2_1_0

JCR Stats 2.1.0

Release date: 2026-06-23

JCR Stats turns a raw JCR subtree into something you can actually read: an
interactive flamegraph, a sortable tree-table, and a top-largest list — weighted
by storage size or by number of nodes. This release adds a full GraphQL API, an
asynchronous computation model for very large trees, and a redesigned admin UI.

Highlights

• 📊 Interactive admin UI — flamegraph, tree-table, top-largest, and snapshot
  comparison views, available under Administration → System Health → JCR Statistics.
• ⚡ Asynchronous computation — large subtrees are traversed in the background
  with live progress, so requests no longer time out.
• 🔌 GraphQL API — script and automate the same analysis the UI uses.
• 🔐 Dedicated permission & role — access is gated by a new jcrStatsAdmin
  permission.

New features

GraphQL API

A new jcrStats namespace on the root Query and Mutation:

• Queries: size(path), nodeCount(path), tree(path, maxDepth),
  status(), result(maxDepth), reports()
• Mutations:
  • compute(path) — fire-and-forget asynchronous start
  • computeSize(path, deleteTemporaryFile) — synchronous full flamegraph
• The node tree is returned recursively with depth limiting to keep payloads small.
• Every operation requires the jcrStatsAdmin permission.

Asynchronous computation

A single server-wide background job model for large subtree traversal:

• compute(path) starts one job (no-op if one is already running).
• status() reports live progress: running flag, elapsed time (ms), visited-node
  count, path, and error state.
• result(maxDepth) returns the cached tree once computation finishes.
• The admin UI polls status every 2s and shows an elapsed timer + live node counter.
• Resume-on-remount: leaving the page and coming back re-attaches to a job
  still in progress.

Admin UI

An interactive space-analysis interface at /jahia/administration/jcrStats:

• Flamegraph view — click-to-zoom visualization of space usage.
• Tree-table view — hierarchical breakdown with size, % of total, % of parent,
  and node count; fully keyboard accessible.
• Largest-items view — sorted top-N space consumers.
• Comparison view — diff two snapshots to see what changed over time.
• Snapshot save/load — download the current tree as JSON and reload baselines.
• jContent deep links — jump straight from a result into the jContent editor
  for the selected node.

Metrics

Weight any analysis by size (bytes) for disk-usage analysis or by number of
nodes for structure/complexity analysis.

Shared computation engine

A reusable JcrStatsComputer now powers all three entry points — the
jcr-stats:compute-size Karaf command, the GraphQL API, and the admin UI — so they
always produce consistent results.

Improvements

• Single admin menu entry — the previous two-level JCR Statistics → Compute size
  navigation is collapsed into one clickable JCR Statistics entry under
  System Health.
• Job logging — the asynchronous computation now logs an INFO line when a job
  starts and when it finishes (with elapsed time and visited-node count), making
  long-running scans easy to follow in the server log.
• Karaf command refactored to delegate to the shared JcrStatsComputer.

Fixes

• Defensive node-count traversal cap prevents unbounded memory use on pathologically
  large trees.
• Hardened JSON-import validation for snapshot upload (strict schema enforcement).

Security & access control

• New jcrStatsAdmin permission and jcr-stats-administrator role
  (bundling administrationAccess + jcrStatsAdmin, marked privileged). All GraphQL
  operations and the admin UI require jcrStatsAdmin.
• ⚠️ Privileged traversal: compute(path) and computeSize(path) run under a
  JCR system session, which bypasses node-level read ACLs. Holders of
  jcrStatsAdmin therefore get full-repository structural/size visibility regardless
  of per-node read permissions. This is intentional — administrators need the full
  storage footprint — so treat the jcr-stats-administrator role as granting broad
  read-visibility into the entire JCR tree.
• Generated flamegraph HTML is safe, non-executable content; path parameters are
  validated and traversal is bounded by a configurable depth limit.

Deprecations

• Direct use of ComputeSizeCommand for programmatic access is deprecated — use the
  GraphQL API or JcrStatsComputer instead.

Upgrade notes

• The module's root package was renamed from org.jahia.modules.* to
  org.jahia.community.jcrstats, and the module is now declared as a system
  type module.
• Assign the jcr-stats-administrator role (or grant the jcrStatsAdmin
  permission) to users who should access the tool — see the security note above.

Compatibility

• Requires Jahia 8.2.1.0 or later (jahia-modules parent 8.2.1.0).