Read-gate the projection list and canonicalize its casing

Two PR-review fixes to the RDF export resolution path:

* The unknown-projection 400 listed every Mapping page title from the raw DB
  query, leaking the titles of read-restricted Mapping pages. ExportPageRdfApi
  now filters the list by the caller's own read permission
  (NeoWikiExtension::filterReadableProjectionNames), mirroring the Schema read
  filter (DatabaseSchemaNameLookup). The system-context getRdfProjectionNames()
  used by DumpRdf and the SPARQL store stays unfiltered.

* WikiPageMappingLookup::getMapping() now names the returned Mapping from the
  resolved Title's text rather than the requested string, so ?projection=eDM and
  ?projection=EDM (the same Mapping:EDM page) mint the same projector, serializer,
  and named-graph IRI.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: JeroenDeDauw

src/EntryPoints/REST/ExportPageRdfApi.php

@@ -34,9 +34,17 @@ public function run( int $pageId ): Response {
 		$resolution = $extension->resolveRdfProjection( $projectionName );
 
 		if ( $resolution->projection === null ) {
+			// Read-filter the known-projection list with the caller's own authority, so the 400 never
+			// leaks the titles of Mapping pages they may not read — the same gate placement as the
+			// per-page read check below.
+			$knownProjections = $extension->filterReadableProjectionNames(
+				$resolution->knownProjectionNames,
+				$this->getAuthority()
+			);
+
 			return $this->getResponseFactory()->createHttpError( 400, [
 				'message' => 'Unknown RDF projection: "' . $projectionName . '". Known projections: '
-					. implode( ', ', $resolution->knownProjectionNames ) . '.',
+					. implode( ', ', $knownProjections ) . '.',
 			] );
 		}
 

src/NeoWikiExtension.php

@@ -404,6 +404,35 @@ public function getRdfProjectionNames(): array {
 		);
 	}
 
+	/**
+	 * The known projection names the given authority may read, for the REST 400 body. "native" is not a
+	 * page and is always kept; a Mapping name is kept only when its page is readable, so a read-restricted
+	 * Mapping page's title never leaks into the error (#1046, mirroring the Schema
+	 * {@see \ProfessionalWiki\NeoWiki\Persistence\MediaWiki\DatabaseSchemaNameLookup} read filter). This is
+	 * the REST boundary; the system-context {@see self::getRdfProjectionNames()} used by DumpRdf and the
+	 * SPARQL store stays unfiltered.
+	 *
+	 * @param string[] $names
+	 * @return string[]
+	 */
+	public function filterReadableProjectionNames( array $names, Authority $authority ): array {
+		$readAuthorizer = $this->newPageReadAuthorizer( $authority );
+		$titleFactory = MediaWikiServices::getInstance()->getTitleFactory();
+
+		return array_values( array_filter(
+			$names,
+			static function ( string $name ) use ( $readAuthorizer, $titleFactory ): bool {
+				if ( $name === RdfPageProjector::PROJECTION ) {
+					return true;
+				}
+
+				$title = $titleFactory->newFromText( $name, NeoWikiExtension::NS_MAPPING );
+
+				return $title !== null && $readAuthorizer->authorizeReadByPageTitle( $title );
+			}
+		) );
+	}
+
 	/**
 	 * The native prefixes (Subject IRIs stay native) plus the Mapping's declared ontology prefixes, for
 	 * readable output. Unsafe prefix namespaces are dropped defensively so a Mapping can never inject a
@@ -429,6 +458,7 @@ public function getMappingLookup(): MappingLookup {
 				pageContentFetcher: $this->getPageContentFetcher(),
 				authority: $this->getRequestAuthority(),
 				mappingDeserializer: $this->getMappingPersistenceDeserializer(),
+				titleParser: MediaWikiServices::getInstance()->getTitleParser(),
 			),
 			cache: MediaWikiServices::getInstance()->getMainWANObjectCache(),
 			titleFactory: MediaWikiServices::getInstance()->getTitleFactory(),

src/Persistence/MediaWiki/WikiPageMappingLookup.php

@@ -7,6 +7,8 @@
 use InvalidArgumentException;
 use LogicException;
 use MediaWiki\Permissions\Authority;
+use MediaWiki\Title\MalformedTitleException;
+use MediaWiki\Title\TitleParser;
 use ProfessionalWiki\NeoWiki\Application\MappingLookup;
 use ProfessionalWiki\NeoWiki\Domain\Mapping\Mapping;
 use ProfessionalWiki\NeoWiki\Domain\Mapping\MappingName;
@@ -19,6 +21,7 @@ public function __construct(
 		private readonly PageContentFetcher $pageContentFetcher,
 		private readonly Authority $authority,
 		private readonly MappingPersistenceDeserializer $mappingDeserializer,
+		private readonly TitleParser $titleParser,
 	) {
 	}
 
@@ -30,13 +33,30 @@ public function getMapping( MappingName $name ): ?Mapping {
 		}
 
 		try {
-			return $this->mappingDeserializer->deserialize( $name, $content->getText() );
+			return $this->mappingDeserializer->deserialize( $this->canonicalName( $name ), $content->getText() );
 		}
 		catch ( InvalidArgumentException ) {
 			return null;
 		}
 	}
 
+	/**
+	 * The requested name normalized to its Mapping page's canonical title text — MediaWiki capitalizes
+	 * the first letter — so a projection requested as "eDM" and one requested as "EDM" (the same page)
+	 * mint the same projector, serializer, and named-graph IRI. The content fetch already succeeded, so
+	 * the title parses; the guard is defensive.
+	 */
+	private function canonicalName( MappingName $name ): MappingName {
+		try {
+			return new MappingName(
+				$this->titleParser->parseTitle( $name->getText(), NeoWikiExtension::NS_MAPPING )->getText()
+			);
+		}
+		catch ( MalformedTitleException ) {
+			return $name;
+		}
+	}
+
 	private function getContent( MappingName $name ): ?MappingContent {
 		$content = $this->pageContentFetcher->getPageContent(
 			$name->getText(),

tests/phpunit/EntryPoints/REST/ExportPageRdfApiTest.php

@@ -241,6 +241,45 @@ public function testProjectionNameIsTheMappingPageTitle(): void {
 		$this->assertSame( 400, $this->export( query: [ 'projection' => 'edm' ] )->getStatusCode() );
 	}
 
+	public function testProjectionCasingResolvesToTheCanonicalMappingPageTitle(): void {
+		// MediaWiki capitalizes only the first title letter, so "eDM" and "EDM" are the same Mapping:EDM
+		// page. Both must mint the canonical "EDM" named graph, not one keyed on the requested casing.
+		$this->createEdmMapping();
+
+		$lowerFirst = $this->export( query: [ 'projection' => 'eDM' ] );
+		$exact = $this->export( query: [ 'projection' => 'EDM' ] );
+
+		$this->assertSame( 200, $lowerFirst->getStatusCode() );
+		$this->assertSame( 200, $exact->getStatusCode() );
+		$this->assertStringEndsWith(
+			'/graph/EDM/page/' . $this->pageId,
+			$this->soleGraphIn( $lowerFirst->getBody()->getContents() ),
+			'A projection requested with non-canonical casing still mints the canonical named graph.'
+		);
+		$this->assertStringEndsWith(
+			'/graph/EDM/page/' . $this->pageId,
+			$this->soleGraphIn( $exact->getBody()->getContents() )
+		);
+	}
+
+	public function testReadRestrictedMappingNamesAreAbsentFromTheKnownProjectionsList(): void {
+		// The 400 list must not leak the titles of Mapping pages the caller cannot read (#1046). A caller
+		// that can read the page sees "EDM"; one that cannot must not — though "native" (not a page) stays.
+		$this->createEdmMapping();
+
+		$readable = $this->export( query: [ 'projection' => 'bogus' ] );
+		$restricted = $this->export(
+			query: [ 'projection' => 'bogus' ],
+			authority: $this->authorityWithGlobalReadButNoPageRead()
+		);
+
+		$this->assertStringContainsString( 'EDM', $readable->getBody()->getContents() );
+
+		$restrictedBody = $restricted->getBody()->getContents();
+		$this->assertStringNotContainsString( 'EDM', $restrictedBody, 'A read-restricted Mapping page name must not leak into the 400 list.' );
+		$this->assertStringContainsString( 'native', $restrictedBody, 'The always-available native projection stays listed.' );
+	}
+
 	/**
 	 * The export surface is where the projection name selected by the request reaches the projector that
 	 * mints the graph (#1053). Asserting the graph IRI here, rather than only on the projector, is what