chore(server): bump REST API version

.editorconfig

@@ -21,9 +21,9 @@ root = true
 charset = utf-8
 end_of_line = lf
 insert_final_newline = true
-max_line_length = 100
+max_line_length = 120
 ij_wrap_on_typing = true
-ij_visual_guides = 100
+ij_visual_guides = 120
 
 
 [*.{java,xml,py}]

.github/workflows/check-dependencies.yml

@@ -47,7 +47,7 @@ jobs:
       - name: 'Checkout Repository'
         uses: actions/checkout@v4
       - name: 'Dependency Review'
-        uses: actions/dependency-review-action@v3
+        uses: actions/dependency-review-action@v5
         # Refer: https://github.com/actions/dependency-review-action
         with:
           # TODO: reset critical to low before releasing

.github/workflows/docker-build-ci.yml

@@ -24,10 +24,17 @@ on:
       - 'release-*'
   pull_request:
     paths:
-      - '**/Dockerfile*'
+      - '.github/workflows/docker-build-ci.yml'
       - '.dockerignore'
-      - 'hugegraph-server/hugegraph-dist/docker/**'
-      - 'hugegraph-server/hugegraph-dist/src/assembly/static/bin/util.sh'
+      - '.mvn/**'
+      - 'pom.xml'
+      - 'hugegraph-commons/**'
+      - 'hugegraph-cluster-test/**'
+      - 'hugegraph-pd/**'
+      - 'hugegraph-store/**'
+      - 'hugegraph-struct/**'
+      - 'hugegraph-server/**'
+      - 'install-dist/**'
 
 jobs:
   docker-build:
@@ -47,7 +54,8 @@ jobs:
 
       - name: Build ${{ matrix.dockerfile }}
         run: |
-          IMAGE_ID=$(docker build -q -f ${{ matrix.dockerfile }} .)
+          IMAGE_ID=$(docker build -q --build-arg SOURCE_REVISION="$GITHUB_SHA" \
+            -f ${{ matrix.dockerfile }} .)
           echo "Built: $IMAGE_ID"
           echo "IMAGE_ID=$IMAGE_ID" >> "$GITHUB_ENV"
           HC=$(docker inspect --format='{{json .Config.Healthcheck}}' "$IMAGE_ID")
@@ -78,3 +86,34 @@ jobs:
             echo "ERROR: no usable socket-table tool (ss/netstat) in ${{ matrix.dockerfile }}"
             exit 1
           }
+
+      - name: Server image API versions match source
+        if: ${{ startsWith(matrix.dockerfile, 'hugegraph-server/') }}
+        run: |
+          CHECK_DIR=$(mktemp -d)
+          trap 'rm -rf "$CHECK_DIR"' EXIT
+          docker run --rm --entrypoint bash \
+            -v "$CHECK_DIR:/check" "$IMAGE_ID" -c \
+            'cp /hugegraph-server/lib/hugegraph-api-*.jar \
+                /hugegraph-server/lib/hugegraph-common-*.jar /check/'
+
+          API_JAR=$(find "$CHECK_DIR" -name 'hugegraph-api-*.jar' -print -quit)
+          COMMON_JAR=$(find "$CHECK_DIR" -name 'hugegraph-common-*.jar' -print -quit)
+          EXPECTED_MANIFEST=$(sed -n \
+            's|.*<Implementation-Version>\([^<]*\)</Implementation-Version>.*|\1|p' \
+            hugegraph-server/hugegraph-api/pom.xml)
+          ACTUAL_MANIFEST=$(unzip -p "$API_JAR" META-INF/MANIFEST.MF |
+            sed -n 's/^Implementation-Version: *//p' | tr -d '\r')
+          EXPECTED_PROPERTY=$(sed -n 's/^ApiVersion=//p' \
+            hugegraph-commons/hugegraph-common/src/main/resources/version.properties)
+          ACTUAL_PROPERTY=$(unzip -p "$COMMON_JAR" version.properties |
+            sed -n 's/^ApiVersion=//p' | tr -d '\r')
+
+          [[ "$ACTUAL_MANIFEST" == "$EXPECTED_MANIFEST" ]] || {
+            echo "ERROR: API manifest is $ACTUAL_MANIFEST; expected $EXPECTED_MANIFEST"
+            exit 1
+          }
+          [[ "$ACTUAL_PROPERTY" == "$EXPECTED_PROPERTY" ]] || {
+            echo "ERROR: API property is $ACTUAL_PROPERTY; expected $EXPECTED_PROPERTY"
+            exit 1
+          }

.github/workflows/hbase-docker-build-ci.yml

@@ -0,0 +1,78 @@
+#
+# Licensed to the Apache Software Foundation (ASF) under one or more
+# contributor license agreements.  See the NOTICE file distributed with
+# this work for additional information regarding copyright ownership.
+# The ASF licenses this file to You under the Apache License, Version 2.0
+# (the "License"); you may not use this file except in compliance with
+# the License.  You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+name: "HBase Docker Build CI"
+
+on:
+  push:
+    branches:
+      - master
+      - 'release-*'
+    paths:
+      - '.github/workflows/hbase-docker-build-ci.yml'
+      - 'docker/hbase/**'
+  pull_request:
+    paths:
+      - '.github/workflows/hbase-docker-build-ci.yml'
+      - 'docker/hbase/**'
+
+jobs:
+  docker-build:
+    runs-on: ubuntu-24.04
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Validate HBase entrypoint and config
+        run: |
+          bash -n docker/hbase/entrypoint.sh
+          python3 -c 'import xml.etree.ElementTree as ET; ET.parse("docker/hbase/hbase-site.xml")'
+
+      - name: Build HBase image
+        run: |
+          IMAGE_ID=$(docker build -q docker/hbase)
+          echo "Built: $IMAGE_ID"
+          ENTRYPOINT=$(docker inspect --format='{{json .Config.Entrypoint}}' "$IMAGE_ID")
+          echo "Entrypoint: $ENTRYPOINT"
+          [[ "$ENTRYPOINT" == '["/entrypoint.sh"]' ]] || {
+            echo "ERROR: unexpected HBase entrypoint: $ENTRYPOINT"
+            exit 1
+          }
+
+          CONTAINER_ID=$(docker run -d --hostname hbase "$IMAGE_ID")
+          cleanup() {
+            docker logs "$CONTAINER_ID" || true
+            docker rm -f "$CONTAINER_ID" || true
+          }
+          trap cleanup EXIT
+
+          for attempt in $(seq 1 240); do
+            if docker logs "$CONTAINER_ID" 2>&1 | grep -Fq "HBase is ready."; then
+              docker exec "$CONTAINER_ID" bash -lc \
+                'echo "status '\''simple'\''" | "$HBASE_HOME/bin/hbase" shell -n' \
+                | grep -E -q \
+                  '([1-9][0-9]*[[:space:]]+live[[:space:]]+servers|[1-9][0-9]*[[:space:]]+servers|servers:[[:space:]]*[1-9])'
+              exit 0
+            fi
+            if [[ "$(docker inspect -f '{{.State.Running}}' "$CONTAINER_ID")" != "true" ]]; then
+              echo "ERROR: HBase container exited before readiness"
+              exit 1
+            fi
+            sleep 2
+          done
+          echo "ERROR: HBase container did not become ready within 480 seconds"
+          exit 1

.serena/memories/code_style_and_conventions.md

@@ -6,7 +6,7 @@
 - `.licenserc.yaml` + apache-rat-plugin + skywalking-eyes — License header validation
 
 ## Core Rules
-- **Line length**: 100 chars (120 for XML)
+- **Line length**: 120 chars
 - **Indent**: 4 spaces, continuation 8 spaces
 - **Charset**: UTF-8, LF line endings, final newline
 - **Imports**: Sorted `$*` → `java` → `javax` → `org` → `com` → `*`, no star imports (threshold 100)

AGENTS.md

@@ -85,7 +85,7 @@ Before writing new tests, check existing suites under `hugegraph-server/hugegrap
 
 ## Style & Pre-commit
 
-- Line 100, 4-space indent, LF, UTF-8, **no star imports**
+- Line 120, 4-space indent, LF, UTF-8, **no star imports**
 - Commit format: `feat|fix|refactor(module): msg`
 - Run before pushing:
   ```bash

README.md

@@ -342,7 +342,7 @@ For detailed architecture and development guidance, see [AGENTS.md](AGENTS.md).
    - Try modifying a test and see what breaks
 
 5. **Code Standards**
-   - Line length: 100 characters
+   - Line length: 120 characters
    - Indentation: 4 spaces
    - No star imports
    - Commit format: `feat|fix|refactor(module): description`

hugegraph-commons/hugegraph-common/src/main/resources/version.properties

@@ -17,7 +17,7 @@
 # hugegraph-common follows the project version defined by ${revision} in the root pom.xml,
 # and VersionInBash needs to be updated in this file.
 Version=${revision}
-ApiVersion=0.71
+ApiVersion=0.72
 ApiCheckBeginVersion=1.0
 ApiCheckEndVersion=2.0
 VersionInBash=1.7.0

hugegraph-pd/docs/development.md

@@ -282,7 +282,7 @@ HugeGraph PD follows Apache HugeGraph code style.
 
 **Key Style Rules**:
 - **Indentation**: 4 spaces (no tabs)
-- **Line length**: 100 characters (Java), 120 characters (comments)
+- **Line length**: 120 characters
 - **Braces**: K&R style (opening brace on same line)
 - **Imports**: No wildcard imports (`import java.util.*`)
 

hugegraph-server/Dockerfile

@@ -25,9 +25,10 @@ WORKDIR /pkg
 COPY . .
 
 ARG MAVEN_ARGS
+ARG SOURCE_REVISION=local
 
-RUN --mount=type=cache,target=/root/.m2 \
-    mvn package $MAVEN_ARGS -e -B -ntp -Dmaven.test.skip=true -Dmaven.javadoc.skip=true \
+RUN --mount=type=cache,id=hugegraph-maven-${SOURCE_REVISION},target=/root/.m2,sharing=locked \
+    mvn install $MAVEN_ARGS -e -B -ntp -Dmaven.test.skip=true -Dmaven.javadoc.skip=true \
     && rm ./hugegraph-server/*.tar.gz ./hugegraph-pd/*.tar.gz ./hugegraph-store/*.tar.gz
 
 # 2nd stage: runtime env

hugegraph-server/Dockerfile-hstore

@@ -25,9 +25,10 @@ WORKDIR /pkg
 COPY . .
 
 ARG MAVEN_ARGS
+ARG SOURCE_REVISION=local
 
-RUN --mount=type=cache,target=/root/.m2 \
-    mvn package $MAVEN_ARGS -e -B -ntp -DskipTests -Dmaven.javadoc.skip=true \
+RUN --mount=type=cache,id=hugegraph-maven-${SOURCE_REVISION},target=/root/.m2,sharing=locked \
+    mvn install $MAVEN_ARGS -e -B -ntp -DskipTests -Dmaven.javadoc.skip=true \
     && rm ./hugegraph-server/*.tar.gz ./hugegraph-pd/*.tar.gz ./hugegraph-store/*.tar.gz
 
 # 2nd stage: runtime env

hugegraph-server/hugegraph-api/pom.xml

@@ -201,8 +201,8 @@
                             </addDefaultSpecificationEntries>
                         </manifest>
                         <manifestEntries>
-                            <!-- TODO: update it -->
-                            <Implementation-Version>0.71.0.0</Implementation-Version>
+                            <!-- Bump when the public REST API contract changes -->
+                            <Implementation-Version>0.72.0.0</Implementation-Version>
                         </manifestEntries>
                     </archive>
                 </configuration>

hugegraph-server/hugegraph-api/src/main/java/org/apache/hugegraph/api/auth/ManagerAPI.java

@@ -287,20 +287,28 @@ public String checkDefaultRole(@Context GraphManager manager,
             defaultRole = null; // unreachable, satisfies compiler
         }
         validGraphSpace(manager, graphSpace);
-        boolean hasGraph = defaultRole.equals(HugeDefaultRole.OBSERVER);
-        E.checkArgument(!hasGraph || StringUtils.isNotEmpty(graph),
-                        "Must set a graph for observer");
+        boolean hasGraph = defaultRole.equals(HugeDefaultRole.OBSERVER) && StringUtils.isNotEmpty(graph);
         if (hasGraph) {
             validGraph(manager, graphSpace, graph);
         }
 
         boolean result;
         if (hasGraph) {
-            result = authManager.isDefaultRole(graphSpace, graph, user,
-                                               defaultRole);
+            result = authManager.isDefaultRole(graphSpace, graph, user, defaultRole);
+            if (!result) {
+                result = authManager.isDefaultRole(graphSpace, user,
+                                                   defaultRole);
+            }
         } else {
-            result = authManager.isDefaultRole(graphSpace, user,
-                                               defaultRole);
+            result = authManager.isDefaultRole(graphSpace, user, defaultRole);
+            if (!result && defaultRole.equals(HugeDefaultRole.OBSERVER)) {
+                for (String currentGraph : manager.graphs(graphSpace)) {
+                    if (authManager.isDefaultRole(graphSpace, currentGraph, user, defaultRole)) {
+                        result = true;
+                        break;
+                    }
+                }
+            }
         }
         return manager.serializer().writeMap(ImmutableMap.of("check", result));
     }

hugegraph-server/hugegraph-api/src/main/java/org/apache/hugegraph/api/auth/UserAPI.java

@@ -22,7 +22,10 @@
 import org.apache.commons.lang3.StringUtils;
 import org.apache.hugegraph.api.API;
 import org.apache.hugegraph.api.filter.StatusFilter.Status;
+import org.apache.hugegraph.auth.AuthManager;
+import org.apache.hugegraph.auth.HugeGraphAuthProxy;
 import org.apache.hugegraph.auth.HugeUser;
+import org.apache.hugegraph.auth.RolePermission;
 import org.apache.hugegraph.backend.id.Id;
 import org.apache.hugegraph.backend.id.IdGenerator;
 import org.apache.hugegraph.core.GraphManager;
@@ -153,8 +156,14 @@ public String role(@Context GraphManager manager,
                        @PathParam("id") String id) {
         LOG.debug("GraphSpace [{}] get user role: {}", graphSpace, id);
 
-        HugeUser user = manager.authManager().getUser(IdGenerator.of(id));
-        return manager.authManager().rolePermission(user).toJson();
+        AuthManager authManager = manager.authManager();
+        HugeUser user = authManager.getUser(IdGenerator.of(id));
+        RolePermission role = authManager.rolePermission(user);
+        String operator = HugeGraphAuthProxy.username();
+        if (authManager.isAdminManager(operator)) {
+            return role.toJson();
+        }
+        return role.toJson(graphSpace);
     }
 
     @DELETE