XWIKI-23915: Introduce a rest endpoint for user information by pjeanjean · Pull Request #5199 · xwiki/xwiki-platform

pjeanjean · 2026-02-17T16:24:07Z

Jira URL

https://jira.xwiki.org/browse/XWIKI-23915

Changes

Description

This PR adds 3 new REST endpoints:

/user
/users
/users/{userId}

Considering that user references are generic, but the necessary data can only be fetched from the actual storage, this PR also relies on a new component: UserReferenceModelSerializer.
An implementation for the document user store was included, as well as a provider.

Clarifications

Proposal: https://forum.xwiki.org/t/add-a-users-rest-api-endpoint/17982
Design page: https://design.xwiki.org/xwiki/bin/view/Proposal/RESTAPIendpointsforusers

With this PR, only the document user store is supported. If an instance uses a different user store, the API endpoints will return a 501 Not Implemented HTTP error with an appropriate error message.

The current implemention of the /user endpoint is not ideal, however, because it relies on the getUserReference() of the context that returns a DocumentReference directly and not a UserReference. As such, I currently don't know how to make it fully generic.

Screenshots & Video

N/A

Executed Tests

The PR has been built and tested locally.

Expected merging strategy

Prefers squash: Yes
Backport on branches: N/A

* Introduce /user, /users and /users/id REST endpoints * Introduce a UserReferenceModelSerializer component * Implement UserReferenceModelSerializer for the document user store

surli · 2026-02-17T16:35:19Z

...-platform-user-rest-api/src/main/java/org/xwiki/user/rest/resources/CurrentUserResource.java

+ * @version $Id$
+ */
+@Path("/wikis/{wikiName}/user")
+public interface CurrentUserResource


I guess it should be unstable and some javadoc would be nice, I'm surprised by the way that checkstyle is not complaining about missing javadoc on the method?

Checkstyle rules seem to be different in xwiki-platform-rest.
It definitely complained once I moved everything, now there is some Javadoc.

surli · 2026-02-17T16:39:03Z

...st-default/src/main/java/org/xwiki/user/rest/internal/resources/CurrentUserResourceImpl.java

+
+        DocumentReference userDocumentReference = this.xcontextProvider.get().getUserReference();
+        if (userDocumentReference == null) {
+            throw new WebApplicationException(Response.Status.UNAUTHORIZED);


Hmmm if guest is trying to access that endpoint and is authorized to access the wiki, we could still display info saying it's guest, no?

Knowing also that we have a GuestUserReference for it

Yes, there is no reason forbid guest to access this resource.

surli

I'm surprised this API doesn't go to a new module xwiki-platform-user-rest, it's needed because we absolutely want to reuse this in xwiki-platform-rest-model, couldn't we have had a dependency to it?

surli · 2026-02-17T16:39:28Z

...st-default/src/main/java/org/xwiki/user/rest/internal/resources/CurrentUserResourceImpl.java

+
+        DocumentReference userDocumentReference = this.xcontextProvider.get().getUserReference();
+        if (userDocumentReference == null) {
+            throw new WebApplicationException(Response.Status.UNAUTHORIZED);


Knowing also that we have a GuestUserReference for it

surli · 2026-02-17T16:40:10Z

...user-rest-default/src/main/java/org/xwiki/user/rest/internal/resources/UserResourceImpl.java

+        }
+
+        try {
+            UserReference userReference = this.userReferenceResolver.resolve(userId,


On the other hand here you'd need to check that the user has proper credentials no?

This check is actually done in the DocumentUserReferenceModelSerializer, because I assume that it would not be implemented in the same way for other user stores. But this should probably be documented explicitly in the Javadoc for UserReferenceModelSerializer.

...Or it could also be done through a hasAccess() method in UserReferenceModelSerializer, probably cleaner this way.

surli · 2026-02-17T16:41:18Z

xwiki-platform-core/pom.xml

+              <justification>
+                Change in generated class of the REST model to add models for user endpoints.
+              </justification>
+              <criticality>allowed</criticality>


Is it allowed?

I assume it was, it only changed a "@Seealso" in the generated Javadoc. But it's no longer necessary after the refactoring.

vmassol · 2026-02-17T16:44:24Z

I'm surprised this API doesn't go to a new module xwiki-platform-user-rest, it's needed because we absolutely want to reuse this in xwiki-platform-rest-model, couldn't we have had a dependency to it?

I also agree that we need to have each business domain provide its own REST endpoint.

pjeanjean · 2026-02-17T17:03:05Z

Just to be sure (because I can't see if the comment is on something specific), when you suggest moving the API to xwiki-platform-user-rest, are you talking about the endpoints or only the serializers?

surli · 2026-02-18T08:06:20Z

are you talking about the endpoints

the endpoints and the serializers, the whole REST API for user basically

* Move new components and resources to xwiki-platform-user * Add missing documentation

pjeanjean · 2026-02-19T17:29:46Z

I finished moving the APIs and components to xwiki-platform-user-rest. I'll take care of the other comments in a second step.

tmortagne · 2026-02-19T17:40:09Z

...re/xwiki-platform-rest/xwiki-platform-rest-model/src/main/java/org/xwiki/rest/Relations.java

@@ -177,6 +177,11 @@ public final class Relations
     */
    public static final String CLIENT = "http://www.xwiki.org/rel/client";

+    /**
+     * Relation for links pointing to the user.
+     */


Missing @since (and @Unstable I guess).

tmortagne · 2026-02-19T17:43:07Z

...i-platform-user-rest-api/src/main/java/org/xwiki/user/rest/UserReferenceModelSerializer.java

+ * @version $Id$
+ */
+@Role
+public interface UserReferenceModelSerializer


Missing @Unstable.

tmortagne · 2026-02-19T17:44:51Z

...tform-core/xwiki-platform-user/xwiki-platform-user-rest/xwiki-platform-user-rest-api/pom.xml

+  <parent>
+    <groupId>org.xwiki.platform</groupId>
+    <artifactId>xwiki-platform-user-rest</artifactId>
+    <version>18.1.0-SNAPSHOT</version>


Master moved to 18.2.0-SNAPSHOT.

tmortagne · 2026-02-19T17:47:16Z

...st-default/src/main/java/org/xwiki/user/rest/internal/resources/CurrentUserResourceImpl.java

+    private UserReferenceSerializer<String> stringUserReferenceSerializer;
+
+    @Inject
+    private Provider<UserReferenceModelSerializer> userReferenceModelSerializerProvider;


Why do you need a Provider ?

tmortagne · 2026-02-19T17:51:44Z

...ser-rest-default/src/main/java/org/xwiki/user/rest/internal/resources/UsersResourceImpl.java

+            Collection<String> wikiMembers = this.wikiUserManager.getMembers(wikiName);
+
+            // We use streams to handle pagination.
+            wikiMembers.stream().map(userId -> {


You don't seem to make sure to return only users the current user is allowed to see.

tmortagne · 2026-02-19T17:54:06Z

...default/src/main/java/org/xwiki/user/rest/internal/UserReferenceModelSerializerProvider.java

+ */
+@Component
+@Singleton
+public class UserReferenceModelSerializerProvider implements Provider<UserReferenceModelSerializer>


OK, I understand now why you request a Provider in the resources. The way we handle this use case generally is more by making the default UserReferenceModelSerializer component, redirect each call to the configured one. Makes it a bit easier to use.

tmortagne · 2026-02-19T17:54:53Z

...m-core/xwiki-platform-user/xwiki-platform-user-rest/xwiki-platform-user-rest-default/pom.xml

+  <parent>
+    <groupId>org.xwiki.platform</groupId>
+    <artifactId>xwiki-platform-user-rest</artifactId>
+    <version>18.1.0-SNAPSHOT</version>


Wrong version.

tmortagne · 2026-02-19T17:55:21Z

xwiki-platform-core/xwiki-platform-user/xwiki-platform-user-rest/pom.xml

+  <parent>
+    <groupId>org.xwiki.platform</groupId>
+    <artifactId>xwiki-platform-user</artifactId>
+    <version>18.1.0-SNAPSHOT</version>


Wrong version.

tmortagne · 2026-02-19T17:56:26Z

xwiki-platform-core/xwiki-platform-user/pom.xml

@@ -39,6 +39,9 @@
    <module>xwiki-platform-user-profile</module>
    <module>xwiki-platform-user-script</module>
    <module>xwiki-platform-user-resource</module>
+    <module>xwiki-platform-user-rest</module>
+    <module>xwiki-platform-user-rest/xwiki-platform-user-rest-api</module>


That's not how Maven modules are declared usually. You are supposed to list xwiki-platform-user-rest-api and xwiki-platform-user-rest-default in xwiki-platform-user-rest's pom only. I'm surprised Maven allows this actually.

Ouch, that's some IDE shenanigans I missed while reviewing my commit, sorry about that...

surli · 2026-02-20T08:33:02Z

...-platform-user-rest-api/src/main/java/org/xwiki/user/rest/resources/CurrentUserResource.java

+public interface CurrentUserResource
+{
+    /**
+     * Return all the available information on the user making the request.


I would provide info in the doc about the behaviour when the user is guest.

surli · 2026-02-20T08:33:43Z

...t/xwiki-platform-user-rest-api/src/main/java/org/xwiki/user/rest/resources/UserResource.java

+public interface UserResource
+{
+    /**
+     * Return all the available information on the user {userId}.


I would provide info about the required credentials to access those info.

surli · 2026-02-20T08:34:23Z

...rm-user/xwiki-platform-user-rest/xwiki-platform-user-rest-api/src/main/resources/catalog.cat

@@ -0,0 +1 @@
+PUBLIC "http://www.xwiki.org" "maven:org.xwiki.platform:xwiki-platform-rest-model:jar::!/xwiki.rest.model.xsd"


Wrong jar here it seems?

Hmm, no, it should be the right one. The catalog serves to import LinkCollection from the main REST model.

surli · 2026-02-20T08:36:30Z

...re/xwiki-platform-rest/xwiki-platform-rest-model/src/main/java/org/xwiki/rest/Relations.java

+    /**
+     * Relation for links pointing to the user.
+     */
+    public static final String USER = "http://www.xwiki.org/rel/user";


Do you actually use it? Btw I'm surprised: there should be a dependency to xwiki-platform-user-rest somewhere if you want the model to reuse the UserSummary in some existing REST resources no?

I use it only in the users list endpoint, to point to the full user profile endpoint.
It could also be used in the existing REST endpoints, but that's a larger refactoring that I don't think I would like to include in this PR.

surli · 2026-02-20T08:39:57Z

...rc/main/java/org/xwiki/user/rest/internal/document/DocumentUserReferenceModelSerializer.java

+            xcontext));
+        user.setCompany(Objects.toString(userProperties.getProperty("company"), ""));
+        user.setAbout(Objects.toString(userProperties.getProperty("comment"), ""));
+        user.setEmail(Objects.toString(userProperties.getProperty("email"), ""));


Hmmm the email should probably be obfuscated depending on the admin settings, I don't remember if UserProperties check that I imagine it doesn't but might be wrong here

Ah that's a good point.

surli · 2026-02-20T08:41:15Z

...rc/main/java/org/xwiki/user/rest/internal/document/DocumentUserReferenceModelSerializer.java

+
+            String underlineProperty = "underline";
+            userPreferences.setUnderlineLinks(Objects.toString(userProperties.getProperty(underlineProperty),
+                xcontext.getWiki().getXWikiPreference(underlineProperty, xcontext)));


I have a doubt: here your context wiki might not be the wiki of the user no for the default preference?

XWIKI-23915: Introduce a rest endpoint for user information

961bad8

* Introduce /user, /users and /users/id REST endpoints * Introduce a UserReferenceModelSerializer component * Implement UserReferenceModelSerializer for the document user store

pjeanjean assigned tmortagne Feb 17, 2026

surli reviewed Feb 17, 2026

View reviewed changes

XWIKI-23915: Introduce a rest endpoint for user information

10ce5e5

* Move new components and resources to xwiki-platform-user * Add missing documentation

tmortagne reviewed Feb 19, 2026

View reviewed changes

surli reviewed Feb 20, 2026

View reviewed changes

		@@ -0,0 +1 @@
		PUBLIC "http://www.xwiki.org" "maven:org.xwiki.platform:xwiki-platform-rest-model:jar::!/xwiki.rest.model.xsd"

Uh oh!

Comments

Conversation

pjeanjean commented Feb 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Jira URL

Changes

Description

Clarifications

Screenshots & Video

Executed Tests

Expected merging strategy

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

surli left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

vmassol commented Feb 17, 2026

Uh oh!

pjeanjean commented Feb 17, 2026

Uh oh!

surli commented Feb 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

pjeanjean commented Feb 19, 2026

Uh oh!

tmortagne Feb 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

tmortagne Feb 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

tmortagne Feb 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

pjeanjean commented Feb 17, 2026 •

edited

Loading

surli commented Feb 18, 2026 •

edited

Loading

tmortagne Feb 19, 2026 •

edited

Loading

tmortagne Feb 19, 2026 •

edited

Loading

tmortagne Feb 19, 2026 •

edited

Loading