@undefineds.co/xpod 0.3.58 → 0.3.62

package/dist/http/SubgraphSparqlHttpHandler.js

@@ -16,7 +16,7 @@ const UsageRepository_1 = require("../storage/quota/UsageRepository");
 const BandwidthThrottleTransform_1 = require("../util/stream/BandwidthThrottleTransform");
 const ALLOWED_METHODS = ['GET', 'POST', 'OPTIONS'];
 class SubgraphSparqlHttpHandler extends community_server_1.HttpHandler {
-    constructor(queryEngine, credentialsExtractor, permissionReader, authorizer, options = {}) {
+    constructor(queryEngine, credentialsExtractor, permissionReader, authorizer, options = {}, updateAuthority) {
         super();
         this.logger = (0, global_logger_factory_1.getLoggerFor)(this);
         this.generator = new sparqljs_1.Generator();
@@ -26,6 +26,7 @@ class SubgraphSparqlHttpHandler extends community_server_1.HttpHandler {
         this.authorizer = authorizer;
         this.sidecarPath = options.sidecarPath ?? '/-/sparql';
         this.defaultBandwidthLimit = this.normalizeLimit(options.defaultAccountBandwidthLimitBps);
+        this.updateAuthority = updateAuthority;
         // Identity DB is used for pod lookup (to resolve accountId/podId from URL)
         if (options.identityDbUrl) {
             const db = (0, db_1.getIdentityDatabase)(options.identityDbUrl);
@@ -97,17 +98,48 @@ class SubgraphSparqlHttpHandler extends community_server_1.HttpHandler {
                 const errorName = error.name || error.constructor.name || 'HttpError';
                 const errorMessage = error.message || 'No message';
                 this.logger.error(`SPARQL sidecar error ${error.statusCode} (${this.getRequestId(request)}): ${errorName} - ${errorMessage}`);
-                this.sendErrorResponse(response, error.statusCode, errorMessage);
+                this.sendErrorResponse(request, response, error.statusCode, errorMessage, {
+                    error: {
+                        code: `http.${error.statusCode}`,
+                        message: errorMessage,
+                    },
+                });
                 return;
             }
             if (error instanceof RdfSparqlAdapter_1.DisabledSparqlFeatureError) {
                 this.logger.warn(`SPARQL sidecar disabled feature (${this.getRequestId(request)}): ${error.message}`);
-                this.sendErrorResponse(response, 403, error.message);
+                this.sendErrorResponse(request, response, 403, error.message, {
+                    error: {
+                        code: 'rdf.sparql.disabled_feature',
+                        message: error.message,
+                        capability: 'sparql.federation.service',
+                        hint: 'Disable SERVICE federation for server-owned Pod queries, or execute it from a trusted client-side/federated query layer.',
+                        correction: (0, RdfSparqlAdapter_1.sparqlCorrectionForCapability)('sparql.federation.service'),
+                    },
+                });
                 return;
             }
             if (error instanceof RdfSparqlAdapter_1.UnsupportedSparqlQueryError) {
                 this.logger.warn(`SPARQL sidecar unsupported query (${this.getRequestId(request)}): ${error.message}`);
-                this.sendErrorResponse(response, 400, error.message);
+                this.sendErrorResponse(request, response, 400, error.message, {
+                    error: {
+                        code: error.code,
+                        message: error.message,
+                        capability: error.capability,
+                        hint: error.hint,
+                        correction: error.correction,
+                    },
+                });
+                return;
+            }
+            if (error instanceof RdfSparqlAdapter_1.NativeSparqlExecutionError) {
+                this.logger.error(`SPARQL sidecar native execution error (${this.getRequestId(request)}): ${error.message}`);
+                this.sendErrorResponse(request, response, 500, error.message, {
+                    error: {
+                        code: error.code,
+                        message: error.message,
+                    },
+                });
                 return;
             }
             // Re-throw unknown errors for CSS error handling
@@ -115,18 +147,28 @@ class SubgraphSparqlHttpHandler extends community_server_1.HttpHandler {
             throw error;
         }
     }
-    sendErrorResponse(response, statusCode, message) {
+    sendErrorResponse(request, response, statusCode, message, jsonPayload) {
         response.statusCode = statusCode;
+        if (this.acceptsJson(request)) {
+            response.setHeader('Content-Type', 'application/json; charset=utf-8');
+            response.end(JSON.stringify(jsonPayload));
+            return;
+        }
         response.setHeader('Content-Type', 'text/plain; charset=utf-8');
         response.end(message);
     }
+    acceptsJson(request) {
+        const accept = request.headers.accept;
+        const values = Array.isArray(accept) ? accept : [accept];
+        return values.some(value => typeof value === 'string' && /\bapplication\/json\b/i.test(value));
+    }
     async executeSelect(request, { query, basePath, baseUrl }, response, context) {
-        await this.authorizeFor(baseUrl, request, [policy_engine_1.PERMISSIONS.Read]);
+        const accessScope = await this.resolveReadAccessScope(baseUrl, request);
         let vars = [];
         const results = [];
         const seenVars = new Set();
         try {
-            const bindingsStream = await this.engine.queryBindings(query, baseUrl);
+            const bindingsStream = await this.engine.queryBindings(query, baseUrl, accessScope);
             const metadata = typeof bindingsStream.metadata === 'function' ? await bindingsStream.metadata() : undefined;
             vars = metadata?.variables?.map((variable) => variable.value) ?? [];
             for await (const binding of bindingsStream) {
@@ -167,8 +209,8 @@ class SubgraphSparqlHttpHandler extends community_server_1.HttpHandler {
         await this.sendPayload(response, JSON.stringify(payload), 'application/sparql-results+json; charset=utf-8', context);
     }
     async executeAsk(request, { query, basePath, baseUrl }, response, context) {
-        await this.authorizeFor(baseUrl, request, [policy_engine_1.PERMISSIONS.Read]);
-        const result = await this.engine.queryBoolean(query, baseUrl);
+        const accessScope = await this.resolveReadAccessScope(baseUrl, request);
+        const result = await this.engine.queryBoolean(query, baseUrl, accessScope);
         const payload = {
             head: {},
             boolean: result,
@@ -176,8 +218,8 @@ class SubgraphSparqlHttpHandler extends community_server_1.HttpHandler {
         await this.sendPayload(response, JSON.stringify(payload), 'application/sparql-results+json; charset=utf-8', context);
     }
     async executeConstruct(request, { query, basePath, baseUrl }, response, context) {
-        await this.authorizeFor(baseUrl, request, [policy_engine_1.PERMISSIONS.Read]);
-        const quadStream = await this.engine.queryQuads(query, baseUrl);
+        const accessScope = await this.resolveReadAccessScope(baseUrl, request);
+        const quadStream = await this.engine.queryQuads(query, baseUrl, accessScope);
         const writer = new n3_1.Writer({ format: 'N-Quads' });
         for await (const quad of quadStream) {
             writer.addQuad(quad);
@@ -198,18 +240,67 @@ class SubgraphSparqlHttpHandler extends community_server_1.HttpHandler {
         if (queryRequest.method !== 'POST') {
             throw new community_server_2.MethodNotAllowedHttpError(['POST']);
         }
-        const { hasInsert, hasDelete } = this.inspectUpdateGraphs(parsed, queryRequest.baseUrl);
+        const accessPlan = this.inspectUpdateGraphs(parsed, queryRequest.baseUrl);
         const modes = [];
-        if (hasInsert) {
+        if (accessPlan.needsReadScope) {
+            modes.push(policy_engine_1.PERMISSIONS.Read);
+        }
+        if (accessPlan.hasInsert) {
             modes.push(policy_engine_1.PERMISSIONS.Append);
         }
-        if (hasDelete) {
+        if (accessPlan.hasDelete) {
             modes.push(policy_engine_1.PERMISSIONS.Delete);
         }
-        await this.authorizeFor(queryRequest.baseUrl, request, modes);
-        const rewritten = this.rewriteDefaultGraphUpdates(parsed, queryRequest.baseUrl);
+        const credentials = await this.authorizeFor(queryRequest.baseUrl, request, modes);
+        for (const source of accessPlan.readTargets) {
+            if (source === queryRequest.baseUrl) {
+                continue;
+            }
+            await this.authorizeIdentifier(source, credentials, [policy_engine_1.PERMISSIONS.Read]);
+        }
+        for (const [graph, graphModes] of accessPlan.writeTargets) {
+            const resourceUrl = this.resourceUrlForGraphValue(graph);
+            if (resourceUrl === queryRequest.baseUrl) {
+                continue;
+            }
+            await this.authorizeIdentifier(resourceUrl, credentials, [...graphModes]);
+        }
+        const readAccessScope = accessPlan.needsReadScope
+            ? await this.resolveReadAccessScopeForCredentials(queryRequest.baseUrl, credentials)
+            : undefined;
+        const loadDocumentPlan = accessPlan.loadDocuments[0];
+        const clearGraph = accessPlan.clearGraphs[0];
+        const graphCopyPlan = accessPlan.graphCopies[0];
+        let nativeOptions;
+        if (loadDocumentPlan) {
+            try {
+                nativeOptions = { loadDocument: await this.readLoadDocument(loadDocumentPlan, queryRequest.baseUrl, readAccessScope) };
+            }
+            catch (error) {
+                if (!loadDocumentPlan.silent) {
+                    throw error;
+                }
+            }
+        }
+        const rewritten = loadDocumentPlan
+            ? this.updateAuthority && nativeOptions?.loadDocument
+                ? this.rewriteLoadedDocumentUpdate(loadDocumentPlan, nativeOptions.loadDocument)
+                : this.rewriteLoadUpdate(loadDocumentPlan)
+            : clearGraph
+                ? this.rewriteClearGraphUpdate(clearGraph)
+                : graphCopyPlan
+                    ? this.rewriteGraphCopyUpdate(graphCopyPlan)
+                    : this.rewriteDefaultGraphUpdates(parsed, queryRequest.baseUrl);
         this.logger.verbose(`[SubgraphSPARQL] Rewritten Query: ${rewritten}`);
-        await this.engine.queryVoid(rewritten, queryRequest.baseUrl);
+        const skippedSilentAuthorityLoad = Boolean(this.updateAuthority && loadDocumentPlan?.silent && !nativeOptions?.loadDocument);
+        if (!skippedSilentAuthorityLoad) {
+            if (this.updateAuthority) {
+                await this.updateAuthority.executeSparqlUpdate(rewritten, queryRequest.baseUrl, readAccessScope);
+            }
+            else {
+                await this.engine.queryVoid(rewritten, queryRequest.baseUrl, readAccessScope, nativeOptions);
+            }
+        }
         await this.refreshUsage(queryRequest.baseUrl);
         response.statusCode = 204;
         response.setHeader('Cache-Control', 'no-store');
@@ -311,42 +402,161 @@ class SubgraphSparqlHttpHandler extends community_server_1.HttpHandler {
         }
         return Math.trunc(value);
     }
+    async resolveReadAccessScope(baseUrl, request) {
+        const credentials = await this.authorizeFor(baseUrl, request, [policy_engine_1.PERMISSIONS.Read]);
+        return this.resolveReadAccessScopeForCredentials(baseUrl, credentials);
+    }
+    async resolveReadAccessScopeForCredentials(baseUrl, credentials) {
+        const graphs = await this.engine.listGraphs(baseUrl);
+        const deniedGraphUrls = [];
+        for (const graph of graphs) {
+            const resourceUrl = this.resourceUrlForGraphValue(graph);
+            if (!resourceUrl.startsWith(baseUrl)) {
+                continue;
+            }
+            const allowed = await this.canAuthorizeFor(resourceUrl, credentials, [policy_engine_1.PERMISSIONS.Read]);
+            if (!allowed) {
+                deniedGraphUrls.push(graph);
+            }
+        }
+        deniedGraphUrls.sort();
+        return {
+            basePath: baseUrl,
+            mode: 'read',
+            principal: credentials.agent?.webId ?? credentials.client?.clientId ?? 'anonymous',
+            ...(deniedGraphUrls.length > 0 ? { deniedGraphUrls } : {}),
+            version: deniedGraphUrls.length > 0
+                ? `graphs:${graphs.size}:denied:${deniedGraphUrls.join(',')}`
+                : `graphs:${graphs.size}:inherited`,
+        };
+    }
     async authorizeFor(basePath, request, modes) {
         if (modes.length === 0) {
-            return;
+            return this.credentialsExtractor.handleSafe(request);
+        }
+        const credentials = await this.credentialsExtractor.handleSafe(request);
+        await this.authorizeIdentifier(basePath, credentials, modes);
+        return credentials;
+    }
+    async canAuthorizeFor(basePath, credentials, modes) {
+        try {
+            await this.authorizeIdentifier(basePath, credentials, modes);
+            return true;
+        }
+        catch (error) {
+            this.logger.debug(`ACL/ACR graph denied for ${basePath}: ${error instanceof Error ? error.message : String(error)}`);
+            return false;
         }
+    }
+    async authorizeIdentifier(basePath, credentials, modes) {
         const identifier = { path: basePath };
         const requestedModes = new community_server_2.IdentifierSetMultiMap();
         for (const mode of modes) {
             requestedModes.add(identifier, mode);
         }
-        const credentials = await this.credentialsExtractor.handleSafe(request);
         const availablePermissions = await this.permissionReader.handleSafe({ credentials, requestedModes });
         await this.authorizer.handleSafe({ credentials, requestedModes, availablePermissions });
     }
     inspectUpdateGraphs(update, basePath) {
-        let hasInsert = false;
-        let hasDelete = false;
+        const plan = {
+            hasInsert: false,
+            hasDelete: false,
+            needsReadScope: false,
+            readTargets: new Set(),
+            writeTargets: new Map(),
+            loadDocuments: [],
+            clearGraphs: [],
+            graphCopies: [],
+        };
         for (const operation of update.updates ?? []) {
+            if (this.isLoadOperation(operation)) {
+                if ((update.updates?.length ?? 0) !== 1) {
+                    throw new community_server_2.BadRequestHttpError('SPARQL LOAD cannot be mixed with other update operations on the /-/sparql endpoint.');
+                }
+                plan.hasInsert = true;
+                plan.needsReadScope = true;
+                const sourceUri = this.assertGraphTermInScope(operation.source, basePath);
+                if (!sourceUri) {
+                    throw new community_server_2.BadRequestHttpError('SPARQL LOAD source must be an explicit in-pod IRI.');
+                }
+                const targetGraph = operation.destination
+                    ? this.assertGraphTermInScope(operation.destination, basePath)
+                    : basePath;
+                plan.readTargets.add(sourceUri);
+                this.addWriteTarget(plan, targetGraph ?? basePath, [policy_engine_1.PERMISSIONS.Append]);
+                plan.loadDocuments.push({
+                    sourceUri,
+                    targetGraph: targetGraph ?? basePath,
+                    ...(operation.silent ? { silent: true } : {}),
+                });
+                continue;
+            }
+            if (this.isClearGraphOperation(operation) || this.isDropGraphOperation(operation)) {
+                if ((update.updates?.length ?? 0) !== 1) {
+                    throw new community_server_2.BadRequestHttpError('SPARQL graph deletion operations cannot be mixed with other update operations on the /-/sparql endpoint.');
+                }
+                plan.hasDelete = true;
+                plan.needsReadScope = true;
+                const graph = this.assertGraphInScope(operation.graph, basePath) ?? basePath;
+                this.addWriteTarget(plan, graph, [policy_engine_1.PERMISSIONS.Delete]);
+                plan.clearGraphs.push(graph);
+                continue;
+            }
+            if (this.isGraphCopyOperation(operation)) {
+                if ((update.updates?.length ?? 0) !== 1) {
+                    throw new community_server_2.BadRequestHttpError('SPARQL graph copy operations cannot be mixed with other update operations on the /-/sparql endpoint.');
+                }
+                const sourceGraph = this.assertGraphInScope(operation.source, basePath) ?? basePath;
+                const targetGraph = this.assertGraphInScope(operation.destination, basePath) ?? basePath;
+                plan.hasInsert = true;
+                plan.needsReadScope = true;
+                plan.readTargets.add(sourceGraph);
+                if (operation.type === 'add') {
+                    this.addWriteTarget(plan, targetGraph, [policy_engine_1.PERMISSIONS.Append]);
+                }
+                else if (operation.type === 'copy') {
+                    plan.hasDelete = true;
+                    this.addWriteTarget(plan, targetGraph, [policy_engine_1.PERMISSIONS.Delete, policy_engine_1.PERMISSIONS.Append]);
+                }
+                else {
+                    plan.hasDelete = true;
+                    this.addWriteTarget(plan, targetGraph, [policy_engine_1.PERMISSIONS.Delete, policy_engine_1.PERMISSIONS.Append]);
+                    this.addWriteTarget(plan, sourceGraph, [policy_engine_1.PERMISSIONS.Delete]);
+                }
+                plan.graphCopies.push({ operation: operation.type, sourceGraph, targetGraph });
+                continue;
+            }
+            if (this.isCreateGraphOperation(operation)) {
+                plan.hasInsert = true;
+                const graph = this.assertGraphInScope(operation.graph, basePath) ?? basePath;
+                this.addWriteTarget(plan, graph, [policy_engine_1.PERMISSIONS.Append]);
+                continue;
+            }
             if (!this.isInsertDeleteOperation(operation)) {
                 throw new community_server_2.BadRequestHttpError('SPARQL update management operations are not supported.');
             }
             if (operation.updateType === 'insert' ||
                 (operation.updateType === 'insertdelete' && (operation.insert?.length ?? 0) > 0)) {
-                hasInsert = true;
+                plan.hasInsert = true;
             }
             if (operation.updateType === 'delete' || operation.updateType === 'deletewhere' ||
                 (operation.updateType === 'insertdelete' && (operation.delete?.length ?? 0) > 0)) {
-                hasDelete = true;
+                plan.hasDelete = true;
             }
+            const defaultGraph = operation.graph
+                ? this.assertGraphInScope(operation.graph, basePath) ?? basePath
+                : basePath;
             if (operation.graph) {
                 this.assertGraphInScope(operation.graph, basePath);
             }
             if (operation.updateType === 'insert' || operation.updateType === 'insertdelete') {
-                this.inspectQuads(operation.insert ?? [], basePath);
+                this.inspectQuads(operation.insert ?? [], basePath, defaultGraph, plan, [policy_engine_1.PERMISSIONS.Append]);
             }
             if (operation.updateType === 'delete' || operation.updateType === 'insertdelete' || operation.updateType === 'deletewhere') {
-                this.inspectQuads(operation.delete ?? [], basePath);
+                this.inspectQuads(operation.delete ?? [], basePath, defaultGraph, plan, [policy_engine_1.PERMISSIONS.Delete]);
+            }
+            if (operation.updateType === 'insertdelete' || operation.updateType === 'deletewhere') {
+                plan.needsReadScope = true;
             }
             if (operation.updateType === 'insertdelete') {
                 this.inspectPatterns(operation.where ?? [], basePath);
@@ -360,12 +570,18 @@ class SubgraphSparqlHttpHandler extends community_server_1.HttpHandler {
                 }
             }
         }
-        return { hasInsert, hasDelete };
+        return plan;
     }
-    inspectQuads(quads, basePath) {
+    inspectQuads(quads, basePath, defaultGraph, plan, modes) {
         for (const quad of quads) {
             if (quad.type === 'graph') {
-                this.assertGraphTermInScope(quad.name, basePath);
+                const graph = this.assertGraphTermInScope(quad.name, basePath);
+                if (graph) {
+                    this.addWriteTarget(plan, graph, modes);
+                }
+            }
+            else {
+                this.addWriteTarget(plan, defaultGraph, modes);
             }
         }
     }
@@ -382,45 +598,90 @@ class SubgraphSparqlHttpHandler extends community_server_1.HttpHandler {
     }
     assertGraphInScope(graph, basePath) {
         if ('default' in graph && graph.default) {
-            return;
+            return undefined;
         }
         if ('name' in graph) {
             const name = graph.name;
             if (name) {
-                this.assertGraphTermInScope(name, basePath);
+                return this.assertGraphTermInScope(name, basePath);
             }
         }
         else if ('value' in graph) {
-            this.assertGraphTermInScope(graph, basePath);
+            return this.assertGraphTermInScope(graph, basePath);
         }
+        return undefined;
     }
     assertGraphTermInScope(term, basePath) {
         if (!term) {
-            return;
+            return undefined;
         }
         if (term.termType === 'Variable') {
             throw new community_server_2.BadRequestHttpError('Graph IRIs must be explicit when using the /-/sparql update endpoint.');
         }
         if (term.termType === 'NamedNode') {
-            // Graph can be either basePath or prefix:basePath (e.g., meta:http://...)
-            // Extract the path part after optional prefix (anything before first colon that's not part of http:)
             const graphValue = term.value;
-            let pathPart = graphValue;
-            // Check if it has a prefix like "meta:" or "acl:" (not "http:" or "https:")
-            const prefixMatch = graphValue.match(/^([a-z]+):(?!\/\/)/i);
-            if (prefixMatch) {
-                pathPart = graphValue.slice(prefixMatch[0].length);
-            }
+            const pathPart = this.resourceUrlForGraphValue(graphValue);
             if (!pathPart.startsWith(basePath)) {
                 throw new community_server_2.BadRequestHttpError(`Graph ${term.value} is outside of ${basePath}.`);
             }
-            return;
+            return graphValue;
         }
         if (term.default === true) {
-            return;
+            return undefined;
         }
         throw new community_server_2.BadRequestHttpError('Unsupported graph target in SPARQL update.');
     }
+    addWriteTarget(plan, graph, modes) {
+        const existing = plan.writeTargets.get(graph) ?? new Set();
+        for (const mode of modes) {
+            existing.add(mode);
+        }
+        plan.writeTargets.set(graph, existing);
+    }
+    async readLoadDocument(plan, basePath, accessScope) {
+        const quads = await this.engine.constructGraph(plan.sourceUri, basePath, accessScope);
+        const lines = [];
+        for await (const quad of quads) {
+            lines.push([
+                SubgraphSparqlHttpHandler.termToNQuads(quad.subject),
+                SubgraphSparqlHttpHandler.termToNQuads(quad.predicate),
+                SubgraphSparqlHttpHandler.termToNQuads(quad.object),
+                '.',
+            ].join(' '));
+        }
+        return {
+            sourceUri: plan.sourceUri,
+            body: lines.length > 0 ? `${lines.join('\n')}\n` : '',
+            mediaType: 'application/n-triples',
+        };
+    }
+    rewriteLoadUpdate(plan) {
+        return `LOAD ${plan.silent ? 'SILENT ' : ''}<${plan.sourceUri}> INTO GRAPH <${plan.targetGraph}>`;
+    }
+    rewriteLoadedDocumentUpdate(plan, document) {
+        return `INSERT DATA { GRAPH <${plan.targetGraph}> {\n${document.body}\n} }`;
+    }
+    rewriteClearGraphUpdate(graph) {
+        return `DELETE WHERE { GRAPH <${graph}> { ?s ?p ?o } }`;
+    }
+    rewriteGraphCopyUpdate(plan) {
+        if (plan.sourceGraph === plan.targetGraph) {
+            return `CREATE SILENT GRAPH <${plan.targetGraph}>`;
+        }
+        const insert = `INSERT { GRAPH <${plan.targetGraph}> { ?s ?p ?o } } WHERE { GRAPH <${plan.sourceGraph}> { ?s ?p ?o } }`;
+        if (plan.operation === 'add') {
+            return insert;
+        }
+        const clearTarget = this.rewriteClearGraphUpdate(plan.targetGraph);
+        if (plan.operation === 'copy') {
+            return `${clearTarget}; ${insert}`;
+        }
+        return `${clearTarget}; ${insert}; ${this.rewriteClearGraphUpdate(plan.sourceGraph)}`;
+    }
+    resourceUrlForGraphValue(graphValue) {
+        const prefixMatch = graphValue.match(/^([a-z][a-z0-9-]*):(?!\/\/)/i);
+        return prefixMatch ? graphValue.slice(prefixMatch[0].length) : graphValue;
+    }
     /**
      * Rewrites INSERT/DELETE/INSERT+DELETE that target the default graph (or BGP without GRAPH)
      * so they write to the resource graph (graphIri).
@@ -644,11 +905,31 @@ class SubgraphSparqlHttpHandler extends community_server_1.HttpHandler {
             .replace(/\r/g, '\\r')
             .replace(/\t/g, '\\t')
             .replace(/\f/g, '\\f')
-            .replace(/\b/g, '\\b');
+            .replace(/\u0008/g, '\\b');
     }
     isInsertDeleteOperation(operation) {
         return typeof operation.updateType === 'string';
     }
+    isLoadOperation(operation) {
+        const candidate = operation;
+        return candidate.type === 'load' &&
+            candidate.source?.termType === 'NamedNode' &&
+            (!candidate.destination || candidate.destination.termType === 'NamedNode');
+    }
+    isClearGraphOperation(operation) {
+        return operation.type === 'clear' && 'graph' in operation;
+    }
+    isDropGraphOperation(operation) {
+        return operation.type === 'drop' && 'graph' in operation;
+    }
+    isGraphCopyOperation(operation) {
+        const candidate = operation;
+        return (candidate.type === 'add' || candidate.type === 'copy' || candidate.type === 'move') &&
+            'source' in operation && 'destination' in operation;
+    }
+    isCreateGraphOperation(operation) {
+        return operation.type === 'create' && 'graph' in operation;
+    }
     getRequestId(request) {
         const header = (request.headers['x-request-id'] ?? request.headers['X-Request-Id']);
         return header?.toString() ?? 'no-request-id';