init patch

Author: adwk67

nifi/stackable/patches/2.4.0/0005-replace-process-groups-root-with-root-ID.patch

@@ -0,0 +1,65 @@
+From 7bae76c6e7361356fdab4886bf078b0c4fbbce51 Mon Sep 17 00:00:00 2001
+From: Andrew Kenworthy <andrew.kenworthy@stackable.tech>
+Date: Fri, 10 Oct 2025 15:28:56 +0200
+Subject: replace process groups root with root ID
+
+---
+ .../FileAccessPolicyProvider.java             | 30 +++++++++++++++++--
+ 1 file changed, 28 insertions(+), 2 deletions(-)
+
+diff --git a/nifi-framework-bundle/nifi-framework/nifi-file-authorizer/src/main/java/org/apache/nifi/authorization/FileAccessPolicyProvider.java b/nifi-framework-bundle/nifi-framework/nifi-file-authorizer/src/main/java/org/apache/nifi/authorization/FileAccessPolicyProvider.java
+index 5363bb5619..2951e6899a 100644
+--- a/nifi-framework-bundle/nifi-framework/nifi-file-authorizer/src/main/java/org/apache/nifi/authorization/FileAccessPolicyProvider.java
++++ b/nifi-framework-bundle/nifi-framework/nifi-file-authorizer/src/main/java/org/apache/nifi/authorization/FileAccessPolicyProvider.java
+@@ -568,8 +568,8 @@ public class FileAccessPolicyProvider implements ConfigurableAccessPolicyProvide
+         final boolean hasInitialAdminIdentity = (initialAdminIdentity != null && !StringUtils.isBlank(initialAdminIdentity));
+ 
+         // if we are starting fresh then we might need to populate an initial admin or convert legacy users
++        parseFlow();
+         if (emptyAuthorizations) {
+-            parseFlow();
+ 
+             if (hasInitialAdminIdentity) {
+                 logger.info("Populating authorizations for Initial Admin: {}", initialAdminIdentity);
+@@ -581,7 +581,12 @@ public class FileAccessPolicyProvider implements ConfigurableAccessPolicyProvide
+             // save any changes that were made and repopulate the holder
+             saveAndRefreshHolder(authorizations);
+         } else {
+-            this.authorizationsHolder.set(authorizationsHolder);
++            if (isUpdatedRootInAccessPolicy(authorizations)) {
++                // only do this if we have actually changed something
++                saveAndRefreshHolder(authorizations);
++            } else {
++                this.authorizationsHolder.set(authorizationsHolder);
++            }
+         }
+     }
+ 
+@@ -744,6 +749,27 @@ public class FileAccessPolicyProvider implements ConfigurableAccessPolicyProvide
+         }
+     }
+ 
++    /**
++     * Replaces process group root references with the process group ID.
++     * Relevant when a static authorizations file is provided, which can
++     * then use "root" as a placeholder.
++     *
++     * @param authorizations the Authorizations instance to edit the policies in
++     */
++    private boolean isUpdatedRootInAccessPolicy(final Authorizations authorizations) {
++        boolean authorizationsChanged = false;
++        for (Policy policy: authorizations.getPolicies().getPolicy()) {
++            String resource = policy.getResource();
++            String processGroupRoot = ResourceType.ProcessGroup.getValue() + "/root";
++            if (resource.endsWith(processGroupRoot)) {
++                int pos = resource.indexOf(processGroupRoot);
++                policy.setResource(resource.substring(0, pos) + ResourceType.ProcessGroup.getValue() + "/" + rootGroupId);
++                authorizationsChanged = true;
++            }
++        }
++        return authorizationsChanged;
++    }
++
+     /**
+      * Creates and adds an access policy for the given resource, group identity, and actions to the specified authorizations.
+      *