Page Quality Audit 1.3.0

Security release. Hardens the optional AI review endpoint against abuse of the operator's LLM key. Fixes #16 (external security review, PR #17 by @julian-maurel). No functional change to auditing.

Security

• Authorization - the AI review is bound to a page the caller can read (jcr:read); unreadable or missing paths return 403. Closes the "any authenticated user or Personal API Token drives unlimited LLM calls billed to the operator's key" abuse.
• Rate limiting - per-user sliding window of 30 reviews / 10 minutes (429 beyond).
• Unauthenticated disclosure - the status GET now requires a non-guest user; provider/model are no longer readable anonymously.
• CSRF - POST requires Content-Type: application/json (415 otherwise) and rejects cross-origin browser requests (Origin/Referer host check).
• Error disclosure - provider/exception detail is logged server-side only; the client gets a generic message.
• Link checker - only same-origin links on a read-only content-serving allowlist (/cms/render, /cms/file, /files) are verified with the editor session; all other same-origin links are counted but never fetched.

All findings verified live on Jahia 8.2.3.0 (unauth GET → 403, unreadable-path POST → 403, text/plain → 415, cross-origin → 403, 32 concurrent POSTs → exactly 30 processed then 429, legitimate editor review unchanged).

Install

Deploy page-audit-1.3.0.jar via the Jahia module manager (Jahia 8.2+), enable the module on the target site(s). Optional AI review requires org.jahia.se.modules.pageaudit.cfg (provider, model, API key).

See CHANGELOG.md for full history.

Page Quality Audit 1.2.0

Polish release focused on the AI review experience.

Fixed

• AI review language now follows the editor's jContent UI language (not the audited page's language): with Jahia set to English you get an English report even when auditing a French page, and vice versa. Quoted page wording stays verbatim in the page's own language so highlight-in-preview keeps working. The language instruction is also far more reliable - the prompt now states an explicit language name instead of an ISO code.

Improved

• More comfortable reading: base line-height raised to 1.55 across the drawer, extra breathing room in stat lists and recommendation details.

Install

Deploy page-audit-1.2.0.jar via the Jahia module manager (Jahia 8.2+), enable the module on the target site(s). The optional AI review requires the OSGi configuration org.jahia.se.modules.pageaudit.cfg (provider, model, API key). Note: AI reviews cached in the browser before this release keep their old language until regenerated.

Page Quality Audit 1.1.0

The AI release: a seventh AI review tab joins the six automated audits, plus major editor-comfort features. Full English + French UI throughout.

New: AI review tab (optional)

• Sends the page text and a digest of all audit findings to a configured LLM (Anthropic, OpenAI or DeepSeek) and returns an overall assessment plus up to 15 prioritized recommendations.
• 11 categories, including dimensions no automated check covers: proofreading (typos/grammar), factuality (outdated content), consistency, conversion (CTA quality), localization quality and legal risk.
• Exact-wording quotes with robust highlight-in-preview (normalized, element-level matching).
• Footer shows token consumption (in/out) and estimated cost (rates configurable).
• Server-side prompt construction and strict JSON-schema validation - the endpoint cannot be abused as a general LLM proxy; the API key never reaches the browser. Truncated model answers are salvaged instead of failing.
• Configured via OSGi config org.jahia.se.modules.pageaudit.cfg (provider, model, key, max tokens, brand-voice prompt appendix, pricing) - live reload, no restart. Disabled until configured.

New: editor comfort

• Result caching: audits (including the AI review) are cached per page+language in localStorage - reopening the drawer restores the last audit instantly, with a "Last audit: date" header indicator.
• Staleness detection: a cheap repository probe detects when the page was modified after the audit and shows a non-blocking notice while keeping the old report visible as a fix-it checklist.
• Collapsible page preview for full-height results.
• Tabs reordered: Accessibility, SEO, Web Vitals, Readability, Links, Jahia, AI review.

Improvements & fixes

• Text extraction joins text nodes with spaces (accurate readability counts, no fake "missing spaces" AI findings); Jahia's preview title prefix is stripped from SEO title checks.
• Editor/preview tooling (e.g. jExperience persona panel) excluded from all analyzers.
• Audits of HTTP 4xx/5xx preview renders are refused instead of silently scored.
• MIT LICENSE file; CI (GitHub Actions) and Dependabot with platform guardrails.

Install

Deploy page-audit-1.1.0.jar via the Jahia module manager (Jahia 8.2+), enable the module on the target site(s). AI review additionally requires the OSGi configuration above.

Page Quality Audit 1.0.0

First release of Page Quality Audit - a jContent UI extension that adds a "Page audit" action on pages in jContent / Page Builder, opening a side drawer that audits the rendered page across six tabs. Every tab leads with actionable, severity-ranked recommendations; every badge is an issue count. Full English + French UI.

Tabs

• Accessibility - full axe-core WCAG A/AA/AAA + best-practice sweep with per-level scorecards, element highlighting, engine/rules transparency, "needs human review" cases, and a manual checklist for the criteria no tool can automate.
• SEO - title/description length bands, noindex detection, canonical, Open Graph / Twitter card checks with a rendered social sharing preview, JSON-LD validation, lang attribute, alt coverage, generic anchor texts.
• Links - verifies internal links with the editor's session and lists broken ones; flags hardcoded host URLs, mixed content, _blank without noopener. Skips login/logout/action URLs.
• Jahia - repository-aware checks via GraphQL: unpublished content blocks, missing translations per active site language, raw i18n keys visible in the DOM, placeholder text.
• Web Vitals - lab TTFB / DOM ready / full load / CLS / estimated LCP plus page weight, request count, DOM size and image diagnostics.
• Readability - Flesch + Flesch-Kincaid (EN), Kandel-Moles (FR), sentence/paragraph stats, heading structure.

Re-run and JSON export included. Editor tooling (e.g. jExperience persona preview) is excluded from analysis; error pages (HTTP 4xx/5xx previews) are refused rather than scored.

Install

Deploy page-audit-1.0.0.jar via the Jahia module manager (Jahia 8.2+, Java 17 build), then enable the module on the target site(s).