feat: Rewrite the profile page layout - EXO-89538

[MayTekayaa]

Prior to this change, the profile page's right column was filled through profile-right-container and six profile-before/after-* dynamic containers, so its real composition was hidden and contributed by each addon from outside the page.
This change declares the right-column portlets directly in the page definition, each guarded by its addon's profile (analytics, kudos, gamification), with the user spaces listing replacing the activity card, and re-imports the page once on existing instances through a LayoutUpgradePlugin (ProfilePageLayoutUpgrade, execution order 160, execute.once=true).

Part of eXIP 7.3.0.18 "User Spaces List" (Tribe note 50524), released last, after Meeds-io/social#6085, Meeds-io/analytics#446, Meeds-io/gamification#2002 and Meeds-io/kudos#628 — merging it before the two addon PRs would briefly leave the profile page with both the page-level declaration and the dynamic-container one.

What the page carries after the upgrade (board story US08)

analytics/SpacesListWidget ("User Spaces List", profiles="analytics"), kudos/KudosOverview (profiles="kudos"), gamification-portlets/BadgesOverview and gamification-portlets/ConnectorUserProfile (profiles="gamification"). gamification-portlets/ProfileStats (the "My activity" card: connections, weekly points, weekly rank, pending requests, gamification ranking) leaves the profile page and is re-declared nowhere; it stays registered in the application registry.

Release note — to be carried into the customer release note and the migration procedure

1. The profile page is re-imported and returns to its shipped state. A page re-import is a full replacement, not a merge (PageImporter treats MERGE like OVERWRITE): every administrator customization of the profile page is lost — portlets added, moved, or placed inside any of the dropped containers. There is no page version history to roll back to, and the layout editor's own "restore" performs the same replacement. The only mitigation is to identify the instances that customized the profile page before upgrading and capture their layout, then re-apply it by hand in the layout editor afterwards. The PO has accepted the reset as expected behaviour (US08).
2. Seven addonContainer names are removed from the profile page; a customer extension contributing to any of them must be adapted (a deployed instance is known to declare wallet/WalletOverview in one): profile-right-container, profile-before-about-me-container, profile-after-about-me-container, profile-before-contact-information-container, profile-after-contact-information-container, profile-before-work-experience-container, profile-after-work-experience-container.
3. Late install of an addon. The profiles="..." cells are filtered when the page is imported (Container.buildChildren() drops a cell whose profile is inactive before the page is stored), not when it is rendered, and this plugin runs once. An instance upgraded without analytics, kudos or gamification installed will not show that addon's block on the profile page when the addon is installed later; recovery is a "restore" of the profile page from the layout editor, which re-applies the shipped layout — at the cost described in point 1.
4. The "My activity" card is removed with what it contained (connections, weekly points and rank, pending requests, gamification ranking); where weekly points and rank resurface, if anywhere, is PO deferred item 3.

Knowledge: Meeds-io/eng-standards#30, Meeds-io/eng-standards#31 (merged) — the profiles page pattern and the MERGE-is-OVERWRITE re-import; the late-install caveat (point 3) is added to frontend-vue.md by the knowledge PR referenced from Meeds-io/social#6085.

Classification: N1 for the delivery as a whole, and this PR contributes a socle trigger of its own — an upgrade plugin that irreversibly rewrites a shipped page layout. Architect/Senior Developer validation, author ≠ approver, no auto-merge on AI review alone.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[boubaker]

AI review — Round #1

Part of the cross-repo review of eXIP 7.3.0.18 "User Spaces List" (Tribe note 50524, revision 6) across Meeds-io/social#6085, Meeds-io/analytics#446, Meeds-io/meeds#4281, Meeds-io/kudos#628 and Meeds-io/gamification#2002, reviewed as one delivery. First round, so there is no status table.

This PR is faithful to the modern pattern and to its own precedent — one finding, and it is about documentation rather than code.

Verified conform

• All seven addonContainers are gone from the profile page: the six profile-before/after-* and profile-right-container, with no transitional container left, per decision D6.
• Cross-repo coherence, checked one for one against what the addons removed. Meeds-io/gamification#2002 drops gamification-portlets/ProfileStats, …/BadgesOverview and …/ConnectorUserProfile; Meeds-io/kudos#628 drops kudos/KudosOverview. This page re-declares BadgesOverview and ConnectorUserProfile under profiles="gamification", KudosOverview under profiles="kudos", adds analytics/SpacesListWidget under profiles="analytics", and leaves ProfileStats on no page — which is board story US08 satisfied, the acceptance criterion that proves the re-declaration was not forgotten. The application-ref values match each addon's real webapp context and the portlet-refs match their portlet.xml; the three profiles values are the addons' real container profile names.
• The upgrade plugin matches its precedent parameter for parameter — the OverviewPageLayoutUpgrade block in this same file — down to product.group.id=org.exoplatform.social, configPath=war:/conf/sites/, portalType=portal, portalName=global and plugin.upgrade.execute.once=true. plugin.execution.order=160 is unused elsewhere in the file.
• profiles= is the right mechanism and has precedent in this very file (profiles="notes", "app-center", "kudos", "wallet", and on <page> itself), so the profile page carries no hard dependency on the analytics addon — decision D2.
• Dropping the per-portlet permissions that the AddOnPluginImpl declarations carried is not a regression. The page gates on access-permissions = *:/platform/users;*:/platform/externals, which covers the users + externals pairs those declarations listed, and the four sibling portlet-applications on this page carry no <access-permissions> either — so the new cells follow the page's own convention.
• Both touched XML files are well-formed.

Classification

N1 for the delivery as a whole (max-severity aggregation from Meeds-io/social#6085), and this PR contributes a socle trigger of its own: an upgrade plugin that irreversibly rewrites a shipped page layout. It needs validation by an Architect/Senior Developer who knows the delivery is N1 — not auto-merge on AI review alone, author != approver. It is also last in the release order (4 of 4), behind social, analytics, gamification and kudos.

Process: the body carries no Knowledge: line, which dev-lifecycle.md §3b step 5 gates at the feature/mips integration PR.

🤖 Generated with Claude Code

[MayTekayaa]

AI review — Round #2 (follow-up)

Part of the cross-repo review of eXIP 7.3.0.18 "User Spaces List" (Tribe note 50524, revision 6; board project 8368) across Meeds-io/social#6085, Meeds-io/analytics#446, Meeds-io/meeds#4281, Meeds-io/kudos#628 and Meeds-io/gamification#2002, reviewed as one delivery. Head unchanged since round 1 (def5d449e6), so no new code to review; this round re-verifies the cross-repo assumptions and the two process items.

Status of round #1

#	Finding	Status
1	🟡 Migration caveats live only in an XML comment	❌ Still open (documentation, no code) — the body still says "profile-right-container and six profile-before/after-* dynamic containers" without naming them, and does not state that the re-import replaces the whole stored page (every administrator customisation lost, no page history) nor the late-install recovery action. The mechanism itself is now in the corpus (eng-standards#30, #31, merged), which covers the developer audience; the release note and migration procedure the spec requires for customers and ITOps are still owed.
2	Process — no Knowledge: line	✅ Fixed — Knowledge: Meeds-io/eng-standards#30, Meeds-io/eng-standards#31 (merged).

Verified conform (re-checked against the addons at their PR heads)

• profiles values are the addons' real container profiles, verified through the mechanism rather than by name: each WAR's META-INF/exo-conf/configuration.xml declares add.profiles = analytics, kudos, gamification respectively (the gamification WAR's dependency is gamification-portlets, its profile is gamification); PortalContainerDefinitionChangePlugin:94-97 feeds them to RootContainer.addProfiles, and Container.buildChildren() (portal → component/api/.../config/model/Container.java:233-262) drops a cell whose profiles list matches none of ExoContainer.getProfiles() — at build/store time, which is what makes the late-install caveat in the XML comment accurate. profiles="gamification" and "kudos" were already used in this file at the merge base.
• Portlet references: analytics/SpacesListWidget (portlet.xml:82), kudos/KudosOverview (:54), gamification-portlets/BadgesOverview (:117) and ConnectorUserProfile (:285) — one for one with what Meeds-io/kudos#628 and Meeds-io/gamification#2002 remove; ProfileStats re-declared nowhere, as the spec requires (US08).
• Upgrade plugin: same parameters as the OverviewPageLayoutUpgrade precedent; plugin.execution.order 160 unique in the file (5, 120, 130, 140, 150, 499, 500); execute.once = true; MERGE defaulted, which PageImporter treats as OVERWRITE.
• All seven addonContainers gone, none kept transiently (D6). Both XML files well-formed.

Classification

N1 for the delivery as a whole, and this PR contributes a socle trigger of its own: an upgrade plugin that irreversibly rewrites a shipped page layout. Validation by an Architect/Senior Developer who knows it is N1, author != approver, no auto-merge on AI review alone. Last in the release order (4 of 4), after social, analytics, gamification and kudos.

🤖 Generated with Claude Code

[MayTekayaa]

Self-review close-out — #4281 (eXIP 7.3.0.18, head def5d449e6)

Part of the cross-repo self-review of the delivery (Meeds-io/social#6085, Meeds-io/analytics#446, Meeds-io/meeds#4281, Meeds-io/kudos#628, Meeds-io/gamification#2002), three rounds plus a closing round by a fresh reviewer, against Tribe note 50524, board 8368 and the layer-1 norms.

#	Finding	Status
1	🟡 Migration caveats (seven container names, full-replacement re-import, late-install recovery) lived only in an XML comment	✅ Documented — this PR body now carries the release-note section; the mechanism is in the corpus (eng-standards#30, #31) and the late-install caveat is added to frontend-vue.md by the knowledge PR referenced from Meeds-io/social#6085
2	🟢 Spec §4 says the upgrade runs "asynchronously"; it runs synchronously like every sibling	➖ Spec author's resync item; no code change
3	Process — Knowledge: line	✅

Verified conform (closing round): all seven addonContainers gone, none kept transiently (D6); the four re-declared cells match one for one what kudos and gamification remove (application-ref/portlet-ref checked against each portlet.xml, profiles values against each WAR's add.profiles); ProfileStats re-declared nowhere (US08); upgrade plugin parameter-identical to the OverviewPageLayoutUpgrade precedent, order 160 unique, execute.once, MERGE defaulted (= OVERWRITE); Container.buildChildren() filters profiles at build/store time, so the late-install caveat is accurate. Release order 4 of 4, after the two addon PRs.

Classification: N1 — an upgrade plugin that irreversibly rewrites a shipped page layout, plus max-severity aggregation from Meeds-io/social#6085. Architect/Senior Developer validation, author ≠ approver, no auto-merge on AI review alone.

🤖 Generated with Claude Code

[boubaker]

AI review — Round #2 (follow-up)

Head unchanged at def5d449e6; the single round-1 finding was documentation, and it is closed in the PR body.

#	Finding	Status
1	🟡 Migration caveats (seven container names, full-replacement re-import, late-install recovery) lived only in an XML comment	✅ Fixed — the body's Release note section carries all of it; Meeds-io/eng-standards#30 / #31 merged
—	Process: Knowledge: line	✅

No new findings. Nothing outstanding on this PR from the AI review side; it remains last in the release order (after social, analytics, gamification, kudos).

Classification: N1 — an upgrade plugin that irreversibly rewrites a shipped page layout, plus max-severity aggregation from Meeds-io/social#6085. Architect/Senior Developer validation, author != approver, no auto-merge on AI review alone.

🤖 Generated with Claude Code

[MayTekayaa]

AI review — Round #3 (final)

Part of the cross-repo review of eXIP 7.3.0.18 "User Spaces List" (Tribe note 50524, revision 6; board project 8368) across Meeds-io/social#6085, Meeds-io/analytics#446, Meeds-io/meeds#4281, Meeds-io/kudos#628 and Meeds-io/gamification#2002, reviewed as one delivery. Head unchanged since round 1 (def5d449e6); this round closes on the PR body.

Status of every finding

Round	#	Finding	Status
1	1	🟡 Migration caveats lived only in an XML comment	✅ Documented — the body now carries the release-note section: full-replacement re-import with the loss of every administrator customisation and no page history, the seven addonContainer names, the late-install caveat with its recovery action, and the removed card's contents. The release note and migration procedure for customers and ITOps can be lifted from it verbatim.
1	2	Process — Knowledge: line	✅ Fixed — eng-standards#30, #31 (merged)

All findings from previous rounds are resolved; nothing outstanding from the AI review side.

One statement of the specification is contradicted by this PR and the author's own close-out already flagged it: §4 says the upgrade runs "executed once, asynchronously" — UpgradeProductPlugin.asyncUpgradeExecution defaults to false and this plugin's configuration sets no plugin.upgrade.async.execution, so it runs synchronously like its OverviewPageLayoutUpgrade sibling. Spec resync item for the author of note 50524, no code change.

Verified conform (unchanged at this head)

All seven addonContainers gone, none kept transiently (D6); the four re-declared cells match one for one what kudos and gamification remove, with application-ref/portlet-ref checked against each portlet.xml and the profiles values against each WAR's add.profiles through the kernel and portal code paths; ProfileStats re-declared nowhere (US08); upgrade plugin parameter-identical to its precedent, order 160 unique, execute.once, MERGE defaulted (= OVERWRITE).

Classification

N1 for the delivery as a whole, and this PR contributes a socle trigger of its own: an upgrade plugin that irreversibly rewrites a shipped page layout. Architect/Senior Developer validation, author != approver, no auto-merge on AI review alone. Last in the release order (5 of 5), after social, analytics, gamification and kudos.

🤖 Generated with Claude Code