site/org: installed; rights before pages; objects as XML

The first run on starshipos-f18.org created the dashboards, then XWiki
refused the group and rights objects: a form-encoded POST needs XWiki's
form token (CSRF), an XML one does not. For about two minutes Admin.WebHome
and Contributors.WebHome were readable by guests (links and the names of
secrets, no values). Objects now go as XML, and the spaces' rights are made
before the pages, so a failed run cannot leave a dashboard open. Installed:
Main 200, Admin and Contributors 401 as a guest, 200 as rajames; a second
run changes nothing.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01GE3SDvQn5EoxdGufk84zz2

site/org/install.sh

@@ -46,18 +46,20 @@ objects() {     # objects <space> <page> <class>: how many the page has
         python3 -c 'import json,sys; print(len(json.load(sys.stdin).get("objectSummaries") or []))'
 }
 object() {      # object <space> <page> <class> <property=value>...: add one
+    # as XML: XWiki refuses a form-encoded POST without its form token (CSRF), not an XML one
     local s=$1 p=$2 c=$3; shift 3
-    local args=(--data-urlencode "className=$c")
-    for kv in "$@"; do args+=(--data-urlencode "property#$kv"); done
-    curl -fsS -o /dev/null -w "  $s.$p: $c added (%{http_code})\n" "${auth[@]}" -X POST "${args[@]}" \
-        "$rest/spaces/$s/pages/$p/objects"
+    local body
+    body=$(python3 -c '
+import sys
+from xml.sax.saxutils import escape
+props = "".join("<property name=\"%s\"><value>%s</value></property>" % (escape(k), escape(v))
+                for k, v in (a.split("=", 1) for a in sys.argv[2:]))
+print("<object xmlns=\"http://www.xwiki.org\"><className>%s</className>%s</object>" % (escape(sys.argv[1]), props))' "$c" "$@")
+    curl -fsS -o /dev/null -w "  $s.$p: $c added (%{http_code})\n" "${auth[@]}" -X POST \
+        -H 'Content-Type: application/xml' --data-binary "$body" "$rest/spaces/$s/pages/$p/objects"
 }
 
 echo "=== $base, as $user"
-page Main WebHome "StarshipOS" Main.WebHome.xwiki
-page Admin WebHome "Admin Dashboard" Admin.WebHome.xwiki
-page Contributors WebHome "Contributors' Dashboard" Contributors.WebHome.xwiki
-
 echo "=== the group $group"
 page XWiki StarshipContributors "Starship Contributors"
 if [ "$(objects XWiki StarshipContributors XWiki.XWikiGroups)" = 0 ]; then
@@ -84,6 +86,11 @@ else
     echo "  Contributors: rights there already, left as they are"
 fi
 
+echo "=== the pages -- after their spaces' rights, so a dashboard is never readable without them"
+page Main WebHome "StarshipOS" Main.WebHome.xwiki
+page Admin WebHome "Admin Dashboard" Admin.WebHome.xwiki
+page Contributors WebHome "Contributors' Dashboard" Contributors.WebHome.xwiki
+
 echo "=== as a guest"
 bad=
 for p in Main Admin Contributors; do