MLE-31877 revert xdmp-login changes

[jonmille]

Reverting the xdmp-login changes introduced as part of: #1935

The unprotected-uri and unprotected-collections privileges are still needed so they have been added to the java-test-delete-graph and java-test-evaluator roles

The xdmp:xslt-invoke, xdmp:xslt-eval, and xdmp:value privileges are still needed so they have been added to the test-test-writer role

Jira Ticket: https://progresssoftware.atlassian.net/browse/MLE-31877
Related issue why xdmp-login is being removed: https://progresssoftware.atlassian.net/browse/MLE-30664

[Copilot]

Pull request overview

Reverts the prior introduction of the xdmp-login privilege/role in the test-app security configuration (from PR #1935), while keeping required unprotected-uri / unprotected-collections privileges by moving them onto the roles actually used by affected test users.

Changes:

• Removes the java-test-xdmp-login role and strips xdmp-login from test-rest-writer and test user role assignments.
• Adds unprotected-uri and unprotected-collections privileges to java-test-delete-graph and java-test-evaluator.
• Updates several functional tests to stop granting xdmp-login when creating the test-eval role.

Reviewed changes

Copilot reviewed 13 out of 13 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
test-app/src/main/ml-config/security/users/writer-no-default-permissions.json	Removes java-test-xdmp-login from the user’s role list.
test-app/src/main/ml-config/security/users/rest-writer.json	Removes java-test-xdmp-login from the user’s role list.
test-app/src/main/ml-config/security/users/rest-transform-user.json	Deletes user that previously depended on java-test-xdmp-login.
test-app/src/main/ml-config/security/users/rest-evaluator.json	Removes java-test-xdmp-login from the user’s role list.
test-app/src/main/ml-config/security/users/rest-admin.json	Removes java-test-xdmp-login from the user’s role list.
test-app/src/main/ml-config/security/roles/test-rest-writer.json	Removes the xdmp-login execute privilege from the role.
test-app/src/main/ml-config/security/roles/java-test-xdmp-login.json	Deletes the role that bundled xdmp-login and related execute privileges.
test-app/src/main/ml-config/security/roles/java-test-evaluator.json	Adds unprotected-uri / unprotected-collections execute privileges.
test-app/src/main/ml-config/security/roles/java-test-delete-graph.json	Adds unprotected-uri / unprotected-collections execute privileges.
marklogic-client-api-functionaltests/src/test/java/com/marklogic/client/functionaltest/TestBiTemporal.java	Stops granting xdmp-login when creating the test-eval role.
marklogic-client-api-functionaltests/src/test/java/com/marklogic/client/fastfunctest/TestJSResourceExtensions.java	Stops granting xdmp-login when creating the test-eval role.
marklogic-client-api-functionaltests/src/test/java/com/marklogic/client/fastfunctest/TestBulkWriteWithTransformations.java	Stops granting xdmp-login when creating the test-eval role.
marklogic-client-api-functionaltests/src/test/java/com/marklogic/client/datamovement/functionaltests/StringQueryHostBatcherTest.java	Stops granting xdmp-login when creating the test-eval role.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[rjrudin]

This is fine for this PR, but I think it'd be good to next try a PR where this is removed from this role and see what fails. And then create an additional role - e.g. "test-invoke" - that only grants this privilege and give it a user that is only used for tests where we know this privilege is required. It should be granted for a "rest writer" who typically does not need invoke (or eval) privileges.

[rjrudin]

Same for these privileges - I would do a follow up PR where I remove these and see what breaks.

[jonmille]

With the removal of xdmp:xslt-invoke, xdmp:xslt-eval, and xdmp:value the 3 test failures from the first Jenkins run are shown: https://ml-clt-jenkins.progress.com/blue/organizations/jenkins/devexp%2FJava-Client%2Fjava-client-api/detail/PR-1966/1/tests

xsltTransformWithoutParam() – com.marklogic.client.test.rows.TransformDocTest

• com.marklogic.client.ForbiddenUserException: Local message: User is not allowed to apply resource at rows/update. Server Message: You do not have permission to this method and URL.

xsltTransformWithParam() – com.marklogic.client.test.rows.TransformDocTest

• com.marklogic.client.ForbiddenUserException: Local message: User is not allowed to apply resource at rows/update. Server Message: You do not have permission to this method and URL.

testUsingFromParamAndSchematron() – com.marklogic.client.test.rows.ValidateDocTest

• com.marklogic.client.ForbiddenUserException: Local message: User is not allowed to apply resource at rows/update. Server Message: You do not have permission to this method and URL.

[jonmille]

• TransformDocTest#xsltTransformWithoutParam — XSLT stylesheet invoked by URI; needs xdmp:xslt-invoke
• TransformDocTest#xsltTransformWithParam — XSLT stylesheet invoked by URI; needs xdmp:xslt-invoke
• ValidateDocTest#testUsingFromParamAndSchematron — schematron compiled to XSLT (xdmp:xslt-invoke + xdmp:xslt-eval) then written via fromParam (xdmp:value)