propertyMapper" ref="event2PropertyMapper"/>
     </bean>
 
     <bean id="baseEventSender" abstract="true">

repository/src/main/resources/alfresco/rendition-services2-context.xml

@@ -82,6 +82,7 @@
         <property name="contentService" ref="contentService" />
         <property name="renditionService2" ref="renditionService2" />
         <property name="directAccessUrlEnabled" value="${local.transform.directAccessUrl.enabled}"/>
+        <property name="threadPoolSize" value="${local.transform.threadPoolSize}" />
     </bean>
 
     <bean id="synchronousTransformClient" parent="localSynchronousTransformClient" />

repository/src/main/resources/alfresco/repository.properties

@@ -1234,6 +1234,10 @@ repo.event2.filter.childAssocTypes=rn:rendition
 # Comma separated list of users which should be excluded
 # Note: username's case-sensitivity depends on the {user.name.caseSensitive} setting
 repo.event2.filter.users=
+repo.event2.filter.nodeProperties=
+repo.event2.mapper.enabled=true
+repo.event2.mapper.overrideDefaultProperties=
+repo.event2.mapper.overrideReplacementText=
 # Topic name
 repo.event2.topic.endpoint=amqp:topic:alfresco.repo.event2
 # Specifies the strategy for sending the events
@@ -1347,6 +1351,9 @@ restApi.directAccessUrl.defaultExpiryTimeInSec=30
 # Controls whether direct access url URLs may be used in transforms.
 local.transform.directAccessUrl.enabled=true
 
+# Controls size of thread pool used for transforms.
+local.transform.threadPoolSize=8
+
 # Creates additional indexes on alf_node and alf_transaction. Recommended for large repositories.
 system.new-node-transaction-indexes.ignored=true
 

repository/src/test/java/org/alfresco/repo/action/executer/AddFeaturesActionExecuterTest.java

@@ -1,164 +1,177 @@
-/*
- * #%L
- * Alfresco Repository
- * %%
- * Copyright (C) 2005 - 2016 Alfresco Software Limited
- * %%
- * This file is part of the Alfresco software. 
- * If the software was purchased under a paid Alfresco license, the terms of 
- * the paid license agreement will prevail.  Otherwise, the software is 
- * provided under the following open source license terms:
- * 
- * Alfresco is free software: you can redistribute it and/or modify
- * it under the terms of the GNU Lesser General Public License as published by
- * the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- * 
- * Alfresco is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU Lesser General Public License for more details.
- * 
- * You should have received a copy of the GNU Lesser General Public License
- * along with Alfresco. If not, see <http://www.gnu.org/licenses/>.
- * #L%
- */
-package org.alfresco.repo.action.executer;
-
-import java.util.List;
-import java.util.Locale;
-
-import org.alfresco.model.ContentModel;
-import org.alfresco.repo.action.ActionImpl;
-import org.alfresco.repo.security.authentication.AuthenticationComponent;
-import org.alfresco.service.cmr.action.ActionDefinition;
-import org.alfresco.service.cmr.action.ParameterDefinition;
-import org.alfresco.service.cmr.repository.NodeRef;
-import org.alfresco.service.cmr.repository.NodeService;
-import org.alfresco.service.cmr.repository.StoreRef;
-import org.alfresco.service.namespace.QName;
-import org.alfresco.util.BaseSpringTest;
-import org.alfresco.util.GUID;
-import org.junit.Before;
-import org.junit.Test;
-import org.springframework.extensions.surf.util.I18NUtil;
-import org.springframework.transaction.annotation.Transactional;
-
-/**
- * Add features action execution test
- * 
- * @author Roy Wetherall
- */
-@Transactional
-public class AddFeaturesActionExecuterTest extends BaseSpringTest
-{
-    /**
-     * The node service
-     */
-    private NodeService nodeService;
-    
-    /**
-     * The store reference
-     */
-    private StoreRef testStoreRef;
-    
-    /**
-     * The root node reference
-     */
-    private NodeRef rootNodeRef;
-    
-    /**
-     * The test node reference
-     */
-    private NodeRef nodeRef;
-    
-    /**
-     * The add features action executer
-     */
-    private AddFeaturesActionExecuter executer;
-    
-    /**
-     * Id used to identify the test action created
-     */
-    private final static String ID = GUID.generate();
-    
-    /**
-     * Called at the begining of all tests
-     */
-    @Before
-    public void before() throws Exception
-    {
-        this.nodeService = (NodeService)this.applicationContext.getBean("nodeService");
-        
-        AuthenticationComponent authenticationComponent = (AuthenticationComponent)applicationContext.getBean("authenticationComponent");
-        authenticationComponent.setCurrentUser(authenticationComponent.getSystemUserName());
-        
-        // Create the store and get the root node
-        this.testStoreRef = this.nodeService.createStore(
-                StoreRef.PROTOCOL_WORKSPACE, "Test_"
-                        + System.currentTimeMillis());
-        this.rootNodeRef = this.nodeService.getRootNode(this.testStoreRef);
-
-        // Create the node used for tests
-        this.nodeRef = this.nodeService.createNode(
-                this.rootNodeRef,
-                ContentModel.ASSOC_CHILDREN,
-                QName.createQName("{test}testnode"),
-                ContentModel.TYPE_CONTENT).getChildRef();
-        
-        // Get the executer instance 
-        this.executer = (AddFeaturesActionExecuter)this.applicationContext.getBean(AddFeaturesActionExecuter.NAME);
-    }
-    
-    /**
-     * Test execution
-     */
-    @Test
-    public void testExecution()
-    {
-        // Check that the node does not have the classifiable aspect
-        assertFalse(this.nodeService.hasAspect(this.nodeRef, ContentModel.ASPECT_CLASSIFIABLE));
-        
-        // Execute the action
-        ActionImpl action = new ActionImpl(null, ID, AddFeaturesActionExecuter.NAME, null);
-        action.setParameterValue(AddFeaturesActionExecuter.PARAM_ASPECT_NAME, ContentModel.ASPECT_CLASSIFIABLE);
-        this.executer.execute(action, this.nodeRef);
-        
-        // Check that the node now has the classifiable aspect applied
-        assertTrue(this.nodeService.hasAspect(this.nodeRef, ContentModel.ASPECT_CLASSIFIABLE));
-    }
-    
-    /**
-     * MNT-15802
-     */
-    @Test
-    public void testCheckLocalizedParamDefintionWithConstraint()
-    {
-        // test for other than default locale
-        I18NUtil.setLocale(Locale.GERMAN);
-
-        ActionDefinition actionDef = executer.getActionDefinition();
-
-        List<ParameterDefinition> paramDef = actionDef.getParameterDefinitions();
-        assertNotNull(paramDef);
-
-        String constraintName = paramDef.get(0).getParameterConstraintName();
-        assertNotNull(constraintName);
-        assertEquals(AddFeaturesActionExecuter.PARAM_CONSTRAINT, constraintName);
-
-        // test for other than default locale
-        I18NUtil.setLocale(Locale.ITALY);
-
-        actionDef = executer.getActionDefinition();
-
-        paramDef = actionDef.getParameterDefinitions();
-        assertNotNull(paramDef);
-
-        constraintName = paramDef.get(0).getParameterConstraintName();
-        assertNotNull(constraintName);
-        assertEquals(AddFeaturesActionExecuter.PARAM_CONSTRAINT, constraintName);
-
-        I18NUtil.setLocale(Locale.getDefault());
-
-    }
-}
+/*
+ * #%L
+ * Alfresco Repository
+ * %%
+ * Copyright (C) 2005 - 2025 Alfresco Software Limited
+ * %%
+ * This file is part of the Alfresco software.
+ * If the software was purchased under a paid Alfresco license, the terms of
+ * the paid license agreement will prevail.  Otherwise, the software is
+ * provided under the following open source license terms:
+ *
+ * Alfresco is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Lesser General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * Alfresco is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public License
+ * along with Alfresco. If not, see <http://www.gnu.org/licenses/>.
+ * #L%
+ */
+package org.alfresco.repo.action.executer;
+
+import java.util.List;
+import java.util.Locale;
+
+import org.junit.Before;
+import org.junit.Test;
+import org.springframework.extensions.surf.util.I18NUtil;
+import org.springframework.transaction.annotation.Transactional;
+
+import org.alfresco.model.ContentModel;
+import org.alfresco.repo.action.ActionImpl;
+import org.alfresco.repo.action.access.ActionAccessRestriction;
+import org.alfresco.repo.security.authentication.AuthenticationComponent;
+import org.alfresco.service.cmr.action.ActionDefinition;
+import org.alfresco.service.cmr.action.ParameterDefinition;
+import org.alfresco.service.cmr.repository.NodeRef;
+import org.alfresco.service.cmr.repository.NodeService;
+import org.alfresco.service.cmr.repository.StoreRef;
+import org.alfresco.service.namespace.QName;
+import org.alfresco.util.BaseSpringTest;
+import org.alfresco.util.GUID;
+
+/**
+ * Add features action execution test
+ *
+ * @author Roy Wetherall
+ */
+@Transactional
+public class AddFeaturesActionExecuterTest extends BaseSpringTest
+{
+    /**
+     * Id used to identify the test action created
+     */
+    private final static String ID = GUID.generate();
+    /**
+     * The node service
+     */
+    private NodeService nodeService;
+    /**
+     * The store reference
+     */
+    private StoreRef testStoreRef;
+    /**
+     * The root node reference
+     */
+    private NodeRef rootNodeRef;
+    /**
+     * The test node reference
+     */
+    private NodeRef nodeRef;
+    /**
+     * The add features action executer
+     */
+    private AddFeaturesActionExecuter executer;
+
+    /**
+     * Called at the begining of all tests
+     */
+    @Before
+    public void before() throws Exception
+    {
+        this.nodeService = (NodeService) this.applicationContext.getBean("nodeService");
+
+        AuthenticationComponent authenticationComponent = (AuthenticationComponent) applicationContext.getBean("authenticationComponent");
+        authenticationComponent.setCurrentUser(authenticationComponent.getSystemUserName());
+
+        // Create the store and get the root node
+        this.testStoreRef = this.nodeService.createStore(
+                StoreRef.PROTOCOL_WORKSPACE, "Test_"
+                        + System.currentTimeMillis());
+        this.rootNodeRef = this.nodeService.getRootNode(this.testStoreRef);
+
+        // Create the node used for tests
+        this.nodeRef = this.nodeService.createNode(
+                this.rootNodeRef,
+                ContentModel.ASSOC_CHILDREN,
+                QName.createQName("{test}testnode"),
+                ContentModel.TYPE_CONTENT).getChildRef();
+
+        // Get the executer instance
+        this.executer = (AddFeaturesActionExecuter) this.applicationContext.getBean(AddFeaturesActionExecuter.NAME);
+    }
+
+    /**
+     * Test execution
+     */
+    @Test
+    public void testExecution()
+    {
+        // Check that the node does not have the classifiable aspect
+        assertFalse(this.nodeService.hasAspect(this.nodeRef, ContentModel.ASPECT_CLASSIFIABLE));
+
+        // Execute the action
+        ActionImpl action = new ActionImpl(null, ID, AddFeaturesActionExecuter.NAME, null);
+        action.setParameterValue(AddFeaturesActionExecuter.PARAM_ASPECT_NAME, ContentModel.ASPECT_CLASSIFIABLE);
+        this.executer.execute(action, this.nodeRef);
+
+        // Check that the node now has the classifiable aspect applied
+        assertTrue(this.nodeService.hasAspect(this.nodeRef, ContentModel.ASPECT_CLASSIFIABLE));
+    }
+
+    /**
+     * MNT-15802
+     */
+    @Test
+    public void testCheckLocalizedParamDefintionWithConstraint()
+    {
+        // test for other than default locale
+        I18NUtil.setLocale(Locale.GERMAN);
+
+        ActionDefinition actionDef = executer.getActionDefinition();
+
+        List<ParameterDefinition> paramDef = actionDef.getParameterDefinitions();
+        assertNotNull(paramDef);
+
+        String constraintName = paramDef.get(0).getParameterConstraintName();
+        assertNotNull(constraintName);
+        assertEquals(AddFeaturesActionExecuter.PARAM_CONSTRAINT, constraintName);
+
+        // test for other than default locale
+        I18NUtil.setLocale(Locale.ITALY);
+
+        actionDef = executer.getActionDefinition();
+
+        paramDef = actionDef.getParameterDefinitions();
+        assertNotNull(paramDef);
+
+        constraintName = paramDef.get(0).getParameterConstraintName();
+        assertNotNull(constraintName);
+        assertEquals(AddFeaturesActionExecuter.PARAM_CONSTRAINT, constraintName);
+
+        I18NUtil.setLocale(Locale.getDefault());
+
+    }
+
+    /**
+     * Test check actionContext param is removed from adhoc properties
+     */
+    @Test
+    public void testCheckActionContext()
+    {
+        // Execute the action
+        ActionImpl action = new ActionImpl(null, ID, AddFeaturesActionExecuter.NAME, null);
+        action.setParameterValue(ActionAccessRestriction.ACTION_CONTEXT_PARAM_NAME, ActionAccessRestriction.V1_ACTION_CONTEXT);
+        action.setParameterValue(AddFeaturesActionExecuter.PARAM_ASPECT_NAME, ContentModel.ASPECT_CLASSIFIABLE);
+        this.executer.execute(action, this.nodeRef);
+
+        // Ensure the actionContext parameter has been removed
+        assertFalse(nodeService.getProperties(this.nodeRef).containsKey(QName.createQName(ActionAccessRestriction.ACTION_CONTEXT_PARAM_NAME)));
+    }
+}

repository/src/test/java/org/alfresco/repo/action/executer/ImporterActionExecuterTest.java

@@ -2,7 +2,7 @@
  * #%L
  * Alfresco Repository
  * %%
- * Copyright (C) 2005 - 2022 Alfresco Software Limited
+ * Copyright (C) 2005 - 2025 Alfresco Software Limited
  * %%
  * This file is part of the Alfresco software. 
  * If the software was purchased under a paid Alfresco license, the terms of 
@@ -34,6 +34,10 @@ import java.io.File;
 import java.io.IOException;
 import java.net.URL;
 
+import org.junit.AfterClass;
+import org.junit.BeforeClass;
+import org.junit.Test;
+
 import org.alfresco.error.AlfrescoRuntimeException;
 import org.alfresco.model.ContentModel;
 import org.alfresco.repo.action.ActionImpl;
@@ -44,7 +48,6 @@ import org.alfresco.repo.transaction.RetryingTransactionHelper;
 import org.alfresco.repo.transaction.RetryingTransactionHelper.RetryingTransactionCallback;
 import org.alfresco.service.ServiceRegistry;
 import org.alfresco.service.cmr.action.Action;
-import org.alfresco.service.cmr.repository.ContentData;
 import org.alfresco.service.cmr.repository.ContentService;
 import org.alfresco.service.cmr.repository.ContentWriter;
 import org.alfresco.service.cmr.repository.NodeRef;
@@ -53,15 +56,13 @@ import org.alfresco.service.cmr.repository.StoreRef;
 import org.alfresco.service.namespace.QName;
 import org.alfresco.util.GUID;
 import org.alfresco.util.test.junitrules.ApplicationContextInit;
-import org.junit.AfterClass;
-import org.junit.BeforeClass;
-import org.junit.Test;
 
 /**
  * This class contains tests for {@link ImporterActionExecuter}.
  * 
  * @author abalmus
  */
+@SuppressWarnings("PMD.JUnitTestsShouldIncludeAssert")
 public class ImporterActionExecuterTest
 {
     // Rule to initialise the default Alfresco spring configuration
@@ -87,8 +88,7 @@ public class ImporterActionExecuterTest
         AuthenticationUtil.setRunAsUserSystem();
 
         // we need a store
-        storeRef = serviceRegistry.getRetryingTransactionHelper().doInTransaction(new RetryingTransactionCallback<StoreRef>()
-        {
+        storeRef = serviceRegistry.getRetryingTransactionHelper().doInTransaction(new RetryingTransactionCallback<StoreRef>() {
             public StoreRef execute()
             {
                 StoreRef storeRef = nodeService.createStore(StoreRef.PROTOCOL_WORKSPACE, "Test_" + System.nanoTime());
@@ -102,8 +102,7 @@ public class ImporterActionExecuterTest
     {
         try
         {
-            serviceRegistry.getRetryingTransactionHelper().doInTransaction(new RetryingTransactionCallback<Void>()
-            {
+            serviceRegistry.getRetryingTransactionHelper().doInTransaction(new RetryingTransactionCallback<Void>() {
                 public Void execute()
                 {
                     if (storeRef != null)
@@ -125,8 +124,7 @@ public class ImporterActionExecuterTest
     {
         final RetryingTransactionHelper retryingTransactionHelper = serviceRegistry.getRetryingTransactionHelper();
 
-        retryingTransactionHelper.doInTransaction(new RetryingTransactionCallback<Void>()
-        {
+        retryingTransactionHelper.doInTransaction(new RetryingTransactionCallback<Void>() {
             public Void execute()
             {
                 NodeRef rootNodeRef = nodeService.getRootNode(storeRef);
@@ -162,8 +160,7 @@ public class ImporterActionExecuterTest
     }
 
     /**
-     * MNT-16292: Unzipped files which have folders do not get the cm:titled
-     * aspect applied
+     * MNT-16292: Unzipped files which have folders do not get the cm:titled aspect applied
      * 
      * @throws IOException
      */
@@ -172,8 +169,7 @@ public class ImporterActionExecuterTest
     {
         final RetryingTransactionHelper retryingTransactionHelper = serviceRegistry.getRetryingTransactionHelper();
 
-        retryingTransactionHelper.doInTransaction(new RetryingTransactionCallback<Void>()
-        {
+        retryingTransactionHelper.doInTransaction(new RetryingTransactionCallback<Void>() {
             public Void execute()
             {
                 NodeRef rootNodeRef = nodeService.getRootNode(storeRef);
@@ -190,7 +186,7 @@ public class ImporterActionExecuterTest
                 {
                     importerActionExecuter.execute(action, zipFileNodeRef);
 
-                    // check if import succeeded 
+                    // check if import succeeded
                     NodeRef importedFolder = nodeService.getChildByName(targetFolderNodeRef, ContentModel.ASSOC_CONTAINS, "folderCmTitledAspectArchive");
                     assertNotNull("import action failed", importedFolder);
 
@@ -199,7 +195,7 @@ public class ImporterActionExecuterTest
                     assertTrue("folder didn't get the cm:titled aspect applied", hasAspectTitled);
 
                     // MNT-17017 check ContentModel.PROP_TITLE is not set on the top level folder, just like Share
-                    String title = (String)nodeService.getProperty(importedFolder, ContentModel.PROP_TITLE);
+                    String title = (String) nodeService.getProperty(importedFolder, ContentModel.PROP_TITLE);
                     assertNull("The title should not have cm:title set", title);
                 }
                 finally
@@ -224,8 +220,7 @@ public class ImporterActionExecuterTest
     {
         final RetryingTransactionHelper retryingTransactionHelper = serviceRegistry.getRetryingTransactionHelper();
 
-        retryingTransactionHelper.doInTransaction(new RetryingTransactionCallback<Void>()
-        {
+        retryingTransactionHelper.doInTransaction(new RetryingTransactionCallback<Void>() {
             public Void execute()
             {
                 NodeRef rootNodeRef = nodeService.getRootNode(storeRef);
@@ -270,8 +265,7 @@ public class ImporterActionExecuterTest
     {
         final RetryingTransactionHelper retryingTransactionHelper = serviceRegistry.getRetryingTransactionHelper();
 
-        retryingTransactionHelper.doInTransaction(new RetryingTransactionCallback<Void>()
-        {
+        retryingTransactionHelper.doInTransaction(new RetryingTransactionCallback<Void>() {
             public Void execute()
             {
                 NodeRef rootNodeRef = nodeService.getRootNode(storeRef);
@@ -306,11 +300,51 @@ public class ImporterActionExecuterTest
         });
     }
 
+    @Test
+    public void testUnzipZipFileHavingAccentCharInFolderName() throws IOException
+    {
+        final RetryingTransactionHelper retryingTransactionHelper = serviceRegistry.getRetryingTransactionHelper();
+
+        retryingTransactionHelper.doInTransaction(new RetryingTransactionCallback<Void>() {
+            @Override
+            public Void execute() throws Throwable
+
+            {
+                NodeRef rootNodeRef = nodeService.getRootNode(storeRef);
+
+                // create test data
+                NodeRef zipFileNodeRef = nodeService.createNode(rootNodeRef, ContentModel.ASSOC_CHILDREN, ContentModel.ASSOC_CHILDREN, ContentModel.TYPE_CONTENT).getChildRef();
+                NodeRef targetFolderNodeRef = nodeService.createNode(rootNodeRef, ContentModel.ASSOC_CHILDREN, ContentModel.ASSOC_CHILDREN, ContentModel.TYPE_FOLDER).getChildRef();
+
+                putContent(zipFileNodeRef, "import-archive-test/accentCharTestZip.zip");
+
+                Action action = createAction(zipFileNodeRef, "ImporterActionExecuterTestActionDefinition", targetFolderNodeRef);
+
+                try
+                {
+                    importerActionExecuter.setUncompressedBytesLimit("100000");
+                    importerActionExecuter.execute(action, zipFileNodeRef);
+                    NodeRef importedFolder = nodeService.getChildByName(targetFolderNodeRef, ContentModel.ASSOC_CONTAINS, "accentCharTestZip");
+                    assertNotNull("unzip action failed", importedFolder);
+                    assertTrue("multiple folder structure created", nodeService.getChildAssocs(importedFolder).size() == 1);
+                }
+                finally
+                {
+                    // clean test data
+                    nodeService.deleteNode(targetFolderNodeRef);
+                    nodeService.deleteNode(zipFileNodeRef);
+                }
+
+                return null;
+            }
+        });
+    }
+
     private void putContent(NodeRef zipFileNodeRef, String resource)
     {
         URL url = AbstractContentTransformerTest.class.getClassLoader().getResource(resource);
         final File file = new File(url.getFile());
-        
+
         ContentWriter writer = contentService.getWriter(zipFileNodeRef, ContentModel.PROP_CONTENT, true);
         writer.setMimetype(MimetypeMap.MIMETYPE_ZIP);
         writer.putContent(file);

repository/src/test/java/org/alfresco/repo/event2/CSVStringToListParserUnitTest.java

@@ -0,0 +1,48 @@
+/*
+ * #%L
+ * Alfresco Repository
+ * %%
+ * Copyright (C) 2025 - 2025 Alfresco Software Limited
+ * %%
+ * This file is part of the Alfresco software.
+ * If the software was purchased under a paid Alfresco license, the terms of
+ * the paid license agreement will prevail.  Otherwise, the software is
+ * provided under the following open source license terms:
+ *
+ * Alfresco is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Lesser General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * Alfresco is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public License
+ * along with Alfresco. If not, see <http://www.gnu.org/licenses/>.
+ * #L%
+ */
+package org.alfresco.repo.event2;
+
+import static org.junit.Assert.assertEquals;
+
+import java.util.List;
+
+import org.junit.Test;
+
+import org.alfresco.repo.event2.shared.CSVStringToListParser;
+
+public class CSVStringToListParserUnitTest
+{
+    @Test
+    public void shouldIgnoreEmptySpacesAndNoneValueAndTemplateStringsAndParseTheRest()
+    {
+        String userInputCSV = "a,,none,2,${test}, ,*";
+
+        List<String> result = CSVStringToListParser.parse(userInputCSV);
+
+        List<String> expected = List.of("a", "2", "*");
+        assertEquals(expected, result);
+    }
+}

repository/src/test/java/org/alfresco/repo/event2/EventFilterUnitTest.java

@@ -2,7 +2,7 @@
  * #%L
  * Alfresco Repository
  * %%
- * Copyright (C) 2005 - 2020 Alfresco Software Limited
+ * Copyright (C) 2005 - 2025 Alfresco Software Limited
  * %%
  * This file is part of the Alfresco software.
  * If the software was purchased under a paid Alfresco license, the terms of
@@ -35,6 +35,10 @@ import static org.mockito.Mockito.when;
 import java.util.Collection;
 import java.util.Collections;
 
+import org.junit.BeforeClass;
+import org.junit.Test;
+import org.mockito.stubbing.Answer;
+
 import org.alfresco.model.ContentModel;
 import org.alfresco.model.ForumModel;
 import org.alfresco.model.RenditionModel;
@@ -43,14 +47,12 @@ import org.alfresco.repo.event2.filter.EventUserFilter;
 import org.alfresco.repo.event2.filter.NodeAspectFilter;
 import org.alfresco.repo.event2.filter.NodePropertyFilter;
 import org.alfresco.repo.event2.filter.NodeTypeFilter;
+import org.alfresco.repo.event2.shared.TypeDefExpander;
 import org.alfresco.service.cmr.dictionary.DictionaryService;
 import org.alfresco.service.namespace.NamespaceException;
 import org.alfresco.service.namespace.NamespaceService;
 import org.alfresco.service.namespace.QName;
 import org.alfresco.util.OneToManyHashBiMap;
-import org.junit.BeforeClass;
-import org.junit.Test;
-import org.mockito.stubbing.Answer;
 
 /**
  * Tests event filters.
@@ -78,32 +80,32 @@ public class EventFilterUnitTest
 
         namespaceService = new MockNamespaceServiceImpl();
         namespaceService.registerNamespace(NamespaceService.SYSTEM_MODEL_PREFIX,
-                                           NamespaceService.SYSTEM_MODEL_1_0_URI);
+                NamespaceService.SYSTEM_MODEL_1_0_URI);
         namespaceService.registerNamespace(NamespaceService.CONTENT_MODEL_PREFIX,
-                                           NamespaceService.CONTENT_MODEL_1_0_URI);
+                NamespaceService.CONTENT_MODEL_1_0_URI);
         namespaceService.registerNamespace(NamespaceService.FORUMS_MODEL_PREFIX,
-                                           NamespaceService.FORUMS_MODEL_1_0_URI);
+                NamespaceService.FORUMS_MODEL_1_0_URI);
         namespaceService.registerNamespace(NamespaceService.RENDITION_MODEL_PREFIX,
-                                           NamespaceService.RENDITION_MODEL_1_0_URI);
+                NamespaceService.RENDITION_MODEL_1_0_URI);
+        namespaceService.registerNamespace(ContentModel.USER_MODEL_PREFIX,
+                ContentModel.USER_MODEL_URI);
 
-        propertyFilter = new NodePropertyFilter();
-        propertyFilter.setNamespaceService(namespaceService);
-        propertyFilter.setDictionaryService(dictionaryService);
+        TypeDefExpander typeDefExpander = new TypeDefExpander(dictionaryService, namespaceService);
+
+        propertyFilter = new NodePropertyFilter("usr:password");
+        propertyFilter.setTypeDefExpander(typeDefExpander);
         propertyFilter.init();
 
-        typeFilter = new NodeTypeFilter("sys:*, fm:*, cm:thumbnail");
-        typeFilter.setNamespaceService(namespaceService);
-        typeFilter.setDictionaryService(dictionaryService);
+        typeFilter = new NodeTypeFilter("sys:*, fm:*, cm:thumbnail", dictionaryService);
+        typeFilter.setTypeDefExpander(typeDefExpander);
         typeFilter.init();
 
         aspectFilter = new NodeAspectFilter("cm:workingcopy");
-        aspectFilter.setNamespaceService(namespaceService);
-        aspectFilter.setDictionaryService(dictionaryService);
+        aspectFilter.setTypeDefExpander(typeDefExpander);
         aspectFilter.init();
 
         childAssociationTypeFilter = new ChildAssociationTypeFilter("rn:rendition");
-        childAssociationTypeFilter.setNamespaceService(namespaceService);
-        childAssociationTypeFilter.setDictionaryService(dictionaryService);
+        childAssociationTypeFilter.setTypeDefExpander(typeDefExpander);
         childAssociationTypeFilter.init();
 
         caseInsensitive_userFilter = new EventUserFilter("System, john.doe, null", false);
@@ -114,10 +116,12 @@ public class EventFilterUnitTest
     public void nodePropertyFilter()
     {
         assertTrue("System properties are excluded by default.",
-                   propertyFilter.isExcluded(ContentModel.PROP_NODE_UUID));
+                propertyFilter.isExcluded(ContentModel.PROP_NODE_UUID));
 
         assertTrue("System properties are excluded by default.",
-                   propertyFilter.isExcluded(ContentModel.PROP_NODE_DBID));
+                propertyFilter.isExcluded(ContentModel.PROP_NODE_DBID));
+
+        assertTrue("User configured properties are excluded.", propertyFilter.isExcluded(ContentModel.PROP_PASSWORD));
 
         assertFalse("Property cascadeTx is not excluded", propertyFilter.isExcluded(ContentModel.PROP_CASCADE_TX));
         assertFalse("Property cascadeCRC is not excluded", propertyFilter.isExcluded(ContentModel.PROP_CASCADE_CRC));
@@ -129,16 +133,16 @@ public class EventFilterUnitTest
     public void nodeTypeFilter()
     {
         assertTrue("Thumbnail node type should have been filtered.",
-                   typeFilter.isExcluded(ContentModel.TYPE_THUMBNAIL));
+                typeFilter.isExcluded(ContentModel.TYPE_THUMBNAIL));
 
         assertTrue("System folder node types are excluded by default.",
-                   typeFilter.isExcluded(ContentModel.TYPE_SYSTEM_FOLDER));
+                typeFilter.isExcluded(ContentModel.TYPE_SYSTEM_FOLDER));
 
         assertTrue("System node type should have been filtered (sys:*).",
-                   typeFilter.isExcluded(QName.createQName("sys:testSomeSystemType", namespaceService)));
+                typeFilter.isExcluded(QName.createQName("sys:testSomeSystemType", namespaceService)));
 
         assertTrue("Forum node type should have been filtered (fm:*).",
-                   typeFilter.isExcluded(ForumModel.TYPE_POST));
+                typeFilter.isExcluded(ForumModel.TYPE_POST));
 
         assertFalse(typeFilter.isExcluded(ContentModel.TYPE_FOLDER));
     }
@@ -147,7 +151,7 @@ public class EventFilterUnitTest
     public void nodeAspectFilter()
     {
         assertTrue("Working copy aspect should have been filtered.",
-                   aspectFilter.isExcluded(ContentModel.ASPECT_WORKING_COPY));
+                aspectFilter.isExcluded(ContentModel.ASPECT_WORKING_COPY));
 
         assertFalse(aspectFilter.isExcluded(ContentModel.ASPECT_TITLED));
     }
@@ -160,41 +164,41 @@ public class EventFilterUnitTest
 
         assertFalse(childAssociationTypeFilter.isExcluded(ContentModel.ASSOC_CONTAINS));
     }
-    
+
     @Test
     public void userFilter_case_insensitive()
     {
         assertTrue("System user should have been filtered.",
-                   caseInsensitive_userFilter.isExcluded("System"));
+                caseInsensitive_userFilter.isExcluded("System"));
 
         assertTrue("System user should have been filtered (case-insensitive).",
-                   caseInsensitive_userFilter.isExcluded("SYSTEM"));
+                caseInsensitive_userFilter.isExcluded("SYSTEM"));
 
         assertTrue("'null' user should have been filtered.",
-                   caseInsensitive_userFilter.isExcluded("null"));
+                caseInsensitive_userFilter.isExcluded("null"));
 
         assertTrue("john.doe user should have been filtered.",
-                   caseInsensitive_userFilter.isExcluded("John.Doe"));
+                caseInsensitive_userFilter.isExcluded("John.Doe"));
 
         assertFalse("'jane.doe' user should not have been filtered.",
-                    caseInsensitive_userFilter.isExcluded("jane.doe"));
+                caseInsensitive_userFilter.isExcluded("jane.doe"));
     }
 
     @Test
     public void userFilter_case_sensitive()
     {
         assertFalse("'system' user should not have been filtered.",
-                    caseSensitive_userFilter.isExcluded("system"));
+                caseSensitive_userFilter.isExcluded("system"));
         assertTrue("'System' user should have been filtered.",
-                   caseSensitive_userFilter.isExcluded("System"));
+                caseSensitive_userFilter.isExcluded("System"));
 
         assertFalse("'John.Doe' user should not have been filtered.",
-                    caseSensitive_userFilter.isExcluded("John.Doe"));
+                caseSensitive_userFilter.isExcluded("John.Doe"));
         assertTrue("'john.doe' user should have been filtered.",
-                   caseSensitive_userFilter.isExcluded("john.doe"));
+                caseSensitive_userFilter.isExcluded("john.doe"));
 
         assertFalse("'jane.doe' user should not have been filtered.",
-                    caseSensitive_userFilter.isExcluded("jane.doe"));
+                caseSensitive_userFilter.isExcluded("jane.doe"));
     }
 
     /**

repository/src/test/java/org/alfresco/repo/event2/PropertyMapperUnitTest.java

@@ -0,0 +1,81 @@
+/*
+ * #%L
+ * Alfresco Repository
+ * %%
+ * Copyright (C) 2025 - 2025 Alfresco Software Limited
+ * %%
+ * This file is part of the Alfresco software.
+ * If the software was purchased under a paid Alfresco license, the terms of
+ * the paid license agreement will prevail.  Otherwise, the software is
+ * provided under the following open source license terms:
+ *
+ * Alfresco is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Lesser General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * Alfresco is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public License
+ * along with Alfresco. If not, see <http://www.gnu.org/licenses/>.
+ * #L%
+ */
+package org.alfresco.repo.event2;
+
+import static org.junit.Assert.assertEquals;
+
+import java.util.Set;
+import java.util.UUID;
+
+import org.junit.Test;
+
+import org.alfresco.model.ContentModel;
+import org.alfresco.repo.event2.mapper.PropertyMapper;
+import org.alfresco.repo.event2.mapper.ReplaceSensitivePropertyWithTextMapper;
+import org.alfresco.repo.transfer.TransferModel;
+
+public class PropertyMapperUnitTest
+{
+    private static final String DEFAULT_REPLACEMENT_TEXT = "SENSITIVE_DATA_REMOVED";
+    private static final String USER_CONFIGURED_REPLACEMENT_TEXT = "HIDDEN_BY_SECURITY_CONFIG";
+
+    private final PropertyMapper defaultPropertyMapper = new ReplaceSensitivePropertyWithTextMapper(null,null);
+    private final PropertyMapper userConfiguredpropertyMapper = new ReplaceSensitivePropertyWithTextMapper(
+            Set.of(ContentModel.PROP_PASSWORD, TransferModel.PROP_PASSWORD),
+            USER_CONFIGURED_REPLACEMENT_TEXT
+    );
+
+    @Test
+    public void shouldReplacePropertyValueWhenItsOneOfTheDefaultSensitivePropertiesWhenUsingDefaultConfig()
+    {
+        assertEquals(DEFAULT_REPLACEMENT_TEXT, defaultPropertyMapper.map(ContentModel.PROP_PASSWORD, "test_pass"));
+        assertEquals(DEFAULT_REPLACEMENT_TEXT, defaultPropertyMapper.map(ContentModel.PROP_SALT, UUID.randomUUID().toString()));
+        assertEquals(DEFAULT_REPLACEMENT_TEXT, defaultPropertyMapper.map(ContentModel.PROP_PASSWORD_HASH, "r4nD0M_h4sH"));
+        assertEquals(DEFAULT_REPLACEMENT_TEXT, defaultPropertyMapper.map(TransferModel.PROP_PASSWORD, "pyramid"));
+    }
+
+    @Test
+    public void shouldNotReplacePropertyValueWhenItsNotOneOfTheDefaultSensitivePropertiesWhenUsingDefaultConfig()
+    {
+        assertEquals("Bob", defaultPropertyMapper.map(ContentModel.PROP_USERNAME, "Bob"));
+    }
+
+    @Test
+    public void shouldReplacePropertyValueWhenItsOneOfTheDefaultSensitivePropertiesWhenUsingUserConfig()
+    {
+        assertEquals(USER_CONFIGURED_REPLACEMENT_TEXT, userConfiguredpropertyMapper.map(ContentModel.PROP_PASSWORD, "test_pass"));
+
+        assertEquals(USER_CONFIGURED_REPLACEMENT_TEXT, userConfiguredpropertyMapper.map(TransferModel.PROP_PASSWORD, "pyramid"));
+    }
+
+    @Test
+    public void shouldNotReplacePropertyValueWhenItsNotOneOfTheDefaultSensitivePropertiesWhenUsingUserConfig()
+    {
+        String randomUuid = UUID.randomUUID().toString();
+        assertEquals(randomUuid, userConfiguredpropertyMapper.map(ContentModel.PROP_SALT, randomUuid));
+        assertEquals("r4nD0M_h4sH", userConfiguredpropertyMapper.map(ContentModel.PROP_PASSWORD_HASH, "r4nD0M_h4sH"));
+    }
+}

repository/src/test/java/org/alfresco/repo/event2/QNameMatcherUnitTest.java

@@ -0,0 +1,65 @@
+/*
+ * #%L
+ * Alfresco Repository
+ * %%
+ * Copyright (C) 2025 - 2025 Alfresco Software Limited
+ * %%
+ * This file is part of the Alfresco software.
+ * If the software was purchased under a paid Alfresco license, the terms of
+ * the paid license agreement will prevail.  Otherwise, the software is
+ * provided under the following open source license terms:
+ *
+ * Alfresco is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Lesser General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * Alfresco is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public License
+ * along with Alfresco. If not, see <http://www.gnu.org/licenses/>.
+ * #L%
+ */
+package org.alfresco.repo.event2;
+
+import static org.junit.Assert.assertFalse;
+import static org.junit.Assert.assertTrue;
+
+import java.util.Set;
+
+import org.junit.Test;
+
+import org.alfresco.model.ContentModel;
+import org.alfresco.repo.event2.shared.QNameMatcher;
+import org.alfresco.repo.transfer.TransferModel;
+import org.alfresco.service.namespace.QName;
+
+public class QNameMatcherUnitTest
+{
+    @Test
+    public void shouldMatchOnlyQNamesFromUserModelURI()
+    {
+        QNameMatcher qNameMatcher = new QNameMatcher(Set.of(QName.createQName(ContentModel.USER_MODEL_URI, "*")));
+
+        assertTrue(qNameMatcher.isMatching(ContentModel.PROP_USER_USERNAME));
+        assertTrue(qNameMatcher.isMatching(ContentModel.TYPE_USER));
+        assertFalse(qNameMatcher.isMatching(ContentModel.PROP_TITLE));
+        assertFalse(qNameMatcher.isMatching(TransferModel.PROP_USERNAME));
+        assertFalse(qNameMatcher.isMatching(null));
+    }
+
+    @Test
+    public void shouldOnlyMatchSpecificQName()
+    {
+        QNameMatcher qNameMatcher = new QNameMatcher(Set.of(ContentModel.PROP_USER_USERNAME));
+
+        assertTrue(qNameMatcher.isMatching(ContentModel.PROP_USER_USERNAME));
+        assertFalse(qNameMatcher.isMatching(ContentModel.PROP_NAME));
+        assertFalse(qNameMatcher.isMatching(ContentModel.PROP_USERNAME));
+        assertFalse(qNameMatcher.isMatching(TransferModel.PROP_USERNAME));
+        assertFalse(qNameMatcher.isMatching(null));
+    }
+}

repository/src/test/java/org/alfresco/repo/event2/RepoEvent2UnitSuite.java

@@ -2,7 +2,7 @@
  * #%L
  * Alfresco Repository
  * %%
- * Copyright (C) 2005 - 2023 Alfresco Software Limited
+ * Copyright (C) 2005 - 2025 Alfresco Software Limited
  * %%
  * This file is part of the Alfresco software.
  * If the software was purchased under a paid Alfresco license, the terms of
@@ -30,12 +30,15 @@ import org.junit.runners.Suite;
 import org.junit.runners.Suite.SuiteClasses;
 
 @RunWith(Suite.class)
-@SuiteClasses({ EventFilterUnitTest.class,
-                EventConsolidatorUnitTest.class,
-                EventJSONSchemaUnitTest.class,
-                EnqueuingEventSenderUnitTest.class,
-                NodeResourceHelperUnitTest.class
+@SuiteClasses({EventFilterUnitTest.class,
+        EventConsolidatorUnitTest.class,
+        EventJSONSchemaUnitTest.class,
+        EnqueuingEventSenderUnitTest.class,
+        NodeResourceHelperUnitTest.class,
+        PropertyMapperUnitTest.class,
+        QNameMatcherUnitTest.class,
+        CSVStringToListParserUnitTest.class,
+        TypeDefExpanderUnitTest.class
 })
 public class RepoEvent2UnitSuite
-{
-}
+{}

repository/src/test/java/org/alfresco/repo/event2/TypeDefExpanderUnitTest.java

@@ -0,0 +1,98 @@
+/*
+ * #%L
+ * Alfresco Repository
+ * %%
+ * Copyright (C) 2025 - 2025 Alfresco Software Limited
+ * %%
+ * This file is part of the Alfresco software.
+ * If the software was purchased under a paid Alfresco license, the terms of
+ * the paid license agreement will prevail.  Otherwise, the software is
+ * provided under the following open source license terms:
+ *
+ * Alfresco is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Lesser General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * Alfresco is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public License
+ * along with Alfresco. If not, see <http://www.gnu.org/licenses/>.
+ * #L%
+ */
+package org.alfresco.repo.event2;
+
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertTrue;
+import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.when;
+
+import java.util.Collection;
+import java.util.Set;
+import java.util.stream.Collectors;
+import java.util.stream.Stream;
+
+import org.junit.Before;
+import org.junit.Test;
+
+import org.alfresco.model.ContentModel;
+import org.alfresco.model.DataListModel;
+import org.alfresco.repo.event2.shared.TypeDefExpander;
+import org.alfresco.repo.transfer.TransferModel;
+import org.alfresco.repo.workflow.WorkflowModel;
+import org.alfresco.service.cmr.dictionary.DictionaryService;
+import org.alfresco.service.namespace.NamespaceService;
+import org.alfresco.service.namespace.QName;
+
+public class TypeDefExpanderUnitTest
+{
+    private DictionaryService dictionaryService;
+    private NamespaceService namespaceService;
+    private TypeDefExpander typeDefExpander;
+
+    @Before
+    public void setUp()
+    {
+        dictionaryService = mock(DictionaryService.class);
+        namespaceService = mock(NamespaceService.class);
+        typeDefExpander = new TypeDefExpander(dictionaryService, namespaceService);
+    }
+
+    @Test
+    public void testExpandWithValidType()
+    {
+        String input = "usr:username";
+        when(namespaceService.getNamespaceURI("usr")).thenReturn(ContentModel.USER_MODEL_URI);
+
+        Collection<QName> result = typeDefExpander.expand(input);
+
+        QName expected = ContentModel.PROP_USER_USERNAME;
+        assertEquals(expected, result.iterator().next());
+    }
+
+    @Test
+    public void testExpandWithValidTypeIncludingSubtypes()
+    {
+        String input = "cm:content include_subtypes";
+        when(namespaceService.getNamespaceURI("cm")).thenReturn(NamespaceService.CONTENT_MODEL_1_0_URI);
+        Set<QName> subtypes = Set.of(TransferModel.TYPE_TRANSFER_RECORD, DataListModel.TYPE_EVENT, WorkflowModel.TYPE_TASK);
+        when(dictionaryService.getSubTypes(ContentModel.TYPE_CONTENT, true)).thenReturn(subtypes);
+
+        Collection<QName> result = typeDefExpander.expand(input);
+
+        assertEquals(subtypes, result);
+    }
+
+    @Test
+    public void testExpandWithInvalidTypes()
+    {
+        Set<String> input = Stream.of(null, " ", "none", "${test.prop}").collect(Collectors.toSet());
+
+        Collection<QName> result = typeDefExpander.expand(input);
+
+        assertTrue(result.isEmpty());
+    }
+}

repository/src/test/java/org/alfresco/repo/event2/UpdateRepoEventIT.java

@@ -26,6 +26,12 @@
 
 package org.alfresco.repo.event2;
 
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertFalse;
+import static org.junit.Assert.assertNotNull;
+import static org.junit.Assert.assertNull;
+import static org.junit.Assert.assertTrue;
+
 import static org.alfresco.model.ContentModel.PROP_DESCRIPTION;
 
 import java.io.Serializable;
@@ -35,6 +41,9 @@ import java.util.HashSet;
 import java.util.List;
 import java.util.Map;
 import java.util.Set;
+
+import org.junit.Test;
+
 import org.alfresco.model.ContentModel;
 import org.alfresco.repo.content.MimetypeMap;
 import org.alfresco.repo.dictionary.M2Model;
@@ -53,7 +62,6 @@ import org.alfresco.service.cmr.repository.NodeRef;
 import org.alfresco.service.namespace.QName;
 import org.alfresco.util.GUID;
 import org.alfresco.util.Pair;
-import org.junit.Test;
 
 /**
  * @author Iulian Aftene
@@ -66,20 +74,20 @@ public class UpdateRepoEventIT extends AbstractContextAwareRepoEvent
     public void testUpdateNodeResourceContent()
     {
         ContentService contentService = (ContentService) applicationContext.getBean(
-            "contentService");
+                "contentService");
 
         final NodeRef nodeRef = createNode(ContentModel.TYPE_CONTENT);
 
         RepoEvent<EventData<NodeResource>> resultRepoEvent = getRepoEvent(1);
         assertEquals("Wrong repo event type.", EventType.NODE_CREATED.getType(),
-            resultRepoEvent.getType());
+                resultRepoEvent.getType());
 
         NodeResource resource = getNodeResource(resultRepoEvent);
         assertNull("Content should have been null.", resource.getContent());
 
         retryingTransactionHelper.doInTransaction(() -> {
             ContentWriter writer = contentService.getWriter(nodeRef, ContentModel.TYPE_CONTENT,
-                true);
+                    true);
             writer.setMimetype(MimetypeMap.MIMETYPE_PDF);
             writer.setEncoding("UTF-8");
             writer.putContent("test content.");
@@ -90,7 +98,7 @@ public class UpdateRepoEventIT extends AbstractContextAwareRepoEvent
 
         resultRepoEvent = getRepoEvent(2);
         assertEquals("Wrong repo event type.", EventType.NODE_UPDATED.getType(),
-            resultRepoEvent.getType());
+                resultRepoEvent.getType());
 
         resource = getNodeResource(resultRepoEvent);
         ContentInfo content = resource.getContent();
@@ -105,7 +113,7 @@ public class UpdateRepoEventIT extends AbstractContextAwareRepoEvent
         // Update the content again
         retryingTransactionHelper.doInTransaction(() -> {
             ContentWriter writer = contentService.getWriter(nodeRef, ContentModel.TYPE_CONTENT,
-                true);
+                    true);
             writer.setMimetype(MimetypeMap.MIMETYPE_PDF);
             writer.setEncoding("UTF-8");
             writer.putContent("A quick brown fox jumps over the lazy dog.");
@@ -370,7 +378,6 @@ public class UpdateRepoEventIT extends AbstractContextAwareRepoEvent
         assertEquals("new test title", title);
         assertEquals("new test title", getLocalizedProperty(resource, "cm:title", defaultLocale));
 
-
         resourceBefore = getNodeResourceBefore(3);
         title = getProperty(resourceBefore, "cm:title");
         assertEquals("Wrong old property.", "test title", title);
@@ -490,14 +497,14 @@ public class UpdateRepoEventIT extends AbstractContextAwareRepoEvent
         resource = getNodeResource(2);
         assertNotNull(resource.getAspectNames());
         assertTrue(resource.getAspectNames().contains("cm:versionable"));
-        //Check all aspects
+        // Check all aspects
         Set<String> expectedAspects = new HashSet<>(originalAspects);
         expectedAspects.add("cm:versionable");
         assertEquals(expectedAspects, resource.getAspectNames());
         // Check properties
         assertFalse(resource.getProperties().isEmpty());
 
-        //Check resourceBefore
+        // Check resourceBefore
         NodeResource resourceBefore = getNodeResourceBefore(2);
         assertNotNull(resourceBefore.getAspectNames());
         assertEquals(originalAspects, resourceBefore.getAspectNames());
@@ -544,21 +551,64 @@ public class UpdateRepoEventIT extends AbstractContextAwareRepoEvent
         assertEquals(aspectsBeforeRemove, resourceBefore.getAspectNames());
     }
 
+    @Test
+    public void testRemoveAspectPropertiesTest()
+    {
+        final NodeRef nodeRef = createNode(ContentModel.TYPE_CONTENT);
+        NodeResource resource = getNodeResource(1);
+        final Set<String> originalAspects = resource.getAspectNames();
+        assertNotNull(originalAspects);
+
+        // Add cm:geographic aspect with properties
+        retryingTransactionHelper.doInTransaction(() -> {
+            Map<QName, Serializable> aspectProperties = new HashMap<>();
+            aspectProperties.put(ContentModel.PROP_LATITUDE, "12.345678");
+            aspectProperties.put(ContentModel.PROP_LONGITUDE, "12.345678");
+            nodeService.addAspect(nodeRef, ContentModel.ASPECT_GEOGRAPHIC, aspectProperties);
+            return null;
+        });
+        resource = getNodeResource(2);
+        Set<String> aspectsBeforeRemove = resource.getAspectNames();
+        assertNotNull(aspectsBeforeRemove);
+        assertTrue(aspectsBeforeRemove.contains("cm:geographic"));
+
+        // Remove cm:geographic aspect - this automatically removes the properties from the node
+        retryingTransactionHelper.doInTransaction(() -> {
+            nodeService.removeAspect(nodeRef, ContentModel.ASPECT_GEOGRAPHIC);
+            return null;
+        });
+
+        resource = getNodeResource(3);
+        assertEquals(originalAspects, resource.getAspectNames());
+
+        NodeResource resourceBefore = getNodeResourceBefore(3);
+        assertNotNull(resourceBefore.getAspectNames());
+        assertEquals(aspectsBeforeRemove, resourceBefore.getAspectNames());
+        // Resource before should contain cm:latitude and cm:longitude properties
+        assertNotNull(resourceBefore.getProperties());
+        assertTrue(resourceBefore.getProperties().containsKey("cm:latitude"));
+        assertTrue(resourceBefore.getProperties().containsKey("cm:longitude"));
+        // Resource after should NOT contain cm:latitude and cm:longitude properties
+        assertNotNull(resource.getProperties());
+        assertFalse(resource.getProperties().containsKey("cm:latitude"));
+        assertFalse(resource.getProperties().containsKey("cm:longitude"));
+    }
+
     @Test
     public void testCreateAndUpdateInTheSameTransaction()
     {
         retryingTransactionHelper.doInTransaction(() -> {
 
             NodeRef node1 = nodeService.createNode(
-                rootNodeRef,
-                ContentModel.ASSOC_CHILDREN,
-                QName.createQName(TEST_NAMESPACE, GUID.generate()),
-                ContentModel.TYPE_CONTENT).getChildRef();
+                    rootNodeRef,
+                    ContentModel.ASSOC_CHILDREN,
+                    QName.createQName(TEST_NAMESPACE, GUID.generate()),
+                    ContentModel.TYPE_CONTENT).getChildRef();
 
             nodeService.setProperty(node1, PROP_DESCRIPTION, "test description");
             return null;
         });
-        //Create and update node are done in the same transaction so one event is expected
+        // Create and update node are done in the same transaction so one event is expected
         // to be generated
         checkNumOfEvents(1);
     }
@@ -593,8 +643,8 @@ public class UpdateRepoEventIT extends AbstractContextAwareRepoEvent
         assertEquals("Incorrect node type was found", "cm:folder", nodeResource.getNodeType());
 
         NodeResource resourceBefore = getNodeResourceBefore(2);
-        assertEquals("Incorrect node type was found","cm:content", resourceBefore.getNodeType());
-        // assertNotNull(resourceBefore.getModifiedAt());  uncomment this when the issue will be fixed
+        assertEquals("Incorrect node type was found", "cm:content", resourceBefore.getNodeType());
+        // assertNotNull(resourceBefore.getModifiedAt()); uncomment this when the issue will be fixed
         assertNull(resourceBefore.getId());
         assertNull(resourceBefore.getContent());
         assertNull(resourceBefore.isFile());
@@ -624,8 +674,7 @@ public class UpdateRepoEventIT extends AbstractContextAwareRepoEvent
         m2Type.setTitle("Test type title");
 
         // Create active model
-        CustomModelDefinition modelDefinition =
-            retryingTransactionHelper.doInTransaction(() -> customModelService.createCustomModel(model, true));
+        CustomModelDefinition modelDefinition = retryingTransactionHelper.doInTransaction(() -> customModelService.createCustomModel(model, true));
 
         assertNotNull(modelDefinition);
         assertEquals(modelName, modelDefinition.getName().getLocalName());
@@ -655,7 +704,7 @@ public class UpdateRepoEventIT extends AbstractContextAwareRepoEvent
         assertEquals("Wrong repo event type.", EventType.NODE_CREATED.getType(), resultRepoEvent.getType());
         assertEquals("cm:content node type was not found", "cm:content", nodeResource.getNodeType());
 
-        QName typeQName = QName.createQName("{" + namespacePair.getFirst()+ "}" + typeName);
+        QName typeQName = QName.createQName("{" + namespacePair.getFirst() + "}" + typeName);
         retryingTransactionHelper.doInTransaction(() -> {
             nodeService.setType(nodeRef, typeQName);
 
@@ -757,7 +806,7 @@ public class UpdateRepoEventIT extends AbstractContextAwareRepoEvent
         // we should have only 1 event, node.Created
         checkNumOfEvents(1);
 
-        RepoEvent<EventData<NodeResource>>  resultRepoEvent = getRepoEvent(1);
+        RepoEvent<EventData<NodeResource>> resultRepoEvent = getRepoEvent(1);
         assertEquals("Wrong repo event type.", EventType.NODE_CREATED.getType(), resultRepoEvent.getType());
         NodeResource nodeResource = getNodeResource(resultRepoEvent);
         assertEquals("Incorrect node type was found", "cm:folder", nodeResource.getNodeType());
@@ -783,10 +832,10 @@ public class UpdateRepoEventIT extends AbstractContextAwareRepoEvent
 
         retryingTransactionHelper.doInTransaction(() -> {
             nodeService.moveNode(
-                moveFile,
-                folder2,
-                ContentModel.ASSOC_CONTAINS,
-                QName.createQName(TEST_NAMESPACE));
+                    moveFile,
+                    folder2,
+                    ContentModel.ASSOC_CONTAINS,
+                    QName.createQName(TEST_NAMESPACE));
             return null;
         });
 
@@ -801,7 +850,7 @@ public class UpdateRepoEventIT extends AbstractContextAwareRepoEvent
         assertEquals("Wrong node parent.", folder1ID, moveFileParentBeforeMove);
         assertEquals("Wrong node parent.", folder2ID, moveFileParentAfterMove);
         assertEquals("Wrong repo event type.", EventType.NODE_UPDATED.getType(),
-            getRepoEvent(4).getType());
+                getRepoEvent(4).getType());
 
         assertNull(resourceBefore.getId());
         assertNull(resourceBefore.getName());
@@ -833,10 +882,10 @@ public class UpdateRepoEventIT extends AbstractContextAwareRepoEvent
 
         retryingTransactionHelper.doInTransaction(() -> {
             nodeService.moveNode(
-                moveFolder,
-                grandParent,
-                ContentModel.ASSOC_CONTAINS,
-                QName.createQName(TEST_NAMESPACE));
+                    moveFolder,
+                    grandParent,
+                    ContentModel.ASSOC_CONTAINS,
+                    QName.createQName(TEST_NAMESPACE));
             return null;
         });
 
@@ -845,15 +894,13 @@ public class UpdateRepoEventIT extends AbstractContextAwareRepoEvent
         final String grandParentID = getNodeResource(1).getId();
         final String parentID = getNodeResource(2).getId();
 
-        final String moveFolderParentBeforeMove =
-            getNodeResourceBefore(4).getPrimaryHierarchy().get(0);
-        final String moveFolderParentAfterMove =
-            getNodeResource(4).getPrimaryHierarchy().get(0);
+        final String moveFolderParentBeforeMove = getNodeResourceBefore(4).getPrimaryHierarchy().get(0);
+        final String moveFolderParentAfterMove = getNodeResource(4).getPrimaryHierarchy().get(0);
 
         assertEquals("Wrong node parent.", parentID, moveFolderParentBeforeMove);
         assertEquals("Wrong node parent.", grandParentID, moveFolderParentAfterMove);
         assertEquals("Wrong repo event type.", EventType.NODE_UPDATED.getType(),
-            getRepoEventWithoutWait(4).getType());
+                getRepoEventWithoutWait(4).getType());
     }
 
     @Test
@@ -867,28 +914,25 @@ public class UpdateRepoEventIT extends AbstractContextAwareRepoEvent
 
         retryingTransactionHelper.doInTransaction(() -> {
             nodeService.moveNode(
-                grandParent,
-                root2,
-                ContentModel.ASSOC_CONTAINS,
-                QName.createQName(TEST_NAMESPACE));
+                    grandParent,
+                    root2,
+                    ContentModel.ASSOC_CONTAINS,
+                    QName.createQName(TEST_NAMESPACE));
             return null;
         });
 
         checkNumOfEvents(6);
 
         final String root2ID = getNodeResource(2).getId();
-        final String grandParentParentAfterMove =
-            getNodeResource(6).getPrimaryHierarchy().get(0);
+        final String grandParentParentAfterMove = getNodeResource(6).getPrimaryHierarchy().get(0);
         assertEquals("Wrong node parent.", root2ID, grandParentParentAfterMove);
 
         final String grandParentID = getNodeResource(3).getId();
-        final String parentIDOfTheParentFolder =
-            getNodeResource(4).getPrimaryHierarchy().get(0);
+        final String parentIDOfTheParentFolder = getNodeResource(4).getPrimaryHierarchy().get(0);
         assertEquals("Wrong node parent.", grandParentID, parentIDOfTheParentFolder);
 
         final String parentID = getNodeResource(4).getId();
-        final String contentParentID =
-            getNodeResource(5).getPrimaryHierarchy().get(0);
+        final String contentParentID = getNodeResource(5).getPrimaryHierarchy().get(0);
         assertEquals("Wrong node parent.", parentID, contentParentID);
     }
 
@@ -906,10 +950,10 @@ public class UpdateRepoEventIT extends AbstractContextAwareRepoEvent
 
         retryingTransactionHelper.doInTransaction(() -> {
             nodeService.moveNode(
-                moveFile,
-                folder2,
-                ContentModel.ASSOC_CONTAINS,
-                QName.createQName(TEST_NAMESPACE));
+                    moveFile,
+                    folder2,
+                    ContentModel.ASSOC_CONTAINS,
+                    QName.createQName(TEST_NAMESPACE));
             return null;
         });
 
@@ -918,8 +962,7 @@ public class UpdateRepoEventIT extends AbstractContextAwareRepoEvent
         assertTrue("Wrong aspect.", resource.getAspectNames().contains("cm:versionable"));
 
         final String folder2ID = getNodeResource(2).getId();
-        final String moveFileParentAfterMove =
-            getNodeResource(5).getPrimaryHierarchy().get(0);
+        final String moveFileParentAfterMove = getNodeResource(5).getPrimaryHierarchy().get(0);
 
         assertEquals("Wrong node parent.", folder2ID, moveFileParentAfterMove);
     }
@@ -935,10 +978,10 @@ public class UpdateRepoEventIT extends AbstractContextAwareRepoEvent
             nodeService.setProperty(moveFile, ContentModel.PROP_NAME, "test_new_name");
 
             nodeService.moveNode(
-                moveFile,
-                folder2,
-                ContentModel.ASSOC_CONTAINS,
-                QName.createQName(TEST_NAMESPACE));
+                    moveFile,
+                    folder2,
+                    ContentModel.ASSOC_CONTAINS,
+                    QName.createQName(TEST_NAMESPACE));
             return null;
         });
 
@@ -946,8 +989,7 @@ public class UpdateRepoEventIT extends AbstractContextAwareRepoEvent
         assertEquals("test_new_name", resource.getName());
 
         final String folder2ID = getNodeResource(2).getId();
-        final String moveFileParentAfterMove =
-            getNodeResource(4).getPrimaryHierarchy().get(0);
+        final String moveFileParentAfterMove = getNodeResource(4).getPrimaryHierarchy().get(0);
 
         assertEquals("Wrong node parent.", folder2ID, moveFileParentAfterMove);
     }
@@ -958,28 +1000,28 @@ public class UpdateRepoEventIT extends AbstractContextAwareRepoEvent
         retryingTransactionHelper.doInTransaction(() -> {
 
             NodeRef folder1 = nodeService.createNode(
-                rootNodeRef,
-                ContentModel.ASSOC_CHILDREN,
-                QName.createQName(TEST_NAMESPACE),
-                ContentModel.TYPE_FOLDER).getChildRef();
+                    rootNodeRef,
+                    ContentModel.ASSOC_CHILDREN,
+                    QName.createQName(TEST_NAMESPACE),
+                    ContentModel.TYPE_FOLDER).getChildRef();
 
             NodeRef folder2 = nodeService.createNode(
-                rootNodeRef,
-                ContentModel.ASSOC_CHILDREN,
-                QName.createQName(TEST_NAMESPACE),
-                ContentModel.TYPE_FOLDER).getChildRef();
+                    rootNodeRef,
+                    ContentModel.ASSOC_CHILDREN,
+                    QName.createQName(TEST_NAMESPACE),
+                    ContentModel.TYPE_FOLDER).getChildRef();
 
             NodeRef fileToMove = nodeService.createNode(
-                folder1,
-                ContentModel.ASSOC_CONTAINS,
-                QName.createQName(TEST_NAMESPACE),
-                ContentModel.TYPE_CONTENT).getChildRef();
+                    folder1,
+                    ContentModel.ASSOC_CONTAINS,
+                    QName.createQName(TEST_NAMESPACE),
+                    ContentModel.TYPE_CONTENT).getChildRef();
 
             nodeService.moveNode(
-                fileToMove,
-                folder2,
-                ContentModel.ASSOC_CONTAINS,
-                QName.createQName(TEST_NAMESPACE));
+                    fileToMove,
+                    folder2,
+                    ContentModel.ASSOC_CONTAINS,
+                    QName.createQName(TEST_NAMESPACE));
 
             assertEquals(folder2, nodeService.getPrimaryParent(fileToMove).getParentRef());
 
@@ -989,8 +1031,7 @@ public class UpdateRepoEventIT extends AbstractContextAwareRepoEvent
         checkNumOfEvents(3);
 
         final String folder2ID = getNodeResource(2).getId();
-        final String moveFileParentAfterMove =
-            getNodeResource(3).getPrimaryHierarchy().get(0);
+        final String moveFileParentAfterMove = getNodeResource(3).getPrimaryHierarchy().get(0);
 
         assertEquals("Wrong node parent.", folder2ID, moveFileParentAfterMove);
     }
@@ -1003,7 +1044,6 @@ public class UpdateRepoEventIT extends AbstractContextAwareRepoEvent
         final Set<String> originalAspects = resource.getAspectNames();
         assertNotNull(originalAspects);
 
-
         retryingTransactionHelper.doInTransaction(() -> {
             // Add cm:geographic aspect with default value
             nodeService.addAspect(nodeRef, ContentModel.ASPECT_GEOGRAPHIC, null);

repository/src/test/java/org/alfresco/repo/rendition2/AbstractRenditionIntegrationTest.java

@@ -2,7 +2,7 @@
  * #%L
  * Alfresco Repository
  * %%
- * Copyright (C) 2005 - 2022 Alfresco Software Limited
+ * Copyright (C) 2005 - 2025 Alfresco Software Limited
  * %%
  * This file is part of the Alfresco software.
  * If the software was purchased under a paid Alfresco license, the terms of
@@ -26,6 +26,7 @@
 package org.alfresco.repo.rendition2;
 
 import static java.lang.Thread.sleep;
+
 import static org.alfresco.model.ContentModel.PROP_CONTENT;
 import static org.alfresco.model.RenditionModel.PROP_RENDITION_CONTENT_HASH_CODE;
 import static org.alfresco.repo.content.MimetypeMap.EXTENSION_BINARY;
@@ -35,6 +36,15 @@ import java.io.FileNotFoundException;
 import java.io.Serializable;
 import java.util.Collections;
 
+import junit.framework.AssertionFailedError;
+import org.junit.After;
+import org.junit.AfterClass;
+import org.junit.Before;
+import org.junit.BeforeClass;
+import org.quartz.CronExpression;
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.util.ResourceUtils;
+
 import org.alfresco.model.ContentModel;
 import org.alfresco.repo.content.MimetypeMap;
 import org.alfresco.repo.content.metadata.AsynchronousExtractor;
@@ -45,6 +55,7 @@ import org.alfresco.repo.thumbnail.ThumbnailRegistry;
 import org.alfresco.repo.transaction.RetryingTransactionHelper;
 import org.alfresco.service.cmr.rendition.RenditionService;
 import org.alfresco.service.cmr.repository.ChildAssociationRef;
+import org.alfresco.service.cmr.repository.ContentData;
 import org.alfresco.service.cmr.repository.ContentReader;
 import org.alfresco.service.cmr.repository.ContentService;
 import org.alfresco.service.cmr.repository.ContentWriter;
@@ -52,6 +63,7 @@ import org.alfresco.service.cmr.repository.MimetypeService;
 import org.alfresco.service.cmr.repository.NodeRef;
 import org.alfresco.service.cmr.repository.NodeService;
 import org.alfresco.service.cmr.repository.StoreRef;
+import org.alfresco.service.cmr.repository.datatype.DefaultTypeConverter;
 import org.alfresco.service.cmr.security.MutableAuthenticationService;
 import org.alfresco.service.cmr.security.PermissionService;
 import org.alfresco.service.cmr.security.PersonService;
@@ -61,15 +73,6 @@ import org.alfresco.transform.registry.TransformServiceRegistry;
 import org.alfresco.util.BaseSpringTest;
 import org.alfresco.util.GUID;
 import org.alfresco.util.PropertyMap;
-import org.junit.After;
-import org.junit.AfterClass;
-import org.junit.Before;
-import org.junit.BeforeClass;
-import org.quartz.CronExpression;
-import org.springframework.beans.factory.annotation.Autowired;
-import org.springframework.util.ResourceUtils;
-
-import junit.framework.AssertionFailedError;
 
 /**
  * Class unites common utility methods for {@link org.alfresco.repo.rendition2} package tests.
@@ -128,6 +131,7 @@ public abstract class AbstractRenditionIntegrationTest extends BaseSpringTest
 
     protected static final String ADMIN = "admin";
     protected static final String DOC_LIB = "doclib";
+    protected static final String PDF = "pdf";
 
     private CronExpression origLocalTransCron;
     private CronExpression origRenditionCron;
@@ -152,7 +156,7 @@ public abstract class AbstractRenditionIntegrationTest extends BaseSpringTest
 
         // Strict MimetypeCheck
         System.setProperty("transformer.strict.mimetype.check", "true");
-        //  Retry on DifferentMimetype
+        // Retry on DifferentMimetype
         System.setProperty("content.transformer.retryOn.different.mimetype", "true");
     }
 
@@ -181,7 +185,7 @@ public abstract class AbstractRenditionIntegrationTest extends BaseSpringTest
 
         if (transformServiceRegistry instanceof LocalTransformServiceRegistry)
         {
-            ((LocalTransformServiceRegistry)transformServiceRegistry).setEnabled(localTransformServiceEnabled);
+            ((LocalTransformServiceRegistry) transformServiceRegistry).setEnabled(localTransformServiceEnabled);
         }
 
         thumbnailRegistry.setTransformServiceRegistry(transformServiceRegistry);
@@ -257,9 +261,7 @@ public abstract class AbstractRenditionIntegrationTest extends BaseSpringTest
     // Creates a new source node as the given user in its own transaction.
     protected NodeRef createSource(String user, String testFileName)
     {
-        return AuthenticationUtil.runAs(() ->
-                transactionService.getRetryingTransactionHelper().doInTransaction(() ->
-                        createSource(testFileName)), user);
+        return AuthenticationUtil.runAs(() -> transactionService.getRetryingTransactionHelper().doInTransaction(() -> createSource(testFileName)), user);
     }
 
     // Creates a new source node as the current user in the current transaction.
@@ -271,12 +273,10 @@ public abstract class AbstractRenditionIntegrationTest extends BaseSpringTest
     // Changes the content of a source node as the given user in its own transaction.
     protected void updateContent(String user, NodeRef sourceNodeRef, String testFileName)
     {
-        AuthenticationUtil.runAs((AuthenticationUtil.RunAsWork<Void>) () ->
-                transactionService.getRetryingTransactionHelper().doInTransaction(() ->
-                {
-                    updateContent(sourceNodeRef, testFileName);
-                    return null;
-                }), user);
+        AuthenticationUtil.runAs((AuthenticationUtil.RunAsWork<Void>) () -> transactionService.getRetryingTransactionHelper().doInTransaction(() -> {
+            updateContent(sourceNodeRef, testFileName);
+            return null;
+        }), user);
     }
 
     // Changes the content of a source node as the current user in the current transaction.
@@ -295,12 +295,10 @@ public abstract class AbstractRenditionIntegrationTest extends BaseSpringTest
     // Clears the content of a source node as the given user in its own transaction.
     protected void clearContent(String user, NodeRef sourceNodeRef)
     {
-        AuthenticationUtil.runAs((AuthenticationUtil.RunAsWork<Void>) () ->
-                transactionService.getRetryingTransactionHelper().doInTransaction(() ->
-                {
-                    clearContent(sourceNodeRef);
-                    return null;
-                }), user);
+        AuthenticationUtil.runAs((AuthenticationUtil.RunAsWork<Void>) () -> transactionService.getRetryingTransactionHelper().doInTransaction(() -> {
+            clearContent(sourceNodeRef);
+            return null;
+        }), user);
     }
 
     // Clears the content of a source node as the current user in the current transaction.
@@ -312,23 +310,19 @@ public abstract class AbstractRenditionIntegrationTest extends BaseSpringTest
     // Requests a new rendition as the given user in its own transaction.
     protected void render(String user, NodeRef sourceNode, String renditionName)
     {
-        AuthenticationUtil.runAs((AuthenticationUtil.RunAsWork<Void>) () ->
-                transactionService.getRetryingTransactionHelper().doInTransaction(() ->
-                {
-                    render(sourceNode, renditionName);
-                    return null;
-                }), user);
+        AuthenticationUtil.runAs((AuthenticationUtil.RunAsWork<Void>) () -> transactionService.getRetryingTransactionHelper().doInTransaction(() -> {
+            render(sourceNode, renditionName);
+            return null;
+        }), user);
     }
 
     // Requests a new metadata extract as the given user in its own transaction.
     protected void extract(String user, NodeRef sourceNode)
     {
-        AuthenticationUtil.runAs((AuthenticationUtil.RunAsWork<Void>) () ->
-                transactionService.getRetryingTransactionHelper().doInTransaction(() ->
-                {
-                    extract(sourceNode);
-                    return null;
-                }), user);
+        AuthenticationUtil.runAs((AuthenticationUtil.RunAsWork<Void>) () -> transactionService.getRetryingTransactionHelper().doInTransaction(() -> {
+            extract(sourceNode);
+            return null;
+        }), user);
     }
 
     // Requests a new rendition as the current user in the current transaction.
@@ -357,7 +351,7 @@ public abstract class AbstractRenditionIntegrationTest extends BaseSpringTest
             Throwable cause = e.getCause();
             if (cause instanceof AssertionFailedError)
             {
-                throw (AssertionFailedError)cause;
+                throw (AssertionFailedError) cause;
             }
             throw e;
         }
@@ -375,7 +369,7 @@ public abstract class AbstractRenditionIntegrationTest extends BaseSpringTest
             Throwable cause = e.getCause();
             if (cause instanceof AssertionFailedError)
             {
-                throw (AssertionFailedError)cause;
+                throw (AssertionFailedError) cause;
             }
             throw e;
         }
@@ -386,16 +380,15 @@ public abstract class AbstractRenditionIntegrationTest extends BaseSpringTest
     {
         long maxMillis = 10000;
         ChildAssociationRef assoc = null;
-        for (int i = (int)(maxMillis / 1000); i >= 0; i--)
+        for (int i = (int) (maxMillis / 1000); i >= 0; i--)
         {
             // Must create a new transaction in order to see changes that take place after this method started.
-            assoc = transactionService.getRetryingTransactionHelper().doInTransaction(() ->
-                    renditionService2.getRenditionByName(sourceNodeRef, renditionName), true, true);
+            assoc = transactionService.getRetryingTransactionHelper().doInTransaction(() -> renditionService2.getRenditionByName(sourceNodeRef, renditionName), true, true);
             if (assoc != null)
             {
                 break;
             }
-            logger.debug("RenditionService2.getRenditionByName(...) sleep "+i);
+            logger.debug("RenditionService2.getRenditionByName(...) sleep " + i);
             sleep(1000);
         }
         if (shouldExist)
@@ -415,11 +408,10 @@ public abstract class AbstractRenditionIntegrationTest extends BaseSpringTest
     {
         long maxMillis = 5000;
         boolean nodeModified = true;
-        for (int i = (int)(maxMillis / 1000); i >= 0; i--)
+        for (int i = (int) (maxMillis / 1000); i >= 0; i--)
         {
             // Must create a new transaction in order to see changes that take place after this method started.
-            nodeModified = transactionService.getRetryingTransactionHelper().doInTransaction(() ->
-            {
+            nodeModified = transactionService.getRetryingTransactionHelper().doInTransaction(() -> {
                 Serializable created = nodeService.getProperty(sourceNodeRef, ContentModel.PROP_CREATED);
                 Serializable modified = nodeService.getProperty(sourceNodeRef, ContentModel.PROP_MODIFIED);
                 return !created.equals(modified);
@@ -428,7 +420,7 @@ public abstract class AbstractRenditionIntegrationTest extends BaseSpringTest
             {
                 break;
             }
-            logger.debug("waitForExtract sleep "+i);
+            logger.debug("waitForExtract sleep " + i);
             sleep(1000);
         }
         if (nodePropsShouldChange)
@@ -445,7 +437,7 @@ public abstract class AbstractRenditionIntegrationTest extends BaseSpringTest
     protected String getTestFileName(String sourceMimetype) throws FileNotFoundException
     {
         String extension = mimetypeMap.getExtension(sourceMimetype);
-        String testFileName = extension.equals(EXTENSION_BINARY) ? null : "quick."+extension;
+        String testFileName = extension.equals(EXTENSION_BINARY) ? null : "quick." + extension;
         if (testFileName != null)
         {
             try
@@ -491,8 +483,7 @@ public abstract class AbstractRenditionIntegrationTest extends BaseSpringTest
 
     String createRandomUser()
     {
-        return AuthenticationUtil.runAs(() ->
-        {
+        return AuthenticationUtil.runAs(() -> {
             String username = generateNewUsernameString();
             createUser(username);
             return username;
@@ -505,13 +496,12 @@ public abstract class AbstractRenditionIntegrationTest extends BaseSpringTest
     }
 
     void createUser(final String username,
-                            final String firstName,
-                            final String lastName,
-                            final String jobTitle,
-                            final long quota)
+            final String firstName,
+            final String lastName,
+            final String jobTitle,
+            final long quota)
     {
-        RetryingTransactionHelper.RetryingTransactionCallback<Void> createUserCallback = () ->
-        {
+        RetryingTransactionHelper.RetryingTransactionCallback<Void> createUserCallback = () -> {
             authenticationService.createAuthentication(username, PASSWORD.toCharArray());
 
             PropertyMap personProperties = new PropertyMap();
@@ -519,7 +509,7 @@ public abstract class AbstractRenditionIntegrationTest extends BaseSpringTest
             personProperties.put(ContentModel.PROP_AUTHORITY_DISPLAY_NAME, "title" + username);
             personProperties.put(ContentModel.PROP_FIRSTNAME, firstName);
             personProperties.put(ContentModel.PROP_LASTNAME, lastName);
-            personProperties.put(ContentModel.PROP_EMAIL, username+"@example.com");
+            personProperties.put(ContentModel.PROP_EMAIL, username + "@example.com");
             personProperties.put(ContentModel.PROP_JOBTITLE, jobTitle);
             if (quota > 0)
             {
@@ -548,14 +538,12 @@ public abstract class AbstractRenditionIntegrationTest extends BaseSpringTest
     }
 
     /**
-     * Helper method which gets the content hash code from the supplied rendition node without specific validations (the
-     * equivalent method from {@link RenditionService2Impl} is not exposed)
+     * Helper method which gets the content hash code from the supplied rendition node without specific validations (the equivalent method from {@link RenditionService2Impl} is not exposed)
      *
      * @param renditionNodeRef
      *            the rendition node
      *
-     * @return -1 in case of there is no content, -2 in case rendition doesn't exist, the actual content hash code
-     *         otherwise
+     * @return -1 in case of there is no content, -2 in case rendition doesn't exist, the actual content hash code otherwise
      */
     protected int getRenditionContentHashCode(NodeRef renditionNodeRef)
     {
@@ -569,4 +557,28 @@ public abstract class AbstractRenditionIntegrationTest extends BaseSpringTest
 
         return renditionContentHashCode;
     }
+
+    /**
+     * Helper method which gets the content hash code from the supplied source node (the equivalent method from {@link RenditionService2Impl} is not public)
+     *
+     * @param sourceNodeRef
+     *            the source node
+     *
+     * @return -1 in case of there is no content, otherwise, the actual content hash code otherwise
+     */
+    protected int getSourceContentHashCode(NodeRef sourceNodeRef)
+    {
+        int hashCode = -1;
+        ContentData contentData = DefaultTypeConverter.INSTANCE.convert(ContentData.class, nodeService.getProperty(sourceNodeRef, PROP_CONTENT));
+        if (contentData != null)
+        {
+            // Originally we used the contentData URL, but that is not enough if the mimetype changes.
+            String contentString = contentData.getContentUrl() + contentData.getMimetype();
+            if (contentString != null)
+            {
+                hashCode = contentString.hashCode();
+            }
+        }
+        return hashCode;
+    }
 }

repository/src/test/java/org/alfresco/repo/rendition2/RenditionService2IntegrationTest.java

@@ -2,7 +2,7 @@
  * #%L
  * Alfresco Repository
  * %%
- * Copyright (C) 2005 - 2022 Alfresco Software Limited
+ * Copyright (C) 2005 - 2025 Alfresco Software Limited
  * %%
  * This file is part of the Alfresco software.
  * If the software was purchased under a paid Alfresco license, the terms of
@@ -25,16 +25,21 @@
  */
 package org.alfresco.repo.rendition2;
 
-import static org.alfresco.model.ContentModel.PROP_CONTENT;
 import static org.junit.Assert.assertNotEquals;
 
+import static org.alfresco.model.ContentModel.PROP_CONTENT;
+
 import java.io.ByteArrayInputStream;
 import java.io.InputStream;
 import java.util.ArrayList;
 import java.util.List;
 
+import org.junit.BeforeClass;
+import org.junit.Test;
+
 import org.alfresco.model.ContentModel;
 import org.alfresco.model.RenditionModel;
+import org.alfresco.repo.content.MimetypeMap;
 import org.alfresco.repo.security.authentication.AuthenticationUtil;
 import org.alfresco.repo.security.permissions.AccessDeniedException;
 import org.alfresco.service.cmr.repository.ChildAssociationRef;
@@ -44,8 +49,6 @@ import org.alfresco.service.cmr.repository.datatype.DefaultTypeConverter;
 import org.alfresco.service.cmr.security.PermissionService;
 import org.alfresco.service.namespace.NamespaceService;
 import org.alfresco.service.namespace.QName;
-import org.junit.BeforeClass;
-import org.junit.Test;
 
 /**
  * Integration tests for {@link RenditionService2}
@@ -62,37 +65,37 @@ public class RenditionService2IntegrationTest extends AbstractRenditionIntegrati
     // PDF transformation
 
     @Test
-    public void testLocalRenderPdfToJpegMedium() 
+    public void testLocalRenderPdfToJpegMedium()
     {
         checkRendition("quick.pdf", "medium", true);
     }
 
     @Test
-    public void testLocalRenderPdfToDoclib() 
+    public void testLocalRenderPdfToDoclib()
     {
         checkRendition("quick.pdf", "doclib", true);
     }
 
     @Test
-    public void testLocalRenderPdfJpegImgpreview() 
+    public void testLocalRenderPdfJpegImgpreview()
     {
         checkRendition("quick.pdf", "imgpreview", true);
     }
 
     @Test
-    public void testLocalRenderPdfPngAvatar() 
+    public void testLocalRenderPdfPngAvatar()
     {
         checkRendition("quick.pdf", "avatar", true);
     }
 
     @Test
-    public void testLocalRenderPdfPngAvatar32() 
+    public void testLocalRenderPdfPngAvatar32()
     {
         checkRendition("quick.pdf", "avatar32", true);
     }
 
     @Test
-    public void testLocalRenderPdfFlashWebpreview() 
+    public void testLocalRenderPdfFlashWebpreview()
     {
         checkRendition("quick.pdf", "webpreview", false);
     }
@@ -100,43 +103,43 @@ public class RenditionService2IntegrationTest extends AbstractRenditionIntegrati
     // DOCX transformation
 
     @Test
-    public void testLocalRenderDocxJpegMedium() 
+    public void testLocalRenderDocxJpegMedium()
     {
         checkRendition("quick.docx", "medium", true);
     }
 
     @Test
-    public void testLocalRenderDocxDoclib() 
+    public void testLocalRenderDocxDoclib()
     {
         checkRendition("quick.docx", "doclib", true);
     }
 
     @Test
-    public void testLocalRenderDocxJpegImgpreview() 
+    public void testLocalRenderDocxJpegImgpreview()
     {
         checkRendition("quick.docx", "imgpreview", true);
     }
 
     @Test
-    public void testLocalRenderDocxPngAvatar() 
+    public void testLocalRenderDocxPngAvatar()
     {
         checkRendition("quick.docx", "avatar", true);
     }
 
     @Test
-    public void testLocalRenderDocxPngAvatar32() 
+    public void testLocalRenderDocxPngAvatar32()
     {
         checkRendition("quick.docx", "avatar32", true);
     }
 
     @Test
-    public void testLocalRenderDocxFlashWebpreview() 
+    public void testLocalRenderDocxFlashWebpreview()
     {
         checkRendition("quick.docx", "webpreview", false);
     }
 
     @Test
-    public void testLocalRenderDocxPdf() 
+    public void testLocalRenderDocxPdf()
     {
         checkRendition("quick.docx", "pdf", true);
     }
@@ -150,7 +153,7 @@ public class RenditionService2IntegrationTest extends AbstractRenditionIntegrati
     }
 
     @Test
-    public void changedSourceToNullContent() 
+    public void changedSourceToNullContent()
     {
         NodeRef sourceNodeRef = createSource(ADMIN, "quick.jpg");
         render(ADMIN, sourceNodeRef, DOC_LIB);
@@ -158,8 +161,7 @@ public class RenditionService2IntegrationTest extends AbstractRenditionIntegrati
 
         clearContent(ADMIN, sourceNodeRef);
         render(ADMIN, sourceNodeRef, DOC_LIB);
-        ChildAssociationRef assoc = AuthenticationUtil.runAs(() ->
-                renditionService2.getRenditionByName(sourceNodeRef, DOC_LIB), ADMIN);
+        ChildAssociationRef assoc = AuthenticationUtil.runAs(() -> renditionService2.getRenditionByName(sourceNodeRef, DOC_LIB), ADMIN);
         waitForRendition(ADMIN, sourceNodeRef, DOC_LIB, false);
         assertNull("There should be no rendition as there was no content", assoc);
     }
@@ -190,8 +192,7 @@ public class RenditionService2IntegrationTest extends AbstractRenditionIntegrati
 
         clearContent(ADMIN, sourceNodeRef);
         render(ADMIN, sourceNodeRef, DOC_LIB);
-        ChildAssociationRef assoc = AuthenticationUtil.runAs(() ->
-                renditionService2.getRenditionByName(sourceNodeRef, DOC_LIB), ADMIN);
+        ChildAssociationRef assoc = AuthenticationUtil.runAs(() -> renditionService2.getRenditionByName(sourceNodeRef, DOC_LIB), ADMIN);
         waitForRendition(ADMIN, sourceNodeRef, DOC_LIB, false);
         assertNull("There should be no rendition as there was no content", assoc);
 
@@ -201,7 +202,7 @@ public class RenditionService2IntegrationTest extends AbstractRenditionIntegrati
     }
 
     @Test
-    public void testCreateRenditionByUser() 
+    public void testCreateRenditionByUser()
     {
         String userName = createRandomUser();
         NodeRef sourceNodeRef = createSource(userName, "quick.jpg");
@@ -211,13 +212,12 @@ public class RenditionService2IntegrationTest extends AbstractRenditionIntegrati
     }
 
     @Test
-    public void testReadRenditionByOtherUser() 
+    public void testReadRenditionByOtherUser()
     {
         String ownerUserName = createRandomUser();
         NodeRef sourceNodeRef = createSource(ownerUserName, "quick.jpg");
         String otherUserName = createRandomUser();
-        transactionService.getRetryingTransactionHelper().doInTransaction(() ->
-        {
+        transactionService.getRetryingTransactionHelper().doInTransaction(() -> {
             permissionService.setPermission(sourceNodeRef, otherUserName, PermissionService.READ, true);
             return null;
         });
@@ -231,13 +231,12 @@ public class RenditionService2IntegrationTest extends AbstractRenditionIntegrati
     }
 
     @Test
-    public void testRenderByReader() 
+    public void testRenderByReader()
     {
         String ownerUserName = createRandomUser();
         NodeRef sourceNodeRef = createSource(ownerUserName, "quick.jpg");
         String otherUserName = createRandomUser();
-        transactionService.getRetryingTransactionHelper().doInTransaction(() ->
-        {
+        transactionService.getRetryingTransactionHelper().doInTransaction(() -> {
             permissionService.setPermission(sourceNodeRef, otherUserName, PermissionService.READ, true);
             return null;
         });
@@ -251,14 +250,13 @@ public class RenditionService2IntegrationTest extends AbstractRenditionIntegrati
     }
 
     @Test
-    public void testAccessWithNoPermissions() 
+    public void testAccessWithNoPermissions()
     {
         String ownerUserName = createRandomUser();
         NodeRef sourceNodeRef = createSource(ownerUserName, "quick.jpg");
         render(ownerUserName, sourceNodeRef, DOC_LIB);
         String noPermissionsUser = createRandomUser();
-        transactionService.getRetryingTransactionHelper().doInTransaction(() ->
-        {
+        transactionService.getRetryingTransactionHelper().doInTransaction(() -> {
             permissionService.setPermission(sourceNodeRef, noPermissionsUser, PermissionService.ALL_PERMISSIONS, false);
             return null;
         });
@@ -280,12 +278,9 @@ public class RenditionService2IntegrationTest extends AbstractRenditionIntegrati
         NodeRef sourceNodeRef = createSource(ownerUserName, "quick.jpg");
         final QName doclibRendDefQName = QName.createQName(NamespaceService.CONTENT_MODEL_1_0_URI, "doclib");
         transactionService.getRetryingTransactionHelper()
-                .doInTransaction(() ->
-                AuthenticationUtil.runAs(() ->
-                        renditionService.render(sourceNodeRef, doclibRendDefQName), ownerUserName));
+                .doInTransaction(() -> AuthenticationUtil.runAs(() -> renditionService.render(sourceNodeRef, doclibRendDefQName), ownerUserName));
 
-        NodeRef oldRendition = AuthenticationUtil.runAs(() ->
-                renditionService.getRenditionByName(sourceNodeRef, doclibRendDefQName).getChildRef(), ownerUserName);
+        NodeRef oldRendition = AuthenticationUtil.runAs(() -> renditionService.getRenditionByName(sourceNodeRef, doclibRendDefQName).getChildRef(), ownerUserName);
         assertFalse("The rendition should be generated by old Rendition Service",
                 AuthenticationUtil.runAs(() -> nodeService.hasAspect(oldRendition, RenditionModel.ASPECT_RENDITION2), ownerUserName));
 
@@ -335,12 +330,10 @@ public class RenditionService2IntegrationTest extends AbstractRenditionIntegrati
         renditionService2.setEnabled(false);
 
         // Call 'clearRenditionContentData' method directly to prove rendition content will be cleaned
-        AuthenticationUtil.runAs((AuthenticationUtil.RunAsWork<Void>) () ->
-            transactionService.getRetryingTransactionHelper().doInTransaction(() ->
-            {
-                renditionService2.clearRenditionContentData(sourceNodeRef, DOC_LIB);
-                return null;
-            }), ADMIN);
+        AuthenticationUtil.runAs((AuthenticationUtil.RunAsWork<Void>) () -> transactionService.getRetryingTransactionHelper().doInTransaction(() -> {
+            renditionService2.clearRenditionContentData(sourceNodeRef, DOC_LIB);
+            return null;
+        }), ADMIN);
 
         // The rendition should not have content by now
         assertNull("Rendition has content", nodeService.getProperty(renditionNodeRef, ContentModel.PROP_CONTENT));
@@ -356,8 +349,7 @@ public class RenditionService2IntegrationTest extends AbstractRenditionIntegrati
     /**
      * Tests if a rendition without content (but with contentHashCode) can be generated again.
      * <p>
-     * If the rendition consumption receives a null InputStream, the contentHashCode should be cleaned from the
-     * rendition node, allowing new requests to generate the rendition.
+     * If the rendition consumption receives a null InputStream, the contentHashCode should be cleaned from the rendition node, allowing new requests to generate the rendition.
      * </p>
      */
     @Test
@@ -369,8 +361,7 @@ public class RenditionService2IntegrationTest extends AbstractRenditionIntegrati
     /**
      * Tests if a rendition without content (but with contentHashCode) can be generated again.
      * <p>
-     * If the rendition consumption receives a zero length InputStream, the contentHashCode should be cleaned from the
-     * rendition node, allowing new requests to generate the rendition.
+     * If the rendition consumption receives a zero length InputStream, the contentHashCode should be cleaned from the rendition node, allowing new requests to generate the rendition.
      * </p>
      */
     @Test
@@ -455,6 +446,61 @@ public class RenditionService2IntegrationTest extends AbstractRenditionIntegrati
         assertEquals(TOTAL_NODES, countModifier(nodes, user1));
     }
 
+    @Test
+    public void testForceRenditionsContentHashCode()
+    {
+
+        // Create a node
+        NodeRef sourceNodeRef = createSource(ADMIN, "quick.docx");
+        assertNotNull("Node not generated", sourceNodeRef);
+
+        // Get content hash code for the source node
+        int sourceNodeContentHashCode = getSourceContentHashCode(sourceNodeRef);
+
+        // Trigger the pdf rendition
+        render(ADMIN, sourceNodeRef, PDF);
+        NodeRef pdfRenditionNodeRef = waitForRendition(ADMIN, sourceNodeRef, PDF, true);
+        assertNotNull("pdf rendition was not generated", pdfRenditionNodeRef);
+        assertNotNull("pdf rendition was not generated", nodeService.getProperty(pdfRenditionNodeRef, PROP_CONTENT));
+
+        // Check the pdf rendition content hash code is valid
+        int pdfRenditionContentHashCode = getRenditionContentHashCode(pdfRenditionNodeRef);
+        assertEquals("pdf rendition content hash code is different from source node content hash code", sourceNodeContentHashCode, pdfRenditionContentHashCode);
+
+        // Trigger the doc lib rendition
+        render(ADMIN, sourceNodeRef, DOC_LIB);
+        NodeRef docLibRenditionNodeRef = waitForRendition(ADMIN, sourceNodeRef, DOC_LIB, true);
+        assertNotNull("doc lib rendition was not generated", docLibRenditionNodeRef);
+        assertNotNull("doc lib rendition was not generated", nodeService.getProperty(docLibRenditionNodeRef, PROP_CONTENT));
+
+        // Check the doc lib rendition content hash code is valid
+        int docLibenditionContentHashCode = getRenditionContentHashCode(docLibRenditionNodeRef);
+        assertEquals("doc lib rendition content hash code is different from source node content hash code", sourceNodeContentHashCode, docLibenditionContentHashCode);
+
+        // Update the source node content
+        updateContent(ADMIN, sourceNodeRef, "quick.docx");
+
+        // Get source node content hash code after update
+        int sourceNodeContentHashCode2 = getSourceContentHashCode(sourceNodeRef);
+
+        // Check content hash code are different after content update
+        assertNotEquals("Source node content hash code is the same after content update", sourceNodeContentHashCode, sourceNodeContentHashCode2);
+        assertNotEquals("pdf rendition content hash code is the same after content update", sourceNodeContentHashCode2, pdfRenditionContentHashCode);
+        assertNotEquals("doc lib rendition content hash code is the same after content update", sourceNodeContentHashCode2, docLibenditionContentHashCode);
+
+        // Forces the content hash code for every source node renditions
+        AuthenticationUtil.runAs(() -> {
+            renditionService2.forceRenditionsContentHashCode(sourceNodeRef);
+            return null;
+        }, ADMIN);
+
+        // Check the renditions content hash code are now the same as the latest source node content hash code
+        int pdfRenditionContentHashCode2 = getRenditionContentHashCode(pdfRenditionNodeRef);
+        int docLibenditionContentHashCode2 = getRenditionContentHashCode(docLibRenditionNodeRef);
+        assertEquals("pdf rendition content hash code is different from latest source node content hash code", sourceNodeContentHashCode2, pdfRenditionContentHashCode2);
+        assertEquals("doc lib rendition content hash code is different from latest source node content hash code", sourceNodeContentHashCode2, docLibenditionContentHashCode2);
+    }
+
     private int countModifier(List<NodeRef> nodes, String user)
     {
         int count = 0;
@@ -492,22 +538,16 @@ public class RenditionService2IntegrationTest extends AbstractRenditionIntegrati
             NodeRef sourceNodeRef = createSource(ADMIN, "quick.jpg");
             final QName doclibRendDefQName = QName.createQName(NamespaceService.CONTENT_MODEL_1_0_URI, "doclib");
             transactionService.getRetryingTransactionHelper()
-                    .doInTransaction(() ->
-                            AuthenticationUtil.runAs(() ->
-                                    renditionService.render(sourceNodeRef, doclibRendDefQName), ADMIN));
+                    .doInTransaction(() -> AuthenticationUtil.runAs(() -> renditionService.render(sourceNodeRef, doclibRendDefQName), ADMIN));
             assertNotNull("The old renditions service did not render", waitForRendition(ADMIN, sourceNodeRef, DOC_LIB, true));
             List<String> lastThumbnailModification = transactionService.getRetryingTransactionHelper()
-                    .doInTransaction(() ->
-                            AuthenticationUtil.runAs(() ->
-                                    (List<String>) nodeService.getProperty(sourceNodeRef, ContentModel.PROP_LAST_THUMBNAIL_MODIFICATION_DATA), ADMIN));
+                    .doInTransaction(() -> AuthenticationUtil.runAs(() -> (List<String>) nodeService.getProperty(sourceNodeRef, ContentModel.PROP_LAST_THUMBNAIL_MODIFICATION_DATA), ADMIN));
             updateContent(ADMIN, sourceNodeRef, "quick.png");
             List<String> newThumbnailModification = null;
             for (int i = 0; i < 5; i++)
             {
                 newThumbnailModification = transactionService.getRetryingTransactionHelper()
-                        .doInTransaction(() ->
-                                AuthenticationUtil.runAs(() ->
-                                        (List<String>) nodeService.getProperty(sourceNodeRef, ContentModel.PROP_LAST_THUMBNAIL_MODIFICATION_DATA), ADMIN));
+                        .doInTransaction(() -> AuthenticationUtil.runAs(() -> (List<String>) nodeService.getProperty(sourceNodeRef, ContentModel.PROP_LAST_THUMBNAIL_MODIFICATION_DATA), ADMIN));
                 if (!newThumbnailModification.equals(lastThumbnailModification))
                 {
                     break;
@@ -579,9 +619,7 @@ public class RenditionService2IntegrationTest extends AbstractRenditionIntegrati
             NodeRef sourceNodeRef = createSource(ADMIN, "quick.jpg");
             final QName doclibRendDefQName = QName.createQName(NamespaceService.CONTENT_MODEL_1_0_URI, "doclib");
             transactionService.getRetryingTransactionHelper()
-                    .doInTransaction(() ->
-                            AuthenticationUtil.runAs(() ->
-                                    renditionService.render(sourceNodeRef, doclibRendDefQName), ADMIN));
+                    .doInTransaction(() -> AuthenticationUtil.runAs(() -> renditionService.render(sourceNodeRef, doclibRendDefQName), ADMIN));
             waitForRendition(ADMIN, sourceNodeRef, DOC_LIB, true);
 
             renditionService2.setEnabled(true);
@@ -652,9 +690,7 @@ public class RenditionService2IntegrationTest extends AbstractRenditionIntegrati
             NodeRef sourceNodeRef = createSource(ADMIN, "quick.jpg");
             final QName doclibRendDefQName = QName.createQName(NamespaceService.CONTENT_MODEL_1_0_URI, "doclib");
             transactionService.getRetryingTransactionHelper()
-                    .doInTransaction(() ->
-                            AuthenticationUtil.runAs(() ->
-                                    renditionService.render(sourceNodeRef, doclibRendDefQName), ADMIN));
+                    .doInTransaction(() -> AuthenticationUtil.runAs(() -> renditionService.render(sourceNodeRef, doclibRendDefQName), ADMIN));
             waitForRendition(ADMIN, sourceNodeRef, DOC_LIB, true);
 
             renditionService2.setEnabled(true);
@@ -682,4 +718,57 @@ public class RenditionService2IntegrationTest extends AbstractRenditionIntegrati
             renditionService2.setEnabled(true);
         }
     }
+
+    @Test
+    public void testTextExtractTransformAllowedWhenThumbnailDisabled()
+    {
+        // create a source node
+        NodeRef sourceNodeRef = createSource(ADMIN, "quick.pdf");
+        assertNotNull("Node not generated", sourceNodeRef);
+        String replyQueue = "org.test.queue";
+        String targetMimetype = MimetypeMap.MIMETYPE_TEXT_PLAIN;
+
+        TransformDefinition textExtractTransform = new TransformDefinition(
+                targetMimetype,
+                java.util.Collections.emptyMap(),
+                "clientData",
+                replyQueue,
+                "requestId");
+
+        renditionService2.setThumbnailsEnabled(false);
+        try
+        {
+            // Should NOT throw, as this is a text extract transform
+            AuthenticationUtil.runAs(() -> {
+                transactionService.getRetryingTransactionHelper().doInTransaction(() -> {
+                    renditionService2.transform(sourceNodeRef, textExtractTransform);
+                    return null;
+                });
+                return null;
+            }, ADMIN);
+        }
+        finally
+        {
+            renditionService2.setThumbnailsEnabled(true);
+        }
+    }
+
+    @Test
+    public void testMetadataExtractTransformAllowedWhenThumbnailDisabled()
+    {
+        // create a source node
+        NodeRef sourceNodeRef = createSource(ADMIN, "quick.pdf");
+        assertNotNull("Node not generated", sourceNodeRef);
+        renditionService2.setThumbnailsEnabled(false);
+        try
+        {
+            // Should NOT throw, as this is a metadata extract transform
+            extract(ADMIN, sourceNodeRef);
+            waitForExtract(ADMIN, sourceNodeRef, true);
+        }
+        finally
+        {
+            renditionService2.setThumbnailsEnabled(true);
+        }
+    }
 }