wip: replaceWithRootGroupId

Author: adwk67

nifi/stackable/patches/2.4.0/0005-replace-process-groups-root-with-root-ID.patch

@@ -1,65 +1,61 @@
-From 7bae76c6e7361356fdab4886bf078b0c4fbbce51 Mon Sep 17 00:00:00 2001
+From 7d3774380339871ab4890b898eb35e4a8d4fc995 Mon Sep 17 00:00:00 2001
 From: Andrew Kenworthy <andrew.kenworthy@stackable.tech>
 Date: Fri, 10 Oct 2025 15:28:56 +0200
 Subject: replace process groups root with root ID
 
 ---
- .../FileAccessPolicyProvider.java             | 30 +++++++++++++++++--
- 1 file changed, 28 insertions(+), 2 deletions(-)
+ .../FileAccessPolicyProvider.java             | 24 +++++++++++++++++++
+ .../nifi/controller/StandardFlowService.java  |  5 ++++
+ 2 files changed, 29 insertions(+)
 
 diff --git a/nifi-framework-bundle/nifi-framework/nifi-file-authorizer/src/main/java/org/apache/nifi/authorization/FileAccessPolicyProvider.java b/nifi-framework-bundle/nifi-framework/nifi-file-authorizer/src/main/java/org/apache/nifi/authorization/FileAccessPolicyProvider.java
-index 5363bb5619..2951e6899a 100644
+index 5363bb5619..ca9758f32c 100644
 --- a/nifi-framework-bundle/nifi-framework/nifi-file-authorizer/src/main/java/org/apache/nifi/authorization/FileAccessPolicyProvider.java
 +++ b/nifi-framework-bundle/nifi-framework/nifi-file-authorizer/src/main/java/org/apache/nifi/authorization/FileAccessPolicyProvider.java
-@@ -568,8 +568,8 @@ public class FileAccessPolicyProvider implements ConfigurableAccessPolicyProvide
-         final boolean hasInitialAdminIdentity = (initialAdminIdentity != null && !StringUtils.isBlank(initialAdminIdentity));
- 
-         // if we are starting fresh then we might need to populate an initial admin or convert legacy users
-+        parseFlow();
-         if (emptyAuthorizations) {
--            parseFlow();
- 
-             if (hasInitialAdminIdentity) {
-                 logger.info("Populating authorizations for Initial Admin: {}", initialAdminIdentity);
-@@ -581,7 +581,12 @@ public class FileAccessPolicyProvider implements ConfigurableAccessPolicyProvide
-             // save any changes that were made and repopulate the holder
-             saveAndRefreshHolder(authorizations);
-         } else {
--            this.authorizationsHolder.set(authorizationsHolder);
-+            if (isUpdatedRootInAccessPolicy(authorizations)) {
-+                // only do this if we have actually changed something
-+                saveAndRefreshHolder(authorizations);
-+            } else {
-+                this.authorizationsHolder.set(authorizationsHolder);
-+            }
-         }
-     }
- 
-@@ -744,6 +749,27 @@ public class FileAccessPolicyProvider implements ConfigurableAccessPolicyProvide
+@@ -744,6 +744,30 @@ public class FileAccessPolicyProvider implements ConfigurableAccessPolicyProvide
          }
      }
 
 +    /**
 +     * Replaces process group root references with the process group ID.
 +     * Relevant when a static authorizations file is provided, which can
 +     * then use "root" as a placeholder.
-+     *
-+     * @param authorizations the Authorizations instance to edit the policies in
 +     */
-+    private boolean isUpdatedRootInAccessPolicy(final Authorizations authorizations) {
-+        boolean authorizationsChanged = false;
-+        for (Policy policy: authorizations.getPolicies().getPolicy()) {
-+            String resource = policy.getResource();
-+            String processGroupRoot = ResourceType.ProcessGroup.getValue() + "/root";
-+            if (resource.endsWith(processGroupRoot)) {
-+                int pos = resource.indexOf(processGroupRoot);
-+                policy.setResource(resource.substring(0, pos) + ResourceType.ProcessGroup.getValue() + "/" + rootGroupId);
-+                authorizationsChanged = true;
++    public void replaceWithRootGroupId() throws JAXBException {
++        if (rootGroupId != null) {
++            Authorizations authorizations = this.authorizationsHolder.get().getAuthorizations();
++            boolean authorizationsChanged = false;
++            for (Policy policy: authorizations.getPolicies().getPolicy()) {
++                String resource = policy.getResource();
++                String processGroupRoot = ResourceType.ProcessGroup.getValue() + "/root";
++                if (resource.endsWith(processGroupRoot)) {
++                    int pos = resource.indexOf(processGroupRoot);
++                    policy.setResource(resource.substring(0, pos) + ResourceType.ProcessGroup.getValue() + "/" + rootGroupId);
++                    authorizationsChanged = true;
++                }
++            }
++            if (authorizationsChanged) {
++                saveAuthorizations(authorizations);
 +            }
 +        }
-+        return authorizationsChanged;
 +    }
 +
      /**
       * Creates and adds an access policy for the given resource, group identity, and actions to the specified authorizations.
       *
+diff --git a/nifi-framework-bundle/nifi-framework/nifi-framework-core/src/main/java/org/apache/nifi/controller/StandardFlowService.java b/nifi-framework-bundle/nifi-framework/nifi-framework-core/src/main/java/org/apache/nifi/controller/StandardFlowService.java
+index 09f4d38f77..dad44540de 100644
+--- a/nifi-framework-bundle/nifi-framework/nifi-framework-core/src/main/java/org/apache/nifi/controller/StandardFlowService.java
++++ b/nifi-framework-bundle/nifi-framework/nifi-framework-core/src/main/java/org/apache/nifi/controller/StandardFlowService.java
+@@ -933,6 +933,11 @@ public class StandardFlowService implements FlowService, ProtocolHandler {
+             // start the processors as indicated by the dataflow
+             controller.onFlowInitialized(autoResumeState);
+ 
++            // this should be done once the flow has been initialized
++            if (this.authorizer instanceof org.apache.nifi.authorization.FileAccessPolicyProvider) {
++                ((org.apache.nifi.authorization.FileAccessPolicyProvider) this.authorizer).replaceWithRootGroupId();
++            }
++
+             loadSnippets(dataFlow.getSnippets());
+ 
+             controller.startHeartbeating();