Develop#322
Draft
namedgraph wants to merge 12 commits into
Draft
Conversation
acl:mode() reads the LinkedDataHub.acl-modes window flags, which were set only on document load from the response Link headers. On fetch-less switches between already-loaded tab panes the flags went stale, reflecting the last-loaded document rather than the activated pane. Extract the flag-setting into a reusable ldh:SetAclModes template; stamp each document body with data-acl-modes (from its Link-header modes) via a new acl-modes param threaded through bs2:Document; re-sync the flags from the activated pane's data-acl-modes in ldh:ActivateTab, and re-stamp reused panes.
The in-modal live-search onkeyup handler scheduled its deferred search with
<ixsl:schedule-action wait="$delay" document="ixsl:page()">. The document
attribute names fetchable document URIs; the literal string ixsl:page() made
SaxonJS attempt fetch("ixsl:page()"), logging "Fetch API cannot load
ixsl:page(). URL scheme ixsl is not supported" on every debounced keystroke.
The deferred body reaches the live page via ixsl:page() at execution time and
needs no preloaded document, so wait alone is the correct trigger — matching
the typeahead debounce in form.xsl.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* Harden SSRF, XXE, and JWT verification (pen-test remediation) - URLValidator: block loopback (127.0.0.0/8, ::1) and wildcard (0.0.0.0, ::) addresses in addition to link-local/private, and check every resolved address to narrow the DNS-rebinding window (LNK-003/LNK-009). ALLOW_INTERNAL_URLS remains the development escape hatch. Extend URLValidatorTest. - SecureXML: hardened parser factories. XSLTMasterUpdater parses with DTDs and external entities disabled; ldh:send-request (SendHTTPRequest) parses external responses with secure processing (entity-expansion capped) and external entities disabled (LNK-005 residual). - Upgrade java-jwt 3.19.4 -> 4.5.2 on the OAuth2/OIDC verification path; adapt the one breaking call (IDTokenFilterBase TokenExpiredException now takes an Instant); add JWKS-based JWTVerifier tests. - Document the pinned-truststore invariant behind the disabled hostname verifier on internal HTTP clients. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * Do not block loopback in URLValidator (fix http-tests regression) The loopback block broke the HTTP test suite: it runs entirely on https://localhost:4443/, so every client-cert WebID is a localhost URI that WebIDFilter validates on each authenticated request. Blocking loopback turned those into InternalURLException -> 400 on every authenticated call. LDH dereferences its own documents/WebIDs on the same origin (loopback in local/test deployments), and the actual pen-test target (fuseki-admin:3030) is site-local and already blocked, so loopback blocking added little and fought the architecture. Keep the wildcard/any-local block and the all-addresses DNS-rebinding check; leave loopback reachable. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
…nFilter tests (#321) * Make WebID and JWKS cache TTLs configurable The WebID model cache and JWKS cache had a hardcoded 1-day expiration (the TO-DO on the webIDmodelCache field). Read the TTL (seconds) from the com.atomgraph.linkeddatahub.{webIDCacheExpiration,jwksCacheExpiration} system properties, wired from WEBID_CACHE_EXPIRATION / JWKS_CACHE_EXPIRATION env vars via CATALINA_OPTS in the entrypoint, mirroring the CLIENT_* timeout mechanism. Default stays 86400 (1 day), so behaviour is unchanged; lowering the WebID TTL bounds how long a revoked WebID stays authenticated. * Add Dependabot config Weekly update PRs for Maven dependencies (grouping routine minor/patch bumps), the Docker base image, and GitHub Actions. The client 4.3.0 -> 5.x drift went unnoticed for a full major version; automating this prevents a recurrence. * Add AGENTS.md HTTP API guide for agents A machine-readable capability manifest for LLM/HTTP agents driving a running LinkedDataHub instance: the document-as-named-graph model, WebID-TLS auth, the write discipline (POST/PUT to create, PATCH with application/sparql-update to update, DELETE to remove — never the read-only SPARQL endpoint), the content and dataspace model, and the bin/ + Web-Algebra tooling. Mirrors the per-service AGENTS.md convention REST-VKG already serves. * Add AuthorizationFilter unit tests Cover the pure decision logic that had no unit coverage: the HTTP-method to ACL access-mode contract (GET/HEAD->Read, POST->Append, PUT/DELETE/PATCH->Write), getAuthorizationByMode lookup, and createOwnerAuthorization granting the owner Read/Write/Append. No SPARQL or JAX-RS mocking needed.
A language-tagged dct:title renders (xhtml:DefinitionDescription) as a <dd> with a leading language-badge <span>, so xsl:value-of over the whole element prepended the tag to the heading (e.g. "enCurrent members"). Select the value text() node only, dropping the badge; [1] guards against multiple language values. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
ldh:wrap-describe nested the original query — including its FROM / FROM NAMED
dataset clause — as a subquery inside DESCRIBE * WHERE { … }. A dataset clause
is only legal on the outermost query, so any view query carrying a FROM (e.g.
FROM <urn:x-arq:UnionGraph>) became an invalid subquery and the SPARQL endpoint
returned 400. Result-set views (ldh:View, all modes) always go through
ldh:RenderView → ldh:wrap-describe, so they all broke; charts (ResultSetChart)
bypass this path, which is why FROM works there.
Hoist the dataset clause up to the wrapping DESCRIBE and strip it from the
nested subquery. No-op for queries without a dataset clause, so fully
backwards-compatible.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
…323) * Consolidate CSR label rendering on per-vocab templates, retire $ldt:lang - client.xsl imports the Web-Client per-vocab stylesheets (same order as internal-layout.xsl, so CSR label precedence = SSR) and drops the monolithic ac:label/ac:description override — fixes duplicate bilingual widget headings (e.g. BacklinksBacklinks) rendered when the browser language matched neither @en nor @es - Property-value suppression in bs2:PropertyList negotiates over $ac:langs (two split templates): the best accepted language per property wins; values in unaccepted languages stay hidden as before - sh.xsl label/description templates migrated to $ac:langs - All xsl:sort collations use $ac:lang; dual use-when sort pairs collapsed - Depend on client 5.0.3-SNAPSHOT Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * Override $ac:langs client-side from navigator.languages CSR override in client.xsl (import precedence over the Web-Client $ldt:lang-derived default). SaxonJS marshals navigator.languages as an XDM sequence, so it is iterated directly. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * Add client-side ac:uuid() override Implements the Web-Client stub via window.generateUUID in the CSR functions module, mirroring the $ac:langs override pattern. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> --------- Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
The fixed-position .left-sidebar had no overflow, so on short screens the "Other views" section below the class list was clipped and unreachable. Add overflow-y: auto so the whole sidebar scrolls. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.