Added the check_api_user_permission_required Event, allowing applications to decide on a per-request basis whether user permission checks are required. The Event receives feature, method, uriTemplate, and userId. A result of true requires a permission check, false skips the check, and null uses the platform's default behavior.

WebRoleFeatureConfig has been extended with getFeaturesMapByRoleName(), allowing a single configuration to define Features for multiple Roles instead of being limited to one Role. Configuration dependencies are also automatically bound and now provide setters for easier extension and customization.

Added saveAdminRolesByAdminIdAndRoleNames() and saveUserRolesByUserIdAndRoleNames() to assign Roles to Admins or Users directly by Role name. Assigning Roles to an Admin by ID is now idempotent, preventing duplicate records from being created when the same Role has already been assigned.

Added findByNameIn(), getRoleIdsByNames(), getRoleIdMapByNames(), getRoleMapByIds(), and getRoleNameMapByIds(). These APIs allow multiple Roles to be retrieved in a single operation, reducing the number of database queries when applications need to process multiple Roles at once.

Before redirecting to the login page, Admin now stores the current URL as the Callback URL. After a successful login, users are redirected back to the correct previous page, and the Callback Cookie is cleared after use. The Callback Cookie is created only when the URL is valid, providing a more accurate and secure redirect flow.

ezyweb.redirectToLogin() now stores the current path and query parameters in sessionStorage.loginCallbackUrl before redirecting users to the login page. An existing callback is not overwritten when the user is on /login or /register, ensuring that users return to the correct original page after completing the login process.

WebAuthenticationInterceptor has been extended so subclasses can customize getAccessToken(), needToCheckPermission(...), and checkPermission(...). This gives applications greater flexibility when implementing custom Access Token retrieval, deciding when permission checks are required, or providing their own Permission logic.