Release 1.6.0

Improvements:

• OLMIS-8224: Report translations and customizable global header.
  • Report translation bundle sourced from Transifex (openlmis-report.report-translations resource) and merged with an optional deployment-specific bundle mounted under /config/reports/resourceBundles. Separator style stays localizable.
  • Translation bundles are resolved without the JVM default-locale fallback - a locale with no translation file now deterministically falls back to the English base bundle.
  • Merged translation bundles and the compiled global header template are cached for the service lifetime, so a change under /config/reports needs the configuration image rebuilt and the service restarted.
  • The service logs, per locale, which deployment translation override keys were applied and how many were discarded for repeating the English source.
  • The Periodic Stock On Hand Summary, Facility Assignment Configuration Errors, Pick Pack List and CCE Alert History reports read their labels from the translation bundle. They carried the English text in the template itself, so they printed in English whatever locale was asked for. Adds report.column.closingStock, report.title.pickPackList and report.title.cceAlertHistory; the other 40 labels reuse keys that already existed.
  • The CCE Alert History header block (Equipment, Facility, Program, Generated on) reads from the bundle as well. Its title and columns were already translated, but these four stayed English in every locale. The four rows also move down with the title instead of being printed over it: in French, Spanish and Portuguese the title wraps onto two lines and used to overlap the first two rows.
  • The Periodic Stock On Hand Summary page footer reads from the bundle. It built its text as "Page " + n + " of " + total, so it printed English on all 336 pages in every locale while the rest of that report was translated; it now uses report.controls.pageOfPages like the Stock On Hand report does.
  • Translated labels wrap instead of being cut off. The label fields were sized for English and there is no spare width on the page, so they now grow downwards; the Stock On Hand column headers lost characters in French, Spanish and Portuguese.
  • Multi-dimensional arrays are accepted by the report deserialization allowlist. A crosstab stores its cells as JRCrosstabCell[][], and the one-dimensional "[L" patterns do not match "[[L", so compiled crosstab reports were rejected as invalid.
• OLMIS-8176: Added the Pack Size report translations (report.column.packSize, report.header.packSize) used by the new Pack Size column in the stock reports.
• OLMIS-8280 Migrated the SonarCloud analysis to Java 21 by running it through the SonarQube scan action instead of the Gradle plugin, and removed the now-unused Gradle sonar plugin and configuration.
• OLMIS-8280 Removed the axios dependency from the Consul registration script, replacing it with the native Node http client (no more axios security advisories to track).
• Stabilized consul registration and health checks
• ODRC-24 Global header and translations implemented for reports
• OLMIS-8231: Preserve Jasper template parameters order as declared in the .jrxml file.
• OLMIS-8235: Add override query parameter to Jasper template upload to safely replace an existing template.
• Enabled JaCoCo offline instrumentation so coverage of classes exercised through PowerMock (@PrepareForTest / whenNew / spy) is recorded; these were previously reported as near-zero because PowerMock's classloader bypasses the on-the-fly agent.
• ODRC-130: Native reports changes and report translations updates.
• MW-1471: Exposed the Prometheus metrics endpoint at /actuator/prometheus.

Security:

• OLMIS-8224: Restricted POST /api/reports/generate to service-level tokens (the trusted client).

Bugs:

• OLMIS-8235: Fix template override wiping parameter API metadata (selectExpression, selectMethod etc.)
• OLMIS-8235: Fix HTTP 500 when re-uploading (override=true) a template whose parameters carry dependencies - dependency rows were written with a null parameterId; parameters and their dependencies are now reconciled in place with the parameter id preserved.
• OLMIS-8187: Fix duplicate rows in Periodic SOH report - remove SELECT DISTINCT that was hiding identical legitimate movements
• OLMIS-8224: Fix the Periodic Stock On Hand Summary header printing the literal null for Facility when no facility is selected. Program and Product already fell back to "All"; Facility printed the raw parameter. All three now read the fallback from report.header.value.all instead of a hard-coded English literal.
• OLMIS-8223: Fixed apostrophes in messages.
• OLMIS-8347: Fix the Pick Pack List showing only the products that were ordered and shipped as the very same orderable, leaving the report empty or almost empty whenever a trade item was picked against a commodity type order line. The UNION branch meant to map a shipped trade item onto its ordered commodity type still required order_li.orderableid = shipment_li.orderableid, never traversed trade_item_classifications, and applied an uncorrelated dispensable-attribute filter that matched everything. The branch now maps trade item to commodity type through the classification system and disambiguates candidates by dispensable attributes, so pack sizes such as Pentavalent (1 dose) and (10 dose) stay on their own order lines. The direct-match branch no longer requires the order line and the draft line to carry the same orderable version, so a product edited between requisition and packing stays on the report, and the dispensable-attribute comparison is case-insensitive like Dispensable.equals in referencedata. The UNION structure introduced for performance in OLMIS-8000 is kept.

New functionality:

• MW-1449: Added Superset guest token endpoint for embedded dashboards. Dashboard reports now carry an optional embeddedUuid column referencing a Superset embedded dashboard. The new /api/reports/superset/guest-token endpoint exchanges an OpenLMIS user for a short-lived Superset guest token, gated by the REPORTS_VIEW right and a lookup against the dashboard's embeddedUuid.