API changes – IIZI 5.0

The 5.0 JavaDoc is published with the release build; until then, the names below are the reference.

Added

API	What it does
`IClientSessionGyro.getUIScheme()`, `getUISchemeChoice()`, `setUIScheme()`, `setUIMode()`, `setUIFamily()`, `addUISchemeListener()`, `removeUISchemeListener()`	Read and set the session's theme family and mode, and listen to changes.
`IClientSessionGyro.saveClientStorage()`, `getClientStorage()`	Write and read values the client keeps in the Browser's local storage (also on `IRemoteSessionControl`).
`IClientSessionGyro.setAnalyticsConsent()`	Record the user's analytics consent when the application asks for it itself.
`IClientSessionGyro.showWebEngineWarning()`	Show the outdated web engine warning from the application.
`IPushNotificationAPI.subscribe()`, `unsubscribe()`, `resetDevice()`, `resetDeviceEverywhere()`	Manage a device's Push Notification subscriptions from the server.
`IUIFloatOpener`	Open and close a floating panel (UIFloat) from application Java.
`Series.appendLive()`	Append points to a UIChart series from any thread, with a live window (`$liveMaxPoints`, `$liveMaxSeconds`, `$liveScroll`).
`@OnUIUpload`	Receives each file a UIFileUpload delivers.
`KString.newTrustedHTMLKString()`	Create a trusted KString for HTML that a classical KString refuses.
UIFileUpload, UIFloat, UIThemeChooser	New components in iiziGo's palette.
UIChart `$legend`, `$legendSelectable`, `$legendPos`	A legend that can let the user hide series.
`.iiziPush` “Subscribe at sign-in”	Subscribe a user's device when the user signs in.
`.iiziPWA`	The installable web app settings of an application.
App page “Icon (vector, dark)”, “Icon (bitmap, dark)”; `iconDark` in `apps.json`	An application's icon for dark mode.
Selector terms `app-iiziRun`, `app-PWA`, `ptr-coarse`, `ptr-fine`, `hover`, `dev-isVirtual`	New device selector terms.
`--iz-*` theme tokens	The color roles, shape, type, motion and decoration tokens of the themes, for custom CSS.
Client: `izPush.setCredential()`	Give the client's Push API its credential as HTTP Basic or as a Bearer token.

Server settings

Setting	Purpose
`$upload.allow`, `$upload.quota.server`, `$upload.quota.session`, `$upload.maxFiles`, `$upload.chunkSize`, `$upload.idleTimeout`, `$upload.startTimeout`, `$upload.maxPause`, `$upload.types`	File upload: on or off (off by default) and its limits.
`$allowedOrigins`	Origins granted cross-origin reads.
`$geo.trustedProxies`	Reverse proxies whose forwarded client address is trusted.
`$webEngine.refresh`	The weekly refresh of the web engine release data (on by default).
`$signIn.secondFactorAdministrators`	Asks administrators for a second step on a development server.
`iizi.license.servers` (system property), `IIZI_LICENSE_SERVERS` (environment)	The license servers to contact; `none` for none.
`IIZI_JAVA` (environment)	The Java every launcher runs.

Changed

NotFoundException extends RuntimeException instead of Error.
@OnUIFocus methods are also called when the component gains the focus; check isFocusGained(). The event of a focus gained names the component that lost the focus as its opposite.
A message box shown with no buttons gets the localized OK button.
A classical KString refuses SCRIPT, IFRAME, STYLE and FOREIGNOBJECT, javascript: and vbscript: URLs, and event attributes other than IIZI's own.
UIGauge's value property is $value; panels saved with the old name value still load.
UIChart.zoomin(), zoomout(), setWindow() and clearWindow() work, and the axis colors and plot animation set in iiziGo reach the chart.
Event names of sendStat follow GA4's rule; invalid and reserved names are refused with a WARNING.
Percent sizes resolve against the parent's content box.
The Push wire is version 2; version 1 clients are refused.
ServerAdmin's application ID is com.iizix.serveradmin.

Deprecated

IClientSessionGyro.saveDeviceParameters() and getDeviceParameters(): use saveClientStorage() and getClientStorage(). The old methods keep working.

Not for signing users in

UserAuthentication.validateUser, changeExternallyAuthenticatedUser and signInAuthenticatedUser bypass the server's sign-in checks (throttle, second step). Sign users in with the SignIn module.

Removed

The Diffie-Hellman login: common/crypto in the clients, the password transaction, and the pk/epw members of app.json.
The OAuth sign-in layer of 4.x (ScribeJava).
Libraries no longer on IIZI's class path: firebase-admin, the async HTTP stack and netty, pushy, fast-uuid, commons-net (with NtpTimeProvider), dev.samstevens.totp, ScribeJava and image4j (net.sf.image4j.*).
The retired DOMElement component is dropped from a panel when it loads.
The PWA page's application name, description and Firebase group, and the Push page's private key and service account fields.
IIZI's own XML files refuse a DOCTYPE.