Jahia GraphQL Extension Provisioning

⚠️ Breaking change — required permission moved

The mutation now gates on provisioningAccess instead of provisioningApi, and the module no longer ships a permissions.xml.

provisioningApi is not this module's permission. Jahia core declares it in WEB-INF/etc/repository/root-permissions.xml as a grouping node, with provisioningAccess beneath it as the actually grantable permission — the same permission that gates core's own Provisioning API, which is exactly the capability this module exposes. Gating on the group had it backwards in both directions: the role Jahia equips for provisioning could not call the mutation (aggregation runs downwards, so a child never satisfies a parent check), while anyone granted the group to use this module also picked up core's provisioning access as a side effect.

What this means for you

• system-administrator now reaches the mutation on a stock install, where before no default role did. It gains no capability it lacked — that role already held provisioningAccess for core's Provisioning API, which reaches the same ProvisioningManager.executeScript sink.
• Existing grants keep working. A role granted provisioningApi still satisfies the leaf through downward aggregation. A backwards-compatibility test asserts this.
• The module's own permissions.xml is removed. It contributed nothing to the gate — privileges register by name into JahiaPrivilegeRegistry, so redeclaring an existing name merely merged an empty child set into the object core had already created. Its one live effect was registering graphql as a new privilege aggregating provisioningApi — an extra grant path to an RCE-equivalent capability that nobody designed.

Also in this release

• Namespace container — executeScript is nested under an admin.jahia.provisioning hierarchy instead of sitting as a flat field on the root Mutation. Flat root fields collide across modules and obscure ownership.
• Hardening — the script argument is validated at the trust boundary; a null/unavailable ProvisioningManager is guarded and surfaces a distinct error instead of an NPE; YAML parse/validation failures are separated from runtime execution failures in both the response and the audit log.
• Tests — 17 JUnit tests covering the permission gate, audit logging, error paths and schema shape, plus 16 Cypress specs running against a dockerized Jahia.
• Dependencies — vulnerable transitive test dependencies pinned (tmp, qs, uuid, systeminformation, @babel/plugin-transform-modules-systemjs).
• Docs — README documents the required permission, the RCE-equivalent risk of granting it, and a mutation example.

Security note. This mutation executes arbitrary provisioning scripts and is effectively equivalent to remote code execution on the Jahia server. Grant provisioningAccess only to roles you would trust with server-level access.