| Three gates decide whether a configuration object is applied by checking admin right on the page author: GPTAPIServerWikiObjectComponentBuilder (about line 113), ModelWikiObjectComponentBuilder (about line 178) and AuthorizedApplicationManager (about line 124, the JWT authorized-applications store). All three read XWikiDocument.getAuthorReference(), deprecated since platform 14.0RC1, while the same model builder reads getAuthors().getEffectiveMetadataAuthor() elsewhere. Today both accessors resolve to the same user, so there is no bypass; under the authors model the effective metadata author is the identity the platform's own trust checks use (UI extensions, wiki components, the Administration app), and the two can diverge once the platform stops mirroring one into the other. LLMAI-199 introduced MCPConfigPageAuthorship.authorOf for exactly this question on the MCP side. Expected / proposal: Read the effective metadata author through DocumentAuthors and convert it with the UserReference to DocumentReference serializer, as MCPConfigPageAuthorship does; one small shared helper or three local changes. |
