Jahia GraphQL Core Provider

New Features

• Mutations that operate on many nodes at once are now bounded by a dedicated configuration property, graphql.mutation.batch.limit (default 5000, 0 disables), read only from the default configuration file so a non-default configuration cannot loosen it.

  Are you affected? Only if a single request asks to operate on more than 5000 nodes. Such a request now fails rather than being applied to a subset, and nothing is persisted. Work through a larger result set in pages instead. A limit no wider than the bound selects a page of mutateNodesByQuery. It is applied as asked when the rest of the request leaves room for it. You can also raise the property in org.jahia.modules.graphql.provider-default.cfg.

• The number of nodes a single GraphQL request may read is now bounded by a new configuration property, graphql.fields.node.requestLimit (default 20000, 0 disables).

• Deprecation: the time-zone-less date surface of JCR properties is deprecated. On JCRProperty, notZonedDateValue and notZonedDateValues are marked @deprecated; on the property mutations (setValue, addValue, etc.), the NOT_ZONED_DATE value of the option argument is deprecated. All of them keep working exactly as before; nothing is removed.

  Prefer the zoned variants: read a date with value / values, which return the JCR ISO-8601 form carrying the time zone offset, and write one by passing type: DATE with an offset-bearing ISO-8601 value and no option.

  The deprecated surface formats and parses in the server's default time zone and drops the offset, so the same string denotes a different instant depending on where it is read or written. This ambiguity is the reason for deprecation.

• Behaviour change — the createVersion field on JCR node mutations is deprecated and no longer creates a version: it is now an inert no-op that always returns false. Files remain versionable and are still versioned when published; what no longer happens is the extra version created at upload time (the one labelled uploaded_at_<timestamp>). In practice, uploading a file and then replacing it without publishing in between no longer leaves a JCR snapshot of the first revision. The field is kept in the schema so existing callers keep working unchanged

Bug Fixes

• Tag Manager mutations now only write the nodes the caller has rights on, and refuse a replacement tag name that would be stored as an empty tag or as no tag at all. Note one consequence of the per-node scoping: a site-wide rename or delete no longer touches a node that exists only in the live workspace — published, then removed from the edit workspace — so tags left on such nodes are no longer swept by these mutations
• SDL finder arguments are now consistently treated as literal values when they are placed into the generated JCR-SQL2 query, across the String, weak-reference and date finders. A value containing an apostrophe is matched as exactly the text it contains, an empty value is accepted where it previously failed, and an argument passed explicitly as null is treated as absent rather than as a value to match on.

Breaking Change

GraphQL schema introspection now requires the developerToolsAccess permission (override introspectionCheckEnabled=false to restore the previous behaviour).

New Features

• Enable the GraphQL introspection permission check by default.
• Added query-cost limits to the GraphQL endpoint to protect against expensive or abusive queries. Queries exceeding the configured complexity or depth are now rejected before execution. The limits are enabled by default (graphql.query.maxComplexity = 2000, graphql.query.maxDepth = 30) and can be tuned, or disabled by setting either property to 0, in the GraphQL provider configuration. These limits, like the existing node limit, are only accepted from the default configuration file so a non-default configuration cannot loosen them; a configuration that tries is now logged instead of being silently ignored. Removing a limit property (or deleting the configuration) reverts it to its default rather than keeping the last configured value.
• Added a Tag Manager GraphQL API to list, rename, and delete tags across a site or on individual nodes.
  • Available under admin.jahia.tagManager(siteKey) with queries tags and taggedContent, and mutations renameTag, deleteTag, renameTagOnNode, and deleteTagOnNode.
  • All mutations propagate changes to both the edit and live workspaces automatically.
  • Requires the tagManager permission on the target site.

Bug Fixes

• Propagate the authorization scopes resolved at connection time to the GraphQL WebSocket subscription execution thread, matching how the HTTP query/mutation executor already propagates them. Previously subscription data fetchers ran without the connection's scopes initialized, so field-level permission checks were not applied consistently on the WebSocket transport; they are now enforced the same way as on HTTP requests.

New Features

• Remove dev-only SDL source-watcher coupling to external-provider-modules
• Bump bn.js from 4.12.0 to 4.12.3
• Bump markdown-it from 14.1.0 to 14.1.1
• Filter out jmix:hiddenNode types when getting children/descendants
• renderedContent now falls back to the default view (instead of cm) when rendering in page context with no view specified
• Secured the qs library by enforcing version 6.15.2 or higher to address known vulnerabilities

Bug Fixes

• Undeprecated User.name to address a GraphQL specification violation
• Revert role permission checks and logging added to grantRole/revertRole mutation APIs as checks are now done at the JCR level
• Clean up cached permissions before rebuilding the schema on graphql provider registration

Breaking Changes

• Added permission check for grant, revoke role APIs

New Features and Improvements

• Improved incode documentation about rendering
• Added sample permission restriction methods
• Added logging for role mutation endpoints

Bug Fixes

• Updated XML import content type check in GqlJcrMutationSupport
• Fixed rendering for multiple nodes in a row

New features and improvements

• Added the ability to control the access to GraphQL introspection via authorization
  • Authorization for GraphQL introspection can be activated with introspectionCheckEnabled in the configuration, but note that once enabled, jContent will need to be upgraded to 3.5.0+ 
• Introduced the ability to retrieve mixing properties declared as extends
• Added a custom HTTP header X-Jahia-Live-Operation to the GraphQL HTTP response when JCR operations (queries/mutations) are performed on the live workspace. 
• Improved logging on PublicationJobEventListener with info level on activate/deactivate and additional debug logs on listener operations

Bug Fixes

• Update jcrNode when node is moved
• Fixed modifying translation nodes directly
• Use fallback MIME type when unzipping files
• Fixed querying usages on mountpoints

Misc

• Allow the use of Apache Tika 3x
• Updated transitive dependencies pbkdf2 to 3.1.5 and sha.jsto 2.4.12

Improvements

• Added more details to the errors raised when querying

Improvements

• Improved the logging for SDL Definition checks

Improvements

• Added a method to perform batch delete of a specified property
• Added a method to get active jobs with pagination (getPaginatedJobs) and deprecated getJobs
• Introduced a maxDepth attribute in the descendants node
• Improved the error handling when getting group memberships of a principal
• Improved the error handling when deleting localized properties
• Improve the query to get the home page with restricted access

Improvements

• Added a new entry point to get the render url
• Improved the API for the rendering management to allow the usage of an empty view property
• Improved the API to allow a site admin to unlock any content
• Improved the thumbnail retrieval by giving the possibility to check for its existence
• Improved the logging when registering a schema from an extension

Bug fixes

• Fixed an issue with non-translated nodes not listed in the usages tab

Improvements

• Added an option to rename a node being moved if there is a conflict
• Added an option to skip nodes by nodetypes when copying
• Added a new entry point for publication job subscription
• Added a new entry point for usages
• Added an entry point for usages
• Added the 'updateOnly' parameter for configuration edition
• Added a field sorter on node references
• Improved subscription for publication job by adding filter by user key and job states
• Moved journal GraphQL API logic to a Jahia core service
• Removed old and unused javascript libraries
• Added a renderedValue field for string properties
• Added fields for file and thumbnail urls
• Added an isExternal field to know if a node is external (Searchable Implementation rolled back)
• Added a configuration to limit the number of nodes per page (graphql.fields.node.limit with default value set to 5000)
• Migrated from GraphQL Playground to GraphiQL in the tools
• Improved the save action by only validating a session content before saving

Bug fixes

• Fixed SDL wiring issue by providing a default data fetcher factory for SDL types
• Fixed an issue with the user tasks count when starting a publication workflow

Breaking Changes

Added permission check for grant, revoke role APIs

Bug Fixes

Allow modification of translation nodes directly using full path

Improvements

• Added a method to perform batch delete of a specified property

Improvements

• Disabled introspection queries and GraphQL playground in production mode (more details here)
• Added a new configuration entry graphql.introspection.enabled to enable and disable introspection for both development and production modes

Bug fixes

• Fixed an issue with non-translated nodes not listed in the usages tab

Improvements

• Added a configuration for the node limit per page (graphql.fields.node.limit with default value set to 5000)
• Removed old and unused javascript libraries
• Upgraded browserify-sign from 4.2.1 to 4.2.2
• Moved from GraphQL Playground to GraphiQL in the tools
• Improved subscription for publication job by adding filter by user key and job states
• Added a field to know if a node is external
• Added a field sorter on node references
• Added fields for file and thumbnail urls
• Added an entry point for usages
• Added an option to rename a node being moved if there is a conflict
• Added an option to skip nodes by nodetypes when copying
• Added zip validation in importContent graphql mutation API

Bug fixes

• Fixed issue allowing the creation of a node with missing mandatory properties

Improvements

• Added a new entry point to get url of external provider nodes

Improvements

• Introduced a new GraphQL node to fetch journal revisions and cluster in sync status

Bug fixes

• A version is now created when uploading a file to replace an existing one
• Fixed issue with a translated property being duplicated after internationalization of the related content

Bug fixes

• Fixed error when editing a content which has a broken reference

Improvements

• Added new endpoint to provide details about the platform used by Jahia
• Added new endpoints to get and update Roles and ACL

Bug fixes

• Fixed loading error when content usages cannot be retrieved
• Fixed issue with mime type not correctly resolved for unzipped files

Bug fixes

• Fixed issue when editing a content with broken references
• Fixed inconsistencies in GraphQL schema when redeploying a module or deleting/restarting a container
• Added debug logs to trace addition and removal of extensions

Improvements

• Improved zip management to prevent partial path traversal and better handle fabricated zip files
• Added new endpoint to access background jobs
• Added new entrypoint to get available translations for a node

Bug fixes

• Fixed issue with query not using fallback language
• Fixed issue when unzipping in jContent on a Windows server
• Fixed issue when unzipping folder with sub folders in jContent
• Fixed issue with javascript not loaded while rendering in preview

Bug fixes

• Added missing description to GraphQL admin permissions

Improvements

• Created permissions dedicated to the GraphQL admin node. This allows for additional fine-tuning of the access for mutations and queries using this node.
• Improved error handling when using the vanityUrl mutation.
• Introduced two new fields “choicelistValue” and “choicelistValues” under JCRProperty.

Improvements

• Added safeguards in the module to prevent issue in another module’s schema to break graphql-dxm-provider.
• Introduced support for GraphQL subscriptions for the workflow service

Bug fixes

• Fixed wiring issue in graphql-dxm-provider caused by cyclic dependencies

• Added a max size limit to 100MB and a max entries limit to 1024 for zip files to prevent zip bombs

Improvements

• Introduced a new “validInLanguage” parameter to only return nodes available in the specified language. This parameter is available for the following GraphQL nodes: nodeById; nodeByPath, nodesById, nodesByPath 

Bug fixes

• Fixed an issue preventing unzipping files created from Microsoft OneDrive
   

• Added new parameters to the GraphQL renderedContent field: "isEditMode" and "mainResourcePath"
• Added homePage field on site query to get the home page node
• Added the ability to publish all nodes down the tree via a GraphQL mutation
• Added possibility to specify a behaviour at API level when a content already exists during an import
• Improved error logging to display more information
• Fixed issue related to the unit tests (upgraded PowerMock to 2.0.9) when building GraphQL module with jdk 11
• Restored error handling behaviour in nodesById and nodesByPath

• Fixed a wiring issue in graphql-dxm-provider

• Added a query field to get the homepage for a site
• Enabled the usage of the upload feature

• Added the ability to return the property of a JCR node as boolean
• Added GraphQL API generic asynchronous support
• Improved graphql subscription through one websocket connection (new endpoint /graphqlws to ease proxy configurations)
• Upgraded graphql-java from 11 to 13
• Upgraded graphql-java-annotations from 6.1 to 7.2.1
• Upgraded graphql-java-servlet from 4.7.0 to 9.1.0
• Upgraded jackson from 2.9.10 to 2.10.5
• Upgraded guava from 15.0 to 30.1.1-jre
• Fixed missing inline error message when input is invalid
• Fixed the Copy CURL action in GraphQL playground
• Fixed issue when filtering a multi-valued property
• Updated vulnerable dependencies

New admin.jahia

Introduced a jahia node (query & mutation) under “admin” to support administrative operations on the Jahia server being queried. This node is meant to be extended by other services.

Access to this node is restricted to the server administrator role.

This new node currently provides the following:

• a version node, providing details about the Jahia version currently running (build hash, build date, release version, snapshot flag)
• a configuration node providing read (query) and update (mutation) access to the configuration (files located in the karaf/etc folder). 

New admin.userAdmin

Jahia is introducing user and group management to its GraphQL api. The userAdmin node provides a preview of upcoming features.

IMPORTANT: This node will be renamed to admin.userGroup in a future release.

As always, please refer to the schema (accessible via GraphQL Playground) for the API documentation.

• Fixed issue with broken dashboard when upgrading the module

• Added the possibility to have custom instrumentations

• Added a developer tools entry to the left navigation bar

The following minor changes were introduced:

• Implemented API sorting for enums
• Adding missing descriptions in the API schema
• Added property to return the binary size of a node

The following issues were fixed:

• Incorrect path when using ZipUtils

• Introduced a data fetcher capable of injecting OSGI services in GQL endpoints objects
• Fixed return for node queries resulting in apollo issues in jContent
• Minor structural change for the admin query introduced in 2.2.0

• Added an "admin" node to be used by other module willing to register admin interfaces for querying and mutations
• Migrating from GraphiQL to GraphQL Playground in Jahia tools

• Added a GraphQL endpoint to create JCR node without saving them
• Fixed issue with deletion of a non published folder that had published content

• New release compatible with Jahia 8

• Added the ability to publish all nodes down the tree via a GraphQL mutation

• Fixed issue when filtering a multi-valued property

New admin.jahia

Introduced a jahia node (query & mutation) under “admin” to support administrative operations on the Jahia server being queried. This node is meant to be extended by other services.

Access to this node is restricted to the server administrator role.

This new node currently provides the following:

• a version node, providing details about the Jahia version currently running (build hash, build date, release version, snapshot flag)

As always, please refer to the schema (accessible via GraphQL Playground) for the API documentation.

Note: A bug was found in "query.admin.jahia.version" node with release 1.9.0 of graphql-dxm-provider, thus the release of graphql-dxm-provider version 1.9.1, please also note that "query.admin.jahia.version.buildDate" is not compatible with older than Jahia 7.3.6.0

• Added property to return the binary size of a node
• Fixed an issue with the GraphiQL client
• Fixed an issue with preserving folder hierarchies in zipped files

• Minor structural change for the admin query introduced in 1.7.0

Created admin query and mutation shell

• Fixed unit tests

• Improved the way GraphQL get the referenced node

• Fixed error when unzipping in Content and Media Manager

• The GraphQL API now supports zip and unzip operations
• Extend API to support the in context preview for displayable notes (used in content-editor)

• Added GraphQL fields: formattedDateValue and formattedDateValues
• Fixed sources mapping with SDL module

• Ensured full read-only mode is applied to GraphQL and REST API

• Added support into GraphQL API to retrieve constraints for property definition
• Better feedback when exceeding size-limit during file upload

• Added support into GraphQL API to retrieve constraints for property definition

• Checks added to prevent copying/moving a node to itself or its descendants
• Add grouping to children, makes fields inputs mandatory

• Add 'move' and 'copy node' operations
• New endpoint to poll the number of workflow tasks
• Support 'contains' and 'like' operations
• Add sorting by fields
• Add new parameters in GraphQL query API

See https://github.com/Jahia/graphql-core/blob/master/graphql-dxm-provider/README.md