Correctness fixes from full-repo review: query semantics, element projection, deletion, status codes

[blake-regalia]

Summary

Eleven incremental fixes from a full review of the implementation, each committed with its own regression tests. The suite grows from 29 to 55 tests, all green against the layer1 + Fuseki test stack.

Issue fixes

• Fixes Error for Query - PrimitiveConstraint value cannot be array #13 — PrimitiveConstraint semantics completed per the OMG schema: = (and the schema's in, now accepted) is set membership over the whole value array instead of silently using only value[0]; "value": null and null array entries match elements lacking the property (the old null check compared a List against JsonNull — dead code); value is nullable as the schema requires; or composites over different properties no longer exclude elements missing either property (constraint patterns are OPTIONAL with bound() guards); property names are sanitized before becoming SPARQL variables; queries missing select/where return 400 instead of an NPE 500. Adds the first execution coverage of POST /query-results and saved-query results.
• Fixes /elements response for nested behavioral flows appears to omit featureChain information #19 — multi-valued sysml: properties without a json: array annotation (e.g. models loaded as raw RDF rather than through this API's commit path) were silently dropped from every /elements response — exactly the reported disappearance of featureChain. They now render as a best-effort array; when the annotation exists it remains authoritative and preserves order. Also removes a second silent-loss path: a commit change whose identity.@id disagrees with its payload.@id was discarded while the commit still returned 200 — now a 400.
• References GET /projects/{projectId}/branches returns branch names mismatched with @id values #20 (not closed here) — the name/id shuffling reproduces upstream: layer1's list-branches wildcard CONSTRUCT is mis-evaluated by GraphDB when joined with the access-control BGP, and this service faithfully translates the corrupted graph. This PR hardens the local side — branch/tag/project builders no longer fabricate created/name defaults that masked the upstream corruption, and a new test pins the name↔@id pairing in the list response — but the issue should stay open until a layer1 release with the explicit per-branch property binding lands and the compose files pin it.

Additional correctness fixes found during review

• Element deletion left dangling references: the collected incoming-reference set was never used in the SPARQL update. Deletion now removes incoming link triples and the referencing property's array annotation.
• forward() never actually propagated upstream response headers (the built header map was discarded inside the respondText lambda) — ETag, Location, and WWW-Authenticate from layer1 now reach clients; forwarded 401s carry their challenge.
• Status codes: GET of a nonexistent element returned 200 with a fabricated {"@type": null} body (now 404); commits/queries against a nonexistent project crashed on next()!! (now forwarded 404); malformed payloads threw a bare java.lang.Error (now 400); blank-node subjects NPE-crashed whole list responses (now skipped).
• Soft-deleted projects/branches/tags remained retrievable by id (now 404); POST /projects with an existing @id silently overwrote the project via the underlying PUT (now 409).
• RDF escaping missed carriage returns (a \r in any string failed the whole commit with an opaque upstream parse error); element @ids (subject and references) are validated before interpolation into SPARQL IRI positions.
• CORS was anyHost() with allowCredentials = true: any website could make credentialed cross-origin requests replaying a logged-in user's Authorization header. Origins are now configurable via FLEXO_CORS_ALLOWED_ORIGINS; without configuration the API still answers any origin but credentialed cross-origin requests are disabled.

Housekeeping

• Minor/patch dependency bumps (Ktor 3.5.1, Jena 6.1.0, Kotest 6.2.2, logback 1.5.38, coroutines-test 1.11.0, java-jwt 4.6.0, JaCoCo 0.8.15); major migrations (Gradle 9, Kotlin 2.4, Sonar plugin 7) deliberately deferred.
• README cp command fix.

Test plan

• docker compose -f src/test/resources/docker-compose.yml up -d
• ./gradlew test — 55 tests, 0 failures (new suites: QueryResultsTest, ElementArrayTest, DeleteElementTest, ForwardHeadersTest, NegativePathTest, SoftDeleteTest, EscapingTest, BranchListPairingTest)

🤖 Generated with Claude Code