2.0.0-alpha

WebExpress.WebApp 2.0.0-alpha

Release date: 2026-10-31
Target framework: .NET 10 (net10.0)
Blog: WebExpress 2.0.0-alpha – Halloween update

WebExpress.WebApp 2.0.0-alpha is a major rework of the business application template for WebExpress. Data-bound controls are now built on a View/State/Service architecture with typed C# authoring, and the release adds a large set of new controls, real-time collaborative editing, a hybrid relation (link) system and a set of new administration pages. Most ControlRest* types were renamed to ControlData*, so existing applications need to be migrated.

Highlights

• View/State/Service architecture: controls declare their state, services and templates in C#, and a ControlViewState host can share one state between several controls.
• Real-time collaboration: operational transformation with the server as the sequencer, for rich text, graphs, spreadsheets and the WQL prompt.
• Many new controls: Gantt, schedule, graph viewer, permission management, relation view/editor, feed, file view, SLA, traffic light, scrum team and velocity, tag, like, document and spreadsheet dialogs, and more.
• Hybrid relation system: semantic links between objects and to external addresses, with registered systems and relation types.
• New administration pages: certificates, email, security, applications, jobs, REST APIs, themes and log, protected by access policies.
• Theming: colour scheme, light/dark mode and icon set are separate preferences, and a new landing page layout is available.
• Cluster support: the message queue, the index, the login lockout and collaborative documents can work across several instances.

New Features

Data Layer (View/State/Service)

• New namespace WebData with the C# authoring surface for data-bound controls:
  • IDataIsland marks a control as data-bound. The control writes hidden wx-state and wx-service island elements that the client engine reads.
  • DataState, DataServiceDescriptor/DataServiceBuilder and DataResourceDescriptor/DataResourceBuilder describe the initial state, the REST services and the named resources. Endpoints are declared through Endpoint<TEndpoint> and resolved through the sitemap when the page is rendered.
  • DataAuthoringExtensions, ViewStateAuthoringExtensions and ViewStateBindingExtensions provide fluent State, Service and Resource chains.
  • IDataResource and DataTypeName let you reference resources and services by type (Resource<TResource>(), Service<TService>()) instead of strings.
  • IViewState and IViewStateBound: a control bound to a resource of an enclosing ViewState writes a data-wx-resource binding instead of its own state and service.
  • DataQueryState is the standard query state (search term, query, filter, page, page size, order) for lists, tables and tiles.
• ControlViewState and ControlViewStateGeneric host a ViewState region of the page. FragmentControlViewState is the matching fragment base.
• New client modules: webexpress.webapp.service.js, webexpress.webapp.template.js, webexpress.webapp.intent.js, webexpress.webapp.data.js and webexpress.webapp.viewstate.js, plus *.model.js files for the migrated controls. The custom DOM controls now render from state.
• Data change notifications: DataChangedNotifier announces server-side data changes through DataChangedMessage over the WebSocket. DataSubscription lets a ViewState subscribe to the domains of its services, so bound resources can query their data again. RestApiCrud and RestApiScrumBacklog call the notifier.
• A standardized control contract for the WebExpress client controls.

Controls

New data-bound controls (C# class with client controller):

• Planning: ControlDataGantt (tasks, links, calendars, scheduling, and a sandbox mode for trying out scheduling changes), ControlDataSchedule, ControlDataScrumTeam, ControlDataScrumVelocity, ControlDataSla.
• Structure and relations: ControlDataGraphViewer, ControlDataRelationView, ControlDataRelationViewItem, ControlDataRelationEditor (administration of relation types).
• Content and collaboration: ControlDataFeed, ControlDataFileView (file list and tile board, extensible with further views), ControlDataModalDocument, ControlDataModalEditor, ControlDataModalSpreadsheet, ControlLike, ControlDataTag, ControlDataWatcher.
• Administration and status: ControlDataPermission (group-to-policy assignments of a protected resource), ControlStatusTask, ControlSystemMetric (live CPU and memory values over the WebSocket), ControlDataTrafficLight.
• Navigation and search: ControlDataSidebar, ControlDataSearch, ControlWebAppHeaderSearch with the new SectionAppSearch slot.
• Inputs and filters: ControlDataDnf and ControlDataFormItemInputDnf, ControlDataFormItemInputCascading, ControlDataQuickfilterItemDropdown, a choice input in forms and wizards, and an estimate input in the scrum backlog.
• Authentication: ControlDataLogin and ControlDataModalLogin. The "stay signed in" choice is passed through the login REST API.
• Theming: ControlDataSelectionColorScheme and ControlDataSelectionIconSet. The icon set changes without a page reload.

Improvements to existing controls:

• Kanban: configurable statuses for columns (RestApiKanbanStatus), selecting the status on drag and drop, coloured status chips on cards, and resizing columns by dragging (replaces the size menu). While a card is dragged, a column that has no allowed status for the card is shown in red and refuses the drop.
• Table: column templates for country, e-mail, phone, calendar, colour, combo, date, DNF, editor, HTML, Markdown, move, numeric, rating, selection, status, tag, text, traffic light and inline editing (RestApiTableColumnTemplate*). Also hierarchical rows (RestApiTableRow.Children, Expanded), a layout API (TableCtrl.serializeLayout()/applyLayout(), RestApiTableLayout), a localized EmptyText, and improved ordering, editing and sorting.
• Dashboard: reworked widget rendering, lifecycle and persistence, with new board column/widget types.
• Tabs: tab templates and a reworked tab renaming feature. Bindings declared on a ControlDataTabTemplate are now applied to the content of every pane.
• Form editor: rebuilt on the unified View/State/Service architecture, with drafts (RestApiFormEditorDraft).
• WQL prompt: model-driven state architecture, advanced query features and collaborative editing.
• Headline: can optionally be edited.
• Dropdowns and sidebar: RestApiDropdown and the sidebar support headers and dividers.
• Responsive app shell layout.

Real-time Collaboration

• New namespace WebCollaboration. Several users can edit the same document at the same time using operational transformation. The server is the only authority on the order of changes.
• ICollaborativeDocumentManager/CollaborativeDocumentManager accept an operation only on the current version, validate it against the document's schema, assign the next version, and then store and distribute it.
• Schemas (ICollaborativeSchema): RichTextSchema, PlainTextSchema, GraphSchema and SpreadsheetSchema. They prevent a manipulated client from breaking the structure or adding markup, unsafe addresses or styles.
• Exchangeable persistence (ICollaborativeDocumentStore): MemoryCollaborativeDocumentStore and ClusterCollaborativeDocumentStore, with snapshots (CollaborativeSnapshot) and operation history.
• Extension points: ICollaborativeDocumentProvider supplies initial content from your own storage. ICollaborativeAccessPolicy checks permissions beyond the access token, which CollaborativeAccess issues and verifies.

Relations

• New namespace WebRelation with a hybrid link system: object relations (for example blocks, causes, is a duplicate of) and external web links.
• RelationRegistry is the extension point where plugins register link systems (IRelationSystem/RelationSystem) and relation types (IRelationType/RelationType).
• Each relation type defines its cardinality (RelationCardinality), direction (RelationDirection) and workflow effect (RelationEffect). A link has a lifecycle status (RelationStatus), so it is marked obsolete instead of being deleted.
• REST support through RestApiRelation, RestApiRelationType and related payload types. Validation errors come back as machine-readable codes (RelationValidationResult).

REST API

• RestApiRefusal refuses a request with a message the client is meant to read. RestApiFault answers a failed request without revealing how it failed.
• The REST base classes build their WQL filter through an overridable QueryMode property (default WqlQueryMode.Exact). An endpoint backed by a database can return WqlQueryMode.Translatable.
• Typed form fields (RestApiFormField<T> with TryRead<T>, Detach<T>, ReadOptionalGuid). These keep the intent of an update apart: Missing, Empty, Valid or Invalid.
• Avatar uploads: DetachAvatar validates data URLs against RestApiAvatarUploadOptions (PNG, JPEG, GIF and WebP up to 4 MiB by default). ResolveAvatar hands storage decisions to callbacks provided by the application.
• New endpoint base classes for feed, file, Gantt, graph, permission, relation, schedule, sidebar, tag, scrum team and velocity, colour scheme (RestApiColorScheme) and icon set (RestApiIconSet).

Theming and Layout

• Colour scheme, mode and icon set are separate preferences (ThemePreferences, ColorScheme, IconSet, ApplyColorScheme, ApplyIconSet). Every colour scheme is available in light and dark. The Designs page offers three captioned pickers and marks the theme in use.
• Landing pages: IPage<VisualTreeWebAppLanding> provides a public website layout with its own header, hero, content and footer (SectionLandingHeader, SectionLandingHero, SectionLandingFooter). It follows the visitor's theme, mode and icon set.
• SectionCookieBanner is a dedicated slot for cookie notices on application and landing pages.
• New fragment slots for the permission toolbar (SectionPermissionToolbar*) and the relation view (SectionRelationView*).
• A unified colour scheme for a consistent appearance.

Administration

• New settings pages under Settings > System: Applications, Certificates, Email, Jobs, Log (with download), REST APIs, Security and Themes.
  • Certificates shows the inventory of the host's ICertificateManager (alias, hostnames, subject, issuer, validity, status) without passwords or key material. It requires SystemAccessPolicy.
  • Security shows the headers, cookie attributes, cross-site request checks and protocols (including HTTP/3) that the running server actually applies.
  • Email shows the active email policy and whether a provider is available. It is hidden by ConditionEmailEnabled when the delivery service is disabled.
  • Log: inside a container, the log file cannot be switched on.
• The plugin settings page now uses the package manager directly. It lists what each package depends on and what depends on it, shows why a package is not running, and offers a search. Every plugin except a system plugin can be deactivated and removed. Messages appear in the language of the request.
• SettingPageAccess makes the settings navigation offer only pages the identity is allowed to open. The Settings menu is hidden from non-admin users.

Security and Authentication

• RestApiSession now issues a token pair after the provider has verified the credentials, instead of using server-side sessions. Tokens are set as protected cookies and are not returned in the JSON response.
• Login lockout is tracked per application and user, and through the cluster store across instances. A hard lock ends after PermanentLockoutDurationSeconds (default one hour), and ResetFailedAttempts lifts it manually.
• UI state (comments, file view, search, tabs, tables, theme selection and others) is stored in localStorage instead of cookies.

Messaging and Cluster

• AddressDescriptor and ForwardedMessage let messages reach clients connected to other instances of a cluster. The chat channel store, progress tasks and the index manager have cluster support.
• SystemMetricsDispatcher and SystemMetricsSampler push live CPU and memory readings to subscribed clients.
• Jobs release their resources on shutdown, which allows a graceful shutdown when a container stops.

Performance

• The pluggable cluster layer removes scaling bottlenecks when several instances run behind a load balancer.
• System metrics are pushed over the WebSocket instead of being polled over HTTP.
• Collaborative documents load from the latest snapshot and replay only the operations after it.

Bug Fixes

• ControlDataWizard: the render overload no longer ignores its pages argument.
• The log extract on the settings page is now encoded, so markup in request lines can no longer reach the admin page unescaped.
• Markup that a peer writes into a contenteditable outside an editor is now parsed inert and cleaned by EditorHtml.clean.
• Fixed XSS handling on the plugin settings page.
• Inline table editing now shows the field and general validation messages of a RestApiCrud refusal and keeps the entered value.
• Session notifications are shown again after a WebSocket reconnect. A dismissed popup is removed from the session so it does not appear again.
• Tab template bindings are applied, and binding targets are resolved within the bound element only.
• Gantt no longer keeps a link optimistically, and shows an error when the server refuses to create it.
• Fixed Kanban card rendering, state persistence and race conditions. Fixed dashboard widget rendering and lifecycle.
• Fixed ViewState lifecycle, scoping and synchronization, as well as autocomplete and request handling. The service layer reports an abort that happens while the response body is read as an abort, not as a parse failure.
• Fixed graph rendering, edge alignment, workflow reload and autosave serialization in the workflow editor.
• Fixed internal links and images in comments and the editor.
• Status pages no longer show a bright block, and text colours no longer freeze, in dark mode.
• Client texts follow the page language. Dates and times in Gantt, sprint, relation view, form editor, document form and workflow editor use the page language. Remaining English literals are translated, and wrong resource keys are corrected.
• Accessibility improvements across all controls, including landmarks, accessible names, heading levels and contrast of at least 4.5:1.

Breaking Changes

• ControlRest* → ControlData*: the REST-backed controls, their interfaces and fragments were renamed, for example ControlRestTable → ControlDataTable, ControlRestForm → ControlDataForm, IControlRest → IControlData, ControlRestTabTemplate → ControlDataTabTemplate, FragmentControlRestTable → FragmentControlDataTable. This affects the table, list, tile, tab, form, form editor, wizard, dashboard, kanban, dropdown, avatar dropdown, comment, login, quickfilter, scrum backlog/sprint, workflow and WQL prompt.
• Observer → Watcher: ControlRestObserver, RestApiObserver*, webexpress.webapp.observer.js/.css and the wx-webapp-observer class became ControlDataWatcher, RestApiWatcher*, webexpress.webapp.watcher.js/.css and wx-webapp-watcher.
• Removed: webexpress.webapp.modalform.js (ModalFormCtrl), PluginPackageService and PluginPackageOperationResult. The plugin REST API now uses the package manager.
• IdentityProvider now derives from LocalIdentityProvider. RestUri was renamed to RestEndpoint, and CreateForbiddenPage was replaced by CreateForbiddenResponse (override).
• Authentication: server-side sessions were replaced by token-based authentication with cookies.
• UI state: client state is stored in localStorage, and previously stored cookie values are no longer read.
• Client architecture: controls render from state through the View/State/Service engine, and the editor control is state-driven. Custom client code that reads or modifies the DOM of these controls directly must be adapted.
• Bootstrap and Popper.js: the WebApp stylesheets, scripts and documentation no longer depend on Bootstrap and Popper.js.
• WebExpress dependencies: requires WebExpress.WebUI and WebExpress.WebIndex 2.0.0-alpha.

Dependencies

Package	Change	Version	Licence
WebExpress.WebUI	updated	0.0.11-alpha → 2.0.0-alpha	MIT
WebExpress.WebIndex	updated	0.0.11-alpha → 2.0.0-alpha	MIT
Microsoft.Sbom.Targets	added (build only, PrivateAssets="all")	4.1.13	MIT
xunit.v3 (tests)	updated	3.2.2 → 4.0.2	Apache-2.0
Microsoft.NET.Test.Sdk (tests)	removed	18.5.1	MIT

A THIRD-PARTY-NOTICES.md was added. It lists the direct third-party components and the full texts of their original licences.

Build and Tests

• Release packages include an SPDX SBOM. Microsoft.Sbom.Targets embeds the manifest in the .nupkg, and a copy is placed next to the package as <packageid>.spdx.json with a .sha256 file. In Visual Studio builds, dotnet msbuild generates the SBOM.
• The solution was migrated from .sln to .slnx.
• dotnet test runs on Microsoft.Testing.Platform (global.json). The obsolete TestingPlatformDotnetTestSupport property was removed.
• The test project uses settings/webexpress.settings.json instead of Config/webexpress.config.xml, following the .NET configuration model.
• Tests run in parallel with the server garbage collector. Only the message queue cluster test stays serial.
• New headless JavaScript tests (JsTest, about 150 *.test.mjs files) run in Node with a minimal DOM stub. UnitTestJavaScript runs them as part of the xUnit run, with up to one Node process per processor.
• Many new C# tests for controls, fragments, REST APIs, data, collaboration, relations, message queue and includes.
• Fixed solution references and the Node version in the documentation workflow.

Documentation

• New guides: docs/collaboration.md (real-time collaboration), docs/landing-pages.md, docs/landing-reference-license.md and docs/form-table-extensions.md. docs/user-guide.md now covers certificate administration.
• New JavaScript component documentation in docs/js/ for binds, cascading input, dashboard, DNF, feed, file view, Gantt, graph viewer, Kanban, like, modal editor, modal spreadsheet, permission, relation editor and view, schedule, scrum team and velocity, search and search suggestion, SLA, status task, system metric, tag, traffic light, watcher, workflow editor and WQL prompt. observer.md was replaced by watcher.md.
• Updated documentation for comment, collaborative, form, form editor, tab and theme selector.
• README: new project description, corrected links and an AI transparency notice.