Enforce top-level coherence in the single CLI selection gate

queries validate validated graph membership only as a side effect of URI
resolution and queries list only via resolve_graph_selection's membership
check; neither applied the named-graph/top-level coherence rule server boot
enforces, so both gave a false green on a config boot refuses.

Fold ensure_top_level_blocks_honored into resolve_graph_selection so it is the
single gate that returns only valid + server-coherent selections, and route
resolve_selected_graph (queries validate) through it; queries list already
calls the gate. A named graph with a populated top-level block now errors in
both commands, matching boot. A positional URI stays anonymous (top-level
honored), so queries_validate_positional_uri_ignores_default_graph is
unaffected.
This commit is contained in:
Ragnor Comerford 2026-06-01 12:38:08 +02:00
parent 7adbd09a98
commit 5c124b1afe
No known key found for this signature in database
2 changed files with 50 additions and 9 deletions

View file

@ -1698,6 +1698,11 @@ fn resolve_selected_graph(
.map(str::to_string)
.or_else(|| config.cli_graph_name().map(str::to_string))
};
// Validate the selection through the single gate (membership + coherence),
// so a positional URI stays anonymous and a named graph is rejected when a
// top-level block would be silently ignored — matching server boot. `list`
// already routes through the same gate; this keeps `validate` in step.
config.resolve_graph_selection(selected.as_deref())?;
let uri = resolve_local_uri(config, cli_uri, cli_target, operation)?;
Ok((uri, selected))
}