Fix ContentMode block rendering for proxied external resources

namedgraph · claude · namedgraph · commit c11a0d181178 · 2026-04-12T23:46:59.000+02:00
Proxied resources' ContentMode blocks (charts, maps) were querying the
local SPARQL endpoint instead of the remote one because ProxyRequestFilter
discarded all external response headers and ResponseHeadersFilter then
injected the local sd:endpoint Link.

- ApplicationFilter: register external ?uri= target in request context
  (AC.uri property) as authoritative proxy marker
- ProxyRequestFilter: forward all Link headers from external response
- ResponseHeadersFilter: skip local sd:endpoint/ldt:ontology/ac:stylesheet
  for proxy requests; removes now-unused parseLinkHeaderValues/getLinksByRel
- client.xsl (ldh:rdf-document-response): extract sd:endpoint from Link
  header and store in LinkedDataHub.endpoint, mirroring acl:mode pattern
- functions.xsl (sd:endpoint()): return LinkedDataHub.endpoint when set,
  fall back to local /sparql — no changes needed in view.xsl or chart.xsl
- CLAUDE.md: document the proxy/client-side rendering architecture

Co-Authored-By: Claude Sonnet 4.6 &lt;noreply@anthropic.com&gt;
diff --git a/CLAUDE.md b/CLAUDE.md
@@ -91,8 +91,28 @@ The application runs as a multi-container setup:
 1. Requests come through nginx proxy
 2. Varnish provides caching layer
 3. LinkedDataHub application handles business logic
-4. Data persisted to appropriate Fuseki triplestore
-5. XSLT transforms data for client presentation
+4. RDF data is read/written via the **Graph Store Protocol** — each document in the hierarchy corresponds to a named graph in the triplestore; the document URI is the graph name
+5. Data persisted to appropriate Fuseki triplestore
+6. XSLT transforms data for client presentation
+
+### Linked Data Proxy and Client-Side Rendering
+
+LDH includes a Linked Data proxy that dereferences external URIs on behalf of the browser. The original design rendered proxied resources identically to local ones — server-side RDF fetch + XSLT. This created a DDoS/resource-exhaustion vector: scraper bots routing arbitrary external URIs through the proxy would trigger a full server-side pipeline (HTTP fetch → XSLT rendering) per request, exhausting HTTP connection pools and CPU.
+
+The current design splits rendering by request origin:
+
+- **Browser requests** (`Accept: text/html`): `ProxyRequestFilter` bypasses the proxy entirely. The server returns the local application shell. Saxon-JS then issues a second, RDF-typed request (`Accept: application/rdf+xml`) from the browser.
+- **RDF requests** (API clients, Saxon-JS second pass): `ProxyRequestFilter` fetches the external RDF, parses it, and returns it to the caller. No XSLT happens server-side.
+- **Client-side rendering**: Saxon-JS receives the raw RDF and applies the same XSLT 3 templates used server-side (shared stylesheet), so proxied resources look almost identical to local ones.
+
+Key implementation files:
+- `ProxyRequestFilter.java` — intercepts `?uri=` and `lapp:Dataset` proxy requests; HTML bypass; forwards external `Link` headers
+- `ApplicationFilter.java` — registers external proxy target URI in request context (`AC.uri` property) as authoritative proxy marker
+- `ResponseHeadersFilter.java` — skips local-only hypermedia links (`sd:endpoint`, `ldt:ontology`, `ac:stylesheet`) for proxy requests; external ones are forwarded by `ProxyRequestFilter`
+- `client.xsl` (`ldh:rdf-document-response`) — receives the RDF proxy response client-side; extracts `sd:endpoint` from `Link` header; stores it in `LinkedDataHub.endpoint`
+- `functions.xsl` (`sd:endpoint()`) — returns `LinkedDataHub.endpoint` when set (external proxy), otherwise falls back to the local SPARQL endpoint
+
+The SPARQL endpoint forwarding chain ensures ContentMode blocks (charts, maps) query the **remote** app's SPARQL endpoint, not the local one. `LinkedDataHub.endpoint` is reset to the local endpoint by `ldh:HTMLDocumentLoaded` on every HTML page navigation, so there is no stale state when navigating back to local documents.
 
 ### Key Extension Points
 - **Vocabulary definitions** in `com.atomgraph.linkeddatahub.vocabulary`
diff --git a/src/main/java/com/atomgraph/linkeddatahub/server/filter/request/ApplicationFilter.java b/src/main/java/com/atomgraph/linkeddatahub/server/filter/request/ApplicationFilter.java
@@ -107,7 +107,11 @@ public void filter(ContainerRequestContext request) throws IOException
                         
                     requestURI = builder.build();
                 }
-                else requestURI = request.getUriInfo().getRequestUri();
+                else
+                {
+                    request.setProperty(AC.uri.getURI(), graphURI); // authoritative external proxy marker
+                    requestURI = request.getUriInfo().getRequestUri();
+                }
             }
             catch (URISyntaxException ex)
             {
diff --git a/src/main/java/com/atomgraph/linkeddatahub/server/filter/request/ProxyRequestFilter.java b/src/main/java/com/atomgraph/linkeddatahub/server/filter/request/ProxyRequestFilter.java
@@ -65,6 +65,7 @@
 import org.apache.jena.riot.RDFLanguages;
 import org.apache.jena.riot.resultset.ResultSetReaderRegistry;
 import org.glassfish.jersey.message.internal.MessageBodyProviderNotFoundException;
+import java.util.regex.Pattern;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -102,6 +103,7 @@ public class ProxyRequestFilter implements ContainerRequestFilter
 
     private static final Logger log = LoggerFactory.getLogger(ProxyRequestFilter.class);
     private static final MediaTypes MEDIA_TYPES = new MediaTypes();
+    private static final Pattern LINK_SPLITTER = Pattern.compile(",(?=\\s*<)");
 
     @Inject com.atomgraph.linkeddatahub.Application system;
     @Inject jakarta.inject.Provider<Optional<Ontology>> ontology;
@@ -296,14 +298,31 @@ protected Response getResponse(Response clientResponse, Response.StatusType stat
         MediaType formatType = new MediaType(clientResponse.getMediaType().getType(), clientResponse.getMediaType().getSubtype()); // discard charset param
 
         Lang lang = RDFLanguages.contentTypeToLang(formatType.toString());
+        Response response;
         if (lang != null && ResultSetReaderRegistry.isRegistered(lang))
         {
             ResultSetRewindable results = clientResponse.readEntity(ResultSetRewindable.class);
-            return getResponse(results, statusType, selectedVariant);
+            response = getResponse(results, statusType, selectedVariant);
+        }
+        else
+        {
+            Model model = clientResponse.readEntity(Model.class);
+            response = getResponse(model, statusType, selectedVariant);
+        }
+
+        // forward all Link headers from the external response so the client receives remote hypermedia
+        // (e.g. sd:endpoint pointing to the remote SPARQL endpoint);
+        // ResponseHeadersFilter will see sd:endpoint already present and skip injecting the local one
+        String linkHeader = clientResponse.getHeaderString(HttpHeaders.LINK);
+        if (linkHeader != null)
+        {
+            Response.ResponseBuilder builder = Response.fromResponse(response);
+            for (String part : LINK_SPLITTER.split(linkHeader))
+                builder.header(HttpHeaders.LINK, part.trim());
+            response = builder.build();
         }
 
-        Model model = clientResponse.readEntity(Model.class);
-        return getResponse(model, statusType, selectedVariant);
+        return response;
     }
 
     /**
diff --git a/src/main/java/com/atomgraph/linkeddatahub/server/filter/response/ResponseHeadersFilter.java b/src/main/java/com/atomgraph/linkeddatahub/server/filter/response/ResponseHeadersFilter.java
@@ -28,9 +28,6 @@
 import com.atomgraph.linkeddatahub.vocabulary.ACL;
 import java.io.IOException;
 import java.net.URI;
-import java.net.URISyntaxException;
-import java.util.ArrayList;
-import java.util.List;
 import java.util.Optional;
 import jakarta.annotation.Priority;
 import jakarta.inject.Inject;
@@ -40,7 +37,6 @@
 import jakarta.ws.rs.container.ContainerResponseFilter;
 import jakarta.ws.rs.core.HttpHeaders;
 import jakarta.ws.rs.core.Response;
-import java.util.regex.Pattern;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -54,7 +50,6 @@ public class ResponseHeadersFilter implements ContainerResponseFilter
 {
 
     private static final Logger log = LoggerFactory.getLogger(ResponseHeadersFilter.class);
-    private static final Pattern LINK_SPLITTER = Pattern.compile(",(?=\\s*<)"); // split on commas before next '<'
 
     @Inject jakarta.inject.Provider<Optional<Application>> app;
     @Inject jakarta.inject.Provider<Optional<Dataset>> dataset;
@@ -75,16 +70,14 @@ public void filter(ContainerRequestContext request, ContainerResponseContext res
         if (getAuthorizationContext().isPresent())
             getAuthorizationContext().get().getModeURIs().forEach(mode -> response.getHeaders().add(HttpHeaders.LINK, new Link(mode, ACL.mode.getURI(), null)));
 
-        List<Object> linkValues = response.getHeaders().get(HttpHeaders.LINK);
-        List<Link> links = parseLinkHeaderValues(linkValues);
+        // for proxy requests the external Link headers are forwarded by ProxyRequestFilter; suppress local-only hypermedia
+        boolean isProxyRequest = request.getProperty(AC.uri.getURI()) != null;
 
-        if (getLinksByRel(links, SD.endpoint.getURI()).isEmpty())
-            // add Link rel=sd:endpoint.
-            // TO-DO: The external SPARQL endpoint URL is different from the internal one currently specified as sd:endpoint in the context dataset
+        if (!isProxyRequest)
             response.getHeaders().add(HttpHeaders.LINK, new Link(request.getUriInfo().getBaseUriBuilder().path(Dispatcher.class, "getSPARQLEndpoint").build(), SD.endpoint.getURI(), null));
 
-        // Only add application-specific links if application is present
-        if (getApplication().isPresent())
+        // Only add application-specific links if application is present and this is not a proxy request
+        if (!isProxyRequest && getApplication().isPresent())
         {
             Application application = getApplication().get();
             // add Link rel=ldt:ontology, if the ontology URI is specified
@@ -103,55 +96,6 @@ public void filter(ContainerRequestContext request, ContainerResponseContext res
         }
     }
 
-    /**
-    * Parses HTTP <code>Link</code> headers into individual {@link Link} objects.
-    * 
-    * Handles both multiple header fields and comma-separated values
-    * within a single header field.
-    *
-    * @param linkValues raw <code>Link</code> header values (may contain multiple entries)
-    * @return flat list of parsed {@link Link} objects
-    */
-    protected List<Link> parseLinkHeaderValues(List<Object> linkValues)
-    {
-        List<Link> out = new ArrayList<>();
-        if (linkValues == null) return out;
-
-        for (Object hv : linkValues)
-        {
-            String[] parts = LINK_SPLITTER.split(hv.toString());
-            for (String part : parts)
-            {
-                try
-                {
-                     out.add(Link.valueOf(part.trim()));
-                }
-                 catch (URISyntaxException e)
-                {
-                    // ignore invalid entries
-                }
-            }
-        }
-
-        return out;
-    }
-
-    /**
-     * Returns all <code>Link</code> headers that match the given <code>rel</code> attribute.
-     * 
-     * @param links link list
-     * @param rel <code>rel</code> value
-     * @return filtered header list
-     */
-    protected List<Link> getLinksByRel(List<Link> links, String rel)
-    {
-        return links == null
-            ? List.of()
-            : links.stream()
-                   .filter(link -> rel.equals(link.getRel()))
-                   .toList();
-    }
-    
     /**
      * Returns the current application.
      *
diff --git a/src/main/webapp/static/com/atomgraph/linkeddatahub/xsl/bootstrap/2.3.2/client/functions.xsl b/src/main/webapp/static/com/atomgraph/linkeddatahub/xsl/bootstrap/2.3.2/client/functions.xsl
@@ -93,7 +93,9 @@ exclude-result-prefixes="#all"
     </xsl:function>
     
     <xsl:function name="sd:endpoint" as="xs:anyURI">
-        <xsl:sequence select="resolve-uri('sparql', ldt:base())"/>
+        <xsl:sequence select="if (ixsl:contains(ixsl:get(ixsl:window(), 'LinkedDataHub'), 'endpoint'))
+            then xs:anyURI(ixsl:get(ixsl:get(ixsl:window(), 'LinkedDataHub'), 'endpoint'))
+            else resolve-uri('sparql', ldt:base())"/>
     </xsl:function>
     
     <xsl:function name="ldh:query-type" as="xs:string?">
diff --git a/src/main/webapp/static/com/atomgraph/linkeddatahub/xsl/bootstrap/2.3.2/document.xsl b/src/main/webapp/static/com/atomgraph/linkeddatahub/xsl/bootstrap/2.3.2/document.xsl
@@ -180,8 +180,80 @@ extension-element-prefixes="ixsl"
         </div>
     </xsl:template>
 
+    <!-- CONTENT BODY -->
+
+    <xsl:template match="rdf:RDF" mode="bs2:ContentBody">
+        <xsl:param name="id" select="'content-body'" as="xs:string?"/>
+        <xsl:param name="class" select="'container-fluid'" as="xs:string?"/>
+        <xsl:param name="about" select="ac:absolute-path(ldh:base-uri(.))" as="xs:anyURI?"/>
+        <xsl:param name="typeof" select="key('resources', ac:absolute-path(ldh:base-uri(.)))/rdf:type/@rdf:resource/xs:anyURI(.)" as="xs:anyURI*"/>
+        <xsl:param name="mode" as="xs:anyURI"/>
+        <xsl:param name="ldh:requestUri" select="$ldh:requestUri" as="xs:anyURI?"/>
+
+        <div>
+            <xsl:if test="$id">
+                <xsl:attribute name="id" select="$id"/>
+            </xsl:if>
+            <xsl:if test="$class">
+                <xsl:attribute name="class" select="$class"/>
+            </xsl:if>
+            <xsl:if test="$about">
+                <xsl:attribute name="about" select="$about"/>
+            </xsl:if>
+            <xsl:if test="exists($typeof)">
+                <xsl:attribute name="typeof" select="string-join($typeof, ' ')"/>
+            </xsl:if>
+
+            <xsl:choose>
+                <!-- error responses always rendered in bs2:Row mode, no matter what $mode specifies -->
+                <xsl:when test="exists($ldh:requestUri) and key('resources-by-type', '&http;Response') and not(key('resources-by-type', '&spin;ConstraintViolation')) and not(key('resources-by-type', '&sh;ValidationResult'))">
+                    <xsl:apply-templates select="." mode="bs2:Row">
+                        <xsl:sort select="ac:label(.)"/>
+                    </xsl:apply-templates>
+                </xsl:when>
+                <!-- the request is proxied using ?uri, render it client-side in client.xsl -->
+                <xsl:when test="exists($ldh:requestUri) and not(ldh:base-uri(.) = $ldh:requestUri)">
+                    <div class="row-fluid">
+                        <div class="span12 progress progress-striped active">
+                            <div style="width: 33%;" class="bar"></div>
+                        </div>
+                    </div>
+                </xsl:when>
+                <xsl:otherwise>
+                    <xsl:choose>
+                        <xsl:when test="$mode = '&ldh;ContentMode'">
+                            <xsl:apply-templates select="." mode="ldh:ContentList"/>
+                        </xsl:when>
+                        <xsl:when test="$mode = '&ac;MapMode'">
+                            <xsl:apply-templates select="." mode="bs2:Map">
+                                <xsl:with-param name="id" select="generate-id() || '-map-canvas'"/>
+                                <xsl:sort select="ac:label(.)"/>
+                            </xsl:apply-templates>
+                        </xsl:when>
+                        <xsl:when test="$mode = '&ac;ChartMode'">
+                            <xsl:apply-templates select="." mode="bs2:Chart">
+                                <xsl:with-param name="canvas-id" select="generate-id() || '-chart-canvas'"/>
+                                <xsl:with-param name="show-save" select="false()"/>
+                                <xsl:sort select="ac:label(.)"/>
+                            </xsl:apply-templates>
+                        </xsl:when>
+                        <xsl:when test="$mode = '&ac;GraphMode'">
+                            <xsl:variable name="canvas-id" select="generate-id() || '-graph-canvas'" as="xs:string"/>
+                            <div id="{$canvas-id}" class="graph-3d-canvas"/>
+                        </xsl:when>
+                        <xsl:otherwise>
+                            <xsl:apply-templates select="." mode="bs2:Row">
+                                <xsl:sort select="ac:label(.)"/>
+                            </xsl:apply-templates>
+                        </xsl:otherwise>
+                    </xsl:choose>
+                </xsl:otherwise>
+            </xsl:choose>
+        </div>
+    </xsl:template>
+
     <!-- CONTENT LIST -->
-    
+
     <xsl:template match="rdf:RDF" mode="ldh:ContentList">
         <xsl:apply-templates select="key('resources', ac:absolute-path(ldh:base-uri(.)))" mode="#current"/>
         
diff --git a/src/main/webapp/static/com/atomgraph/linkeddatahub/xsl/bootstrap/2.3.2/layout.xsl b/src/main/webapp/static/com/atomgraph/linkeddatahub/xsl/bootstrap/2.3.2/layout.xsl
diff --git a/src/main/webapp/static/com/atomgraph/linkeddatahub/xsl/client.xsl b/src/main/webapp/static/com/atomgraph/linkeddatahub/xsl/client.xsl

Original file line number	Diff line number	Diff line change
`@@ -107,7 +107,11 @@ public void filter(ContainerRequestContext request) throws IOException`
`107`	`107`
`108`	`108`	`requestURI = builder.build();`
`109`	`109`	`}`
`110`		`- else requestURI = request.getUriInfo().getRequestUri();`
	`110`	`+ else`
	`111`	`+ {`
	`112`	`+ request.setProperty(AC.uri.getURI(), graphURI); // authoritative external proxy marker`
	`113`	`+ requestURI = request.getUriInfo().getRequestUri();`
	`114`	`+ }`
`111`	`115`	`}`
`112`	`116`	`catch (URISyntaxException ex)`
`113`	`117`	`{`