Application.java

/**
 *  Copyright 2019 Martynas Jusevičius <martynas@atomgraph.com>
 *
 *  Licensed under the Apache License, Version 2.0 (the "License");
 *  you may not use this file except in compliance with the License.
 *  You may obtain a copy of the License at
 *
 *     http://www.apache.org/licenses/LICENSE-2.0
 *
 *  Unless required by applicable law or agreed to in writing, software
 *  distributed under the License is distributed on an "AS IS" BASIS,
 *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 *  See the License for the specific language governing permissions and
 *  limitations under the License.
 *
 */
package com.atomgraph.linkeddatahub;

import com.atomgraph.linkeddatahub.server.mapper.HttpHostConnectExceptionMapper;
import com.atomgraph.linkeddatahub.server.mapper.InternalURLExceptionMapper;
import com.atomgraph.linkeddatahub.server.mapper.MessagingExceptionMapper;
import com.atomgraph.linkeddatahub.server.mapper.auth.webid.WebIDLoadingExceptionMapper;
import com.atomgraph.linkeddatahub.server.mapper.auth.webid.InvalidWebIDURIExceptionMapper;
import com.atomgraph.linkeddatahub.server.mapper.auth.AuthorizationExceptionMapper;
import com.atomgraph.linkeddatahub.server.mapper.auth.AuthenticationExceptionMapper;
import com.atomgraph.linkeddatahub.server.mapper.ForbiddenExceptionMapper;
import com.atomgraph.linkeddatahub.server.mapper.auth.webid.WebIDCertificateExceptionMapper;
import com.atomgraph.client.MediaTypes;
import com.atomgraph.client.locator.PrefixMapper;
import org.apache.jena.ontology.OntDocumentManager;
import org.apache.jena.util.FileManager;
import org.apache.jena.util.LocationMapper;
import jakarta.annotation.PostConstruct;
import jakarta.servlet.ServletConfig;
import jakarta.ws.rs.core.Context;
import org.apache.jena.riot.Lang;
import org.apache.jena.riot.RDFFormat;
import org.apache.jena.riot.RDFWriterRegistry;
import com.atomgraph.client.mapper.ClientErrorExceptionMapper;
import com.atomgraph.client.util.DataManager;
import com.atomgraph.client.util.DataManagerImpl;
import com.atomgraph.client.vocabulary.AC;
import com.atomgraph.client.writer.function.UUID;
import com.atomgraph.core.exception.ConfigurationException;
import com.atomgraph.core.io.DatasetProvider;
import com.atomgraph.core.io.ModelProvider;
import com.atomgraph.core.io.QueryProvider;
import com.atomgraph.core.io.ResultSetProvider;
import com.atomgraph.core.io.UpdateRequestProvider;
import com.atomgraph.core.mapper.BadGatewayExceptionMapper;
import com.atomgraph.core.provider.QueryParamProvider;
import com.atomgraph.linkeddatahub.writer.factory.DataManagerFactory;
import com.atomgraph.server.vocabulary.LDT;
import com.atomgraph.server.mapper.NotFoundExceptionMapper;
import com.atomgraph.core.riot.RDFLanguages;
import com.atomgraph.core.riot.lang.RDFPostReaderFactory;
import com.atomgraph.core.vocabulary.A;
import com.atomgraph.linkeddatahub.server.mapper.auth.webid.InvalidWebIDPublicKeyExceptionMapper;
import com.atomgraph.linkeddatahub.server.mapper.ModelExceptionMapper;
import com.atomgraph.linkeddatahub.server.mapper.OntClassNotFoundExceptionMapper;
import com.atomgraph.linkeddatahub.server.mapper.jena.QueryExecExceptionMapper;
import com.atomgraph.linkeddatahub.server.mapper.jena.RiotParseExceptionMapper;
import com.atomgraph.linkeddatahub.apps.model.AdminApplication;
import com.atomgraph.linkeddatahub.model.auth.Agent;
import com.atomgraph.linkeddatahub.model.CSVImport;
import com.atomgraph.linkeddatahub.apps.model.EndUserApplication;
import com.atomgraph.linkeddatahub.model.Service;
import com.atomgraph.linkeddatahub.writer.factory.xslt.XsltExecutableSupplier;
import com.atomgraph.linkeddatahub.writer.factory.XsltExecutableSupplierFactory;
import com.atomgraph.client.util.XsltResolver;
import com.atomgraph.linkeddatahub.client.GraphStoreClient;
import com.atomgraph.linkeddatahub.client.filter.ClientUriRewriteFilter;
import com.atomgraph.linkeddatahub.client.filter.JSONGRDDLFilter;
import com.atomgraph.linkeddatahub.client.filter.JSONGRDDLFilterProvider;
import com.atomgraph.linkeddatahub.imports.ImportExecutor;
import com.atomgraph.linkeddatahub.io.HtmlJsonLDReaderFactory;
import com.atomgraph.linkeddatahub.io.JsonLDReader;
import com.atomgraph.linkeddatahub.listener.EMailListener;
import com.atomgraph.linkeddatahub.writer.ModelXSLTWriter;
import com.atomgraph.linkeddatahub.model.Import;
import com.atomgraph.linkeddatahub.model.RDFImport;
import com.atomgraph.linkeddatahub.model.UserAccount;
import com.atomgraph.linkeddatahub.model.auth.Authorization;
import com.atomgraph.linkeddatahub.server.mapper.auth.webid.WebIDDelegationExceptionMapper;
import com.atomgraph.linkeddatahub.model.auth.impl.AgentImpl;
import com.atomgraph.linkeddatahub.model.auth.impl.AuthorizationImpl;
import com.atomgraph.linkeddatahub.model.impl.CSVImportImpl;
import com.atomgraph.linkeddatahub.model.impl.FileImpl;
import com.atomgraph.linkeddatahub.model.impl.ImportImpl;
import com.atomgraph.linkeddatahub.model.impl.RDFImportImpl;
import com.atomgraph.linkeddatahub.model.impl.UserAccountImpl;
import com.atomgraph.linkeddatahub.server.event.AuthorizationCreated;
import com.atomgraph.linkeddatahub.server.event.SignUp;
import com.atomgraph.linkeddatahub.server.factory.AgentContextFactory;
import com.atomgraph.linkeddatahub.server.factory.ApplicationFactory;
import com.atomgraph.linkeddatahub.server.factory.AuthorizationContextFactory;
import com.atomgraph.linkeddatahub.server.filter.request.ApplicationFilter;
import com.atomgraph.linkeddatahub.server.filter.request.auth.WebIDFilter;
import com.atomgraph.linkeddatahub.server.io.ValidatingModelProvider;
import com.atomgraph.server.mapper.ConfigurationExceptionMapper;
import com.atomgraph.linkeddatahub.server.factory.OntologyFactory;
import com.atomgraph.linkeddatahub.server.factory.ServiceFactory;
import com.atomgraph.linkeddatahub.server.filter.request.OntologyFilter;
import com.atomgraph.linkeddatahub.server.filter.request.ProxyRequestFilter;
import com.atomgraph.linkeddatahub.server.filter.request.AuthorizationFilter;
import com.atomgraph.linkeddatahub.server.filter.request.ContentLengthLimitFilter;
import com.atomgraph.linkeddatahub.server.filter.request.auth.ProxiedWebIDFilter;
import com.atomgraph.linkeddatahub.server.filter.response.CORSFilter;
import com.atomgraph.linkeddatahub.server.filter.response.ResponseHeadersFilter;
import com.atomgraph.linkeddatahub.server.filter.response.CacheInvalidationFilter;
import com.atomgraph.linkeddatahub.server.filter.response.XsltExecutableFilter;
import com.atomgraph.linkeddatahub.server.interceptor.RDFPostMediaTypeInterceptor;
import com.atomgraph.linkeddatahub.server.mapper.auth.oauth2.TokenExpiredExceptionMapper;
import com.atomgraph.linkeddatahub.server.model.impl.Dispatcher;
import com.atomgraph.linkeddatahub.server.security.AgentContext;
import com.atomgraph.linkeddatahub.server.security.AuthorizationContext;
import com.atomgraph.linkeddatahub.server.util.MessageBuilder;
import com.atomgraph.linkeddatahub.server.util.URLValidator;
import com.atomgraph.linkeddatahub.vocabulary.ACL;
import com.atomgraph.linkeddatahub.vocabulary.FOAF;
import com.atomgraph.linkeddatahub.vocabulary.LDH;
import com.atomgraph.linkeddatahub.vocabulary.LDHC;
import com.atomgraph.linkeddatahub.vocabulary.Google;
import com.atomgraph.linkeddatahub.vocabulary.ORCID;
import com.atomgraph.linkeddatahub.vocabulary.LAPP;
import com.atomgraph.linkeddatahub.writer.Mode;
import com.atomgraph.linkeddatahub.writer.ResultSetXSLTWriter;
import com.atomgraph.linkeddatahub.writer.XSLTWriterBase;
import com.atomgraph.linkeddatahub.writer.factory.ModeFactory;
import com.atomgraph.linkeddatahub.writer.function.DecodeURI;
import com.atomgraph.server.mapper.NotAcceptableExceptionMapper;
import com.atomgraph.server.mapper.OntologyExceptionMapper;
import com.atomgraph.server.mapper.jena.DatatypeFormatExceptionMapper;
import com.atomgraph.server.mapper.jena.QueryParseExceptionMapper;
import com.atomgraph.server.mapper.jena.RiotExceptionMapper;
import com.google.common.eventbus.EventBus;
import com.google.common.eventbus.Subscribe;
import org.apache.jena.enhanced.BuiltinPersonalities;
import org.apache.jena.ontology.OntModelSpec;
import org.apache.jena.riot.RDFParserRegistry;
import org.slf4j.Logger;
import java.net.URI;
import java.io.FileInputStream;
import java.io.FileNotFoundException;
import java.io.IOException;
import java.io.InputStream;
import java.net.MalformedURLException;
import java.net.URISyntaxException;
import java.security.KeyManagementException;
import java.security.KeyStore;
import java.security.KeyStoreException;
import java.security.NoSuchAlgorithmException;
import java.security.UnrecoverableKeyException;
import java.security.cert.Certificate;
import java.security.cert.CertificateException;
import java.security.cert.X509Certificate;
import java.util.HashMap;
import java.util.ServiceLoader;
import java.util.Map;
import java.util.Properties;
import jakarta.mail.Authenticator;
import jakarta.mail.PasswordAuthentication;
import javax.net.ssl.KeyManagerFactory;
import javax.net.ssl.SSLContext;
import javax.net.ssl.TrustManagerFactory;
import jakarta.servlet.ServletContext;
import javax.xml.transform.Source;
import org.apache.jena.ontology.Ontology;
import org.apache.jena.query.Dataset;
import org.apache.jena.query.Query;
import org.apache.jena.query.QueryExecution;
import org.apache.jena.query.QueryFactory;
import org.apache.jena.rdf.model.Model;
import org.apache.jena.riot.RDFDataMgr;
import org.slf4j.LoggerFactory;
import com.atomgraph.server.mapper.SHACLConstraintViolationExceptionMapper;
import com.atomgraph.server.mapper.SPINConstraintViolationExceptionMapper;
import com.atomgraph.spinrdf.vocabulary.SP;
import com.github.jsonldjava.core.DocumentLoader;
import com.github.jsonldjava.core.JsonLdOptions;
import java.io.FileOutputStream;
import java.io.UnsupportedEncodingException;
import java.nio.charset.StandardCharsets;
import java.security.MessageDigest;
import java.util.Arrays;
import java.util.List;
import java.util.Locale;
import java.util.Optional;
import java.util.TreeMap;
import java.util.concurrent.ExecutorService;
import java.util.concurrent.Executors;
import java.util.concurrent.TimeUnit;
import java.util.stream.Collectors;
import jakarta.mail.Address;
import jakarta.mail.MessagingException;
import jakarta.mail.internet.AddressException;
import jakarta.mail.internet.InternetAddress;
import jakarta.ws.rs.InternalServerErrorException;
import jakarta.ws.rs.client.Client;
import jakarta.ws.rs.client.ClientBuilder;
import jakarta.ws.rs.client.ClientRequestFilter;
import jakarta.ws.rs.core.Response;
import java.util.concurrent.ConcurrentHashMap;
import javax.xml.parsers.ParserConfigurationException;
import javax.xml.transform.TransformerException;
import javax.xml.transform.stream.StreamSource;
import net.jodah.expiringmap.ExpiringMap;
import net.sf.saxon.om.TreeInfo;
import net.sf.saxon.s9api.Processor;
import net.sf.saxon.s9api.QName;
import net.sf.saxon.s9api.SaxonApiException;
import net.sf.saxon.s9api.XdmAtomicValue;
import net.sf.saxon.s9api.XsltCompiler;
import net.sf.saxon.s9api.XsltExecutable;
import org.apache.http.HttpClientConnection;
import org.apache.http.HttpHost;
import org.apache.http.client.HttpRequestRetryHandler;
import org.apache.http.config.Registry;
import org.apache.http.config.RegistryBuilder;
import org.apache.http.conn.socket.ConnectionSocketFactory;
import org.apache.http.conn.socket.PlainConnectionSocketFactory;
import org.apache.http.conn.ssl.NoopHostnameVerifier;
import org.apache.http.conn.ssl.SSLConnectionSocketFactory;
import org.apache.http.impl.conn.PoolingHttpClientConnectionManager;
import org.apache.http.protocol.HttpContext;
import org.apache.http.protocol.HttpCoreContext;
import org.apache.jena.query.DatasetFactory;
import org.apache.jena.rdf.model.ModelFactory;
import org.apache.jena.rdf.model.ResIterator;
import org.apache.jena.rdf.model.Resource;
import org.apache.jena.riot.resultset.ResultSetLang;
import org.apache.jena.riot.system.ErrorHandlerFactory;
import org.apache.jena.riot.system.ParserProfile;
import org.apache.jena.riot.system.RiotLib;
import org.apache.jena.sparql.graph.GraphReadOnly;
import org.apache.jena.vocabulary.DCTerms;
import org.apache.jena.vocabulary.LocationMappingVocab;
import org.apache.jena.vocabulary.RDF;
import org.glassfish.hk2.api.TypeLiteral;
import org.glassfish.hk2.utilities.binding.AbstractBinder;
import org.glassfish.jersey.client.ClientConfig;
import org.glassfish.jersey.apache.connector.ApacheClientProperties;
import org.glassfish.jersey.apache.connector.ApacheConnectorProvider;
import org.glassfish.jersey.client.ClientProperties;
import org.glassfish.jersey.client.RequestEntityProcessing;
import org.glassfish.jersey.media.multipart.MultiPartFeature;
import org.glassfish.jersey.process.internal.RequestScoped;
import org.glassfish.jersey.server.ResourceConfig;
import org.glassfish.jersey.server.filter.HttpMethodOverrideFilter;
import org.glassfish.jersey.uri.UriComponent;
import org.xml.sax.SAXException;

/**
 * JAX-RS application subclass.
 * Used to configure the JAX-RS web application in <code>web.xml</code>.
 * 
 * @author Martynas Jusevičius {@literal <martynas@atomgraph.com>}
 * @see <a href="https://jersey.github.io/documentation/1.19.1/jax-rs.html#d4e186">Deploying a RESTful Web Service</a>
 */
public class Application extends ResourceConfig
{

    private static final Logger log = LoggerFactory.getLogger(Application.class);

    /**
     * Path to the master XSLT stylesheet for server-side transformations.
     * Package stylesheets are imported into this master stylesheet.
     */
    public static final String MASTER_STYLESHEET_PATH = "/static/xsl/layout.xsl";

    private final ExecutorService importThreadPool;
    private final ServletConfig servletConfig;
    private final EventBus eventBus = new EventBus();
    private final DataManager dataManager;
    private final Map<String, OntModelSpec> endUserOntModelSpecs;
    private final MediaTypes mediaTypes;
    private final Client client, externalClient, importClient, noCertClient;
    private final Query documentTypeQuery, documentOwnerQuery, aclQuery, ownerAclQuery, webIDQuery, agentQuery, userAccountQuery, ontologyQuery; // no relative URIs
    private final Integer maxGetRequestSize;
    private final boolean preemptiveAuth;
    private final Processor xsltProc = new Processor(false);
    private final XsltCompiler xsltComp;
    private final XsltExecutable xsltExec;
    private final OntModelSpec ontModelSpec;
    private final boolean cacheStylesheet;
    private final boolean resolvingUncached;
    private final URI baseURI, uploadRoot;
    private final boolean invalidateCache;
    private final Integer cookieMaxAge;
    private final boolean enableLinkedDataProxy;
    private final boolean allowInternalUrls;
    private final URLValidator urlValidator;
    private final Integer maxContentLength;
    private final Address notificationAddress;
    private final Authenticator authenticator;
    private final Properties emailProperties = new Properties();
    private final KeyStore keyStore, trustStore;
    private final URI secretaryWebIDURI;
    private final List<Locale> supportedLanguages;
    private final ExpiringMap<URI, Model> webIDmodelCache = ExpiringMap.builder().expiration(1, TimeUnit.DAYS).build(); // TO-DO: config for the expiration period?
    private final ExpiringMap<String, Model> oidcModelCache = ExpiringMap.builder().variableExpiration().build();
    private final ExpiringMap<String, jakarta.json.JsonObject> jwksCache = ExpiringMap.builder().expiration(1, TimeUnit.DAYS).build(); // Cache JWKS responses
    private final Map<URI, XsltExecutable> xsltExecutableCache = new ConcurrentHashMap<>();
    private final MessageDigest messageDigest;
    private final boolean enableWebIDSignUp;
    private final String oidcRefreshTokensPropertiesPath;
    private final Properties oidcRefreshTokens;
    private final URI contextDatasetURI;
    private final Dataset contextDataset;
    private final URI frontendProxy;
    private final URI backendProxyAdmin;
    private final URI backendProxyEndUser;
    private Map<String, com.atomgraph.linkeddatahub.model.ServiceContext> serviceContextMap;

    /**
     * Constructs system application and configures it using sevlet config.
     * 
     * @param servletConfig servlet config
     * @throws URISyntaxException throw on URI syntax errors
     * @throws MalformedURLException thrown on URL syntax errors
     * @throws IOException thrown on I/O errors
     */
    public Application(@Context ServletConfig servletConfig) throws URISyntaxException, MalformedURLException, IOException
    {
        this(servletConfig,
            new MediaTypes(),
            servletConfig.getServletContext().getInitParameter(A.maxGetRequestSize.getURI()) != null ? Integer.valueOf(servletConfig.getServletContext().getInitParameter(A.maxGetRequestSize.getURI())) : null,
            servletConfig.getServletContext().getInitParameter(A.cacheModelLoads.getURI()) != null ? Boolean.parseBoolean(servletConfig.getServletContext().getInitParameter(A.cacheModelLoads.getURI())) : true,
            servletConfig.getServletContext().getInitParameter(A.preemptiveAuth.getURI()) != null ? Boolean.parseBoolean(servletConfig.getServletContext().getInitParameter(A.preemptiveAuth.getURI())) : false,
            new PrefixMapper(servletConfig.getServletContext().getInitParameter(AC.prefixMapping.getURI()) != null ? servletConfig.getServletContext().getInitParameter(AC.prefixMapping.getURI()) : null),
            servletConfig.getServletContext().getInitParameter(LDHC.contextDataset.getURI()) != null ? servletConfig.getServletContext().getInitParameter(LDHC.contextDataset.getURI()) : null,
            com.atomgraph.client.Application.getSource(servletConfig.getServletContext(), servletConfig.getServletContext().getInitParameter(AC.stylesheet.getURI()) != null ? servletConfig.getServletContext().getInitParameter(AC.stylesheet.getURI()) : null),
            servletConfig.getServletContext().getInitParameter(AC.cacheStylesheet.getURI()) != null ? Boolean.parseBoolean(servletConfig.getServletContext().getInitParameter(AC.cacheStylesheet.getURI())) : false,
            servletConfig.getServletContext().getInitParameter(AC.resolvingUncached.getURI()) != null ? Boolean.parseBoolean(servletConfig.getServletContext().getInitParameter(AC.resolvingUncached.getURI())) : true,
            servletConfig.getServletContext().getInitParameter(LDHC.clientKeyStore.getURI()) != null ? servletConfig.getServletContext().getInitParameter(LDHC.clientKeyStore.getURI()) : null,
            servletConfig.getServletContext().getInitParameter(LDHC.clientKeyStorePassword.getURI()) != null ? servletConfig.getServletContext().getInitParameter(LDHC.clientKeyStorePassword.getURI()) : null,
            servletConfig.getServletContext().getInitParameter(LDHC.secretaryCertAlias.getURI()) != null ? servletConfig.getServletContext().getInitParameter(LDHC.secretaryCertAlias.getURI()) : null,
            servletConfig.getServletContext().getInitParameter(LDHC.clientTrustStore.getURI()) != null ? servletConfig.getServletContext().getInitParameter(LDHC.clientTrustStore.getURI()) : null,
            servletConfig.getServletContext().getInitParameter(LDHC.clientTrustStorePassword.getURI()) != null ? servletConfig.getServletContext().getInitParameter(LDHC.clientTrustStorePassword.getURI()) : null,
            servletConfig.getServletContext().getInitParameter(LDHC.documentTypeQuery.getURI()) != null ? servletConfig.getServletContext().getInitParameter(LDHC.documentTypeQuery.getURI()) : null,
            servletConfig.getServletContext().getInitParameter(LDHC.documentOwnerQuery.getURI()) != null ? servletConfig.getServletContext().getInitParameter(LDHC.documentOwnerQuery.getURI()) : null,
            servletConfig.getServletContext().getInitParameter(LDHC.aclQuery.getURI()) != null ? servletConfig.getServletContext().getInitParameter(LDHC.aclQuery.getURI()) : null,
            servletConfig.getServletContext().getInitParameter(LDHC.ownerAclQuery.getURI()) != null ? servletConfig.getServletContext().getInitParameter(LDHC.ownerAclQuery.getURI()) : null,
            servletConfig.getServletContext().getInitParameter(LDHC.webIDQuery.getURI()) != null ? servletConfig.getServletContext().getInitParameter(LDHC.webIDQuery.getURI()) : null,
            servletConfig.getServletContext().getInitParameter(LDHC.agentQuery.getURI()) != null ? servletConfig.getServletContext().getInitParameter(LDHC.agentQuery.getURI()) : null,
            servletConfig.getServletContext().getInitParameter(LDHC.userAccountQuery.getURI()) != null ? servletConfig.getServletContext().getInitParameter(LDHC.userAccountQuery.getURI()) : null,
            servletConfig.getServletContext().getInitParameter(LDHC.ontologyQuery.getURI()) != null ? servletConfig.getServletContext().getInitParameter(LDHC.ontologyQuery.getURI()) : null,
            servletConfig.getServletContext().getInitParameter(LDHC.baseUri.getURI()) != null ? servletConfig.getServletContext().getInitParameter(LDHC.baseUri.getURI()) : null,
            servletConfig.getServletContext().getInitParameter(LDHC.proxyScheme.getURI()) != null ? servletConfig.getServletContext().getInitParameter(LDHC.proxyScheme.getURI()) : null,
            servletConfig.getServletContext().getInitParameter(LDHC.proxyHost.getURI()) != null ? servletConfig.getServletContext().getInitParameter(LDHC.proxyHost.getURI()) : null,
            servletConfig.getServletContext().getInitParameter(LDHC.proxyPort.getURI()) != null ? Integer.valueOf(servletConfig.getServletContext().getInitParameter(LDHC.proxyPort.getURI())) : null,
            servletConfig.getServletContext().getInitParameter(LDHC.uploadRoot.getURI()) != null ? servletConfig.getServletContext().getInitParameter(LDHC.uploadRoot.getURI()) : null,
            servletConfig.getServletContext().getInitParameter(LDHC.invalidateCache.getURI()) != null ? Boolean.parseBoolean(servletConfig.getServletContext().getInitParameter(LDHC.invalidateCache.getURI())) : false,
            servletConfig.getServletContext().getInitParameter(LDHC.cookieMaxAge.getURI()) != null ? Integer.valueOf(servletConfig.getServletContext().getInitParameter(LDHC.cookieMaxAge.getURI())) : null,
            servletConfig.getServletContext().getInitParameter(LDHC.enableLinkedDataProxy.getURI()) != null ? Boolean.parseBoolean(servletConfig.getServletContext().getInitParameter(LDHC.enableLinkedDataProxy.getURI())) : true,
            System.getProperty("com.atomgraph.linkeddatahub.allowInternalUrls") != null ? Boolean.parseBoolean(System.getProperty("com.atomgraph.linkeddatahub.allowInternalUrls")) :
            servletConfig.getServletContext().getInitParameter(LDHC.allowInternalUrls.getURI()) != null ? Boolean.parseBoolean(servletConfig.getServletContext().getInitParameter(LDHC.allowInternalUrls.getURI())) : false,
            servletConfig.getServletContext().getInitParameter(LDHC.maxContentLength.getURI()) != null ? Integer.valueOf(servletConfig.getServletContext().getInitParameter(LDHC.maxContentLength.getURI())) : null,
            servletConfig.getServletContext().getInitParameter(LDHC.maxConnPerRoute.getURI()) != null ? Integer.valueOf(servletConfig.getServletContext().getInitParameter(LDHC.maxConnPerRoute.getURI())) : null,
            servletConfig.getServletContext().getInitParameter(LDHC.maxTotalConn.getURI()) != null ? Integer.valueOf(servletConfig.getServletContext().getInitParameter(LDHC.maxTotalConn.getURI())) : null,
            servletConfig.getServletContext().getInitParameter(LDHC.maxRequestRetries.getURI()) != null ? Integer.valueOf(servletConfig.getServletContext().getInitParameter(LDHC.maxRequestRetries.getURI())) : null,
            servletConfig.getServletContext().getInitParameter(LDHC.maxImportThreads.getURI()) != null ? Integer.valueOf(servletConfig.getServletContext().getInitParameter(LDHC.maxImportThreads.getURI())) : null,
            servletConfig.getServletContext().getInitParameter(LDHC.notificationAddress.getURI()) != null ? servletConfig.getServletContext().getInitParameter(LDHC.notificationAddress.getURI()) : null,
            servletConfig.getServletContext().getInitParameter(LDHC.supportedLanguages.getURI()) != null ? servletConfig.getServletContext().getInitParameter(LDHC.supportedLanguages.getURI()) : null,
            servletConfig.getServletContext().getInitParameter(LDHC.enableWebIDSignUp.getURI()) != null ? Boolean.parseBoolean(servletConfig.getServletContext().getInitParameter(LDHC.enableWebIDSignUp.getURI())) : true,
            servletConfig.getServletContext().getInitParameter(LDHC.oidcRefreshTokens.getURI()),
            servletConfig.getServletContext().getInitParameter(LDHC.frontendProxy.getURI()) != null ? servletConfig.getServletContext().getInitParameter(LDHC.frontendProxy.getURI()) : null,
            servletConfig.getServletContext().getInitParameter(LDHC.backendProxyAdmin.getURI()) != null ? servletConfig.getServletContext().getInitParameter(LDHC.backendProxyAdmin.getURI()) : null,
            servletConfig.getServletContext().getInitParameter(LDHC.backendProxyEndUser.getURI()) != null ? servletConfig.getServletContext().getInitParameter(LDHC.backendProxyEndUser.getURI()) : null,
            servletConfig.getServletContext().getInitParameter("mail.user") != null ? servletConfig.getServletContext().getInitParameter("mail.user") : null,
            servletConfig.getServletContext().getInitParameter("mail.password") != null ? servletConfig.getServletContext().getInitParameter("mail.password") : null,
            servletConfig.getServletContext().getInitParameter("mail.smtp.host") != null ? servletConfig.getServletContext().getInitParameter("mail.smtp.host") : null,
            servletConfig.getServletContext().getInitParameter("mail.smtp.port") != null ? servletConfig.getServletContext().getInitParameter("mail.smtp.port") : null,
            servletConfig.getServletContext().getInitParameter(Google.clientID.getURI()) != null ? servletConfig.getServletContext().getInitParameter(Google.clientID.getURI()) : null,
            servletConfig.getServletContext().getInitParameter(Google.clientSecret.getURI()) != null ? servletConfig.getServletContext().getInitParameter(Google.clientSecret.getURI()) : null,
            servletConfig.getServletContext().getInitParameter(ORCID.clientID.getURI()) != null ? servletConfig.getServletContext().getInitParameter(ORCID.clientID.getURI()) : null,
            servletConfig.getServletContext().getInitParameter(ORCID.clientSecret.getURI()) != null ? servletConfig.getServletContext().getInitParameter(ORCID.clientSecret.getURI()) : null
        );
    }
    
    /**
     * Constructs and configures system application.
     * 
     * @param servletConfig servlet config
     * @param mediaTypes supported media types
     * @param maxGetRequestSize maximum <code>GET</code> request size
     * @param cacheModelLoads true if model loads should be cached
     * @param preemptiveAuth true if HTTP Basic auth credentials should be sent preemptively
     * @param locationMapper Jena's <code>LocationMapper</code> instance
     * @param contextDatasetURIString location of the context dataset
     * @param stylesheet stylesheet URI
     * @param cacheStylesheet true if stylesheet should be cached
     * @param resolvingUncached true if XLST processor should dereference URLs that are not cached
     * @param clientKeyStoreURIString location of the client's keystore
     * @param clientKeyStorePassword client keystore's password
     * @param secretaryCertAlias alias of the secretary's certificate
     * @param clientTrustStoreURIString location of the client's truststore
     * @param clientTrustStorePassword client truststore's password
     * @param documentTypeQueryString SPARQL string of the document type query
     * @param documentOwnerQueryString SPARQL string of the document owner query
     * @param aclQueryString SPARQL string of the ACL query
     * @param ownerAclQueryString SPARQL string of the owner's ACL query
     * @param webIDQueryString SPARQL string of the WebID validation query
     * @param agentQueryString SPARQL string of the <code>Agent</code> lookup query
     * @param userAccountQueryString SPARQL string of the <code>UserAccount</code> lookup query
     * @param ontologyQueryString SPARQL string of the ontology load query
     * @param baseURIString system base URI
     * @param proxyScheme client's URI rewrite scheme
     * @param proxyHostname client's URI rewrite hostname
     * @param proxyPort client's URI rewrite port
     * @param uploadRootString location of the root folder for file uploads
     * @param invalidateCache true if Varnish proxy cache should be invalidated
     * @param cookieMaxAge max age of auth cookies
     * @param enableLinkedDataProxy true if Linked Data proxy is enabled
     * @param allowInternalUrls true if internal/private network URLs are allowed (disables SSRF protection)
     * @param maxContentLength maximum size of request entity
     * @param maxConnPerRoute maximum client connections per rout
     * @param maxTotalConn maximum total client connections
     * @param maxRequestRetries maximum number of times that the HTTP client will retry a request
     * @param maxImportThreads maximum number of threads used for asynchronous imports
     * @param notificationAddressString email address used to send notifications
     * @param supportedLanguageCodes comma-separated codes of supported languages
     * @param enableWebIDSignUp true if WebID signup is enabled
     * @param oidcRefreshTokensPropertiesPath path to the properties file with OIDC refresh tokens
     * @param mailUser username of the SMTP email server
     * @param mailPassword password of the SMTP email server
     * @param smtpHost hostname of the SMTP email server
     * @param smtpPort port of the SMTP email server
     * @param googleClientID client ID for Google's OAuth
     * @param googleClientSecret client secret for Google's OAuth
     * @param orcidClientID client ID for ORCID's OAuth
     * @param orcidClientSecret client secret for ORCID's OAuth
     * @param frontendProxyString frontend (Varnish) proxy URI used for cache invalidation BAN requests, or null
     * @param backendProxyAdminString backend proxy URI for the admin SPARQL service (endpoint URI rewriting + cache invalidation), or null
     * @param backendProxyEndUserString backend proxy URI for the end-user SPARQL service (endpoint URI rewriting + cache invalidation), or null
     */
    public Application(final ServletConfig servletConfig, final MediaTypes mediaTypes,
            final Integer maxGetRequestSize, final boolean cacheModelLoads, final boolean preemptiveAuth,
            final LocationMapper locationMapper, final String contextDatasetURIString,
            final Source stylesheet, final boolean cacheStylesheet, final boolean resolvingUncached,
            final String clientKeyStoreURIString, final String clientKeyStorePassword,
            final String secretaryCertAlias,
            final String clientTrustStoreURIString, final String clientTrustStorePassword,
            final String documentTypeQueryString, final String documentOwnerQueryString, final String aclQueryString, final String ownerAclQueryString,
            final String webIDQueryString, final String agentQueryString, final String userAccountQueryString, final String ontologyQueryString,
            final String baseURIString, final String proxyScheme, final String proxyHostname, final Integer proxyPort,
            final String uploadRootString, final boolean invalidateCache,
            final Integer cookieMaxAge, final boolean enableLinkedDataProxy, final boolean allowInternalUrls, final Integer maxContentLength,
            final Integer maxConnPerRoute, final Integer maxTotalConn, final Integer maxRequestRetries, final Integer maxImportThreads,
            final String notificationAddressString, final String supportedLanguageCodes, final boolean enableWebIDSignUp, final String oidcRefreshTokensPropertiesPath,
            final String frontendProxyString, final String backendProxyAdminString, final String backendProxyEndUserString,
            final String mailUser, final String mailPassword, final String smtpHost, final String smtpPort,
            final String googleClientID, final String googleClientSecret,
            final String orcidClientID, final String orcidClientSecret)
    {
        if (contextDatasetURIString == null)
        {
            if (log.isErrorEnabled()) log.error("Context dataset URI '{}' not configured", LDHC.contextDataset.getURI());
            throw new ConfigurationException(LDHC.contextDataset);
        }
        this.contextDatasetURI = URI.create(contextDatasetURIString);
        this.frontendProxy = frontendProxyString != null ? URI.create(frontendProxyString) : null;
        this.backendProxyAdmin = backendProxyAdminString != null ? URI.create(backendProxyAdminString) : null;
        this.backendProxyEndUser = backendProxyEndUserString != null ? URI.create(backendProxyEndUserString) : null;

        if (clientKeyStoreURIString == null)
        {
            if (log.isErrorEnabled()) log.error("Client key store ({}) not configured", LDHC.clientKeyStore.getURI());
            throw new ConfigurationException(LDHC.clientKeyStore);
        }

        if (secretaryCertAlias == null)
        {
            if (log.isErrorEnabled()) log.error("Secretary client certificate alias ({}) not configured", LDHC.secretaryCertAlias.getURI());
            throw new ConfigurationException(LDHC.secretaryCertAlias);
        }
        
        if (clientTrustStoreURIString == null)
        {
            if (log.isErrorEnabled()) log.error("Client truststore store ({}) not configured", LDHC.clientTrustStore.getURI());
            throw new ConfigurationException(LDHC.clientTrustStore);
        }
        
        if (documentTypeQueryString == null)
        {
            if (log.isErrorEnabled()) log.error("Document type SPARQL query is not configured properly");
            throw new ConfigurationException(LDHC.documentTypeQuery);
        }
        this.documentTypeQuery = QueryFactory.create(documentTypeQueryString);

        if (documentOwnerQueryString == null)
        {
            if (log.isErrorEnabled()) log.error("Document owner SPARQL query is not configured properly");
            throw new ConfigurationException(LDHC.documentOwnerQuery);
        }
        this.documentOwnerQuery = QueryFactory.create(documentOwnerQueryString);
        
        if (aclQueryString == null)
        {
            if (log.isErrorEnabled()) log.error("ACL SPARQL query is not configured properly");
            throw new ConfigurationException(LDHC.aclQuery);
        }
        this.aclQuery = QueryFactory.create(aclQueryString);
        
        if (ownerAclQueryString == null)
        {
            if (log.isErrorEnabled()) log.error("Owner's ACL SPARQL query is not configured properly");
            throw new ConfigurationException(LDHC.ownerAclQuery);
        }
        this.ownerAclQuery = QueryFactory.create(ownerAclQueryString);
        
        if (webIDQueryString == null)
        {
            if (log.isErrorEnabled()) log.error("WebID SPARQL query is not configured properly");
            throw new ConfigurationException(LDHC.webIDQuery);
        }
        this.webIDQuery = QueryFactory.create(webIDQueryString);
        
        if (agentQueryString == null)
        {
            if (log.isErrorEnabled()) log.error("Agent SPARQL query is not configured properly");
            throw new ConfigurationException(LDHC.agentQuery);
        }
        this.agentQuery = QueryFactory.create(agentQueryString);
        
        if (userAccountQueryString == null)
        {
            if (log.isErrorEnabled()) log.error("UserAccount SPARQL query is not configured properly");
            throw new ConfigurationException(LDHC.userAccountQuery);
        }
        this.userAccountQuery = QueryFactory.create(userAccountQueryString);
        
        if (ontologyQueryString == null)
        {
            if (log.isErrorEnabled()) log.error("Ontology SPARQL query is not configured properly");
            throw new ConfigurationException(LDHC.ontologyQuery);
        }
        this.ontologyQuery = QueryFactory.create(ontologyQueryString);
        
        if (baseURIString == null)
        {
            if (log.isErrorEnabled()) log.error("Base URI property '{}' not configured", LDHC.baseUri.getURI());
            throw new ConfigurationException(LDHC.baseUri);
        }
        baseURI = URI.create(baseURIString);
        
        if (uploadRootString == null)
        {
            if (log.isErrorEnabled()) log.error("Upload root ({}) not configured", LDHC.uploadRoot.getURI());
            throw new ConfigurationException(LDHC.uploadRoot);
        }
        
        if (cookieMaxAge == null)
        {
            if (log.isErrorEnabled()) log.error("JWT cookie max age property '{}' not configured", LDHC.cookieMaxAge.getURI());
            throw new ConfigurationException(LDHC.cookieMaxAge);
        }
        this.cookieMaxAge = cookieMaxAge;

        if (maxImportThreads == null)
        {
            if (log.isErrorEnabled()) log.error("Max import thread count property '{}' not configured", LDHC.maxImportThreads.getURI());
            throw new ConfigurationException(LDHC.maxImportThreads);
        }
        this.importThreadPool = Executors.newFixedThreadPool(maxImportThreads);
        servletConfig.getServletContext().setAttribute(LDHC.maxImportThreads.getURI(), importThreadPool); // used in ImportListener to shutdown the thread pool
        
        if (supportedLanguageCodes == null)
        {
            if (log.isErrorEnabled()) log.error("Supported languages ({}) not configured", LDHC.supportedLanguages.getURI());
            throw new ConfigurationException(LDHC.supportedLanguages);
        }
        this.supportedLanguages = Arrays.asList(supportedLanguageCodes.split(",")).stream().map(code -> Locale.forLanguageTag(code)).collect(Collectors.toList());
        
        this.servletConfig = servletConfig;
        this.mediaTypes = mediaTypes;
        this.maxGetRequestSize = maxGetRequestSize;
        this.preemptiveAuth = preemptiveAuth;
        this.cacheStylesheet = cacheStylesheet;
        this.resolvingUncached = resolvingUncached;
        this.enableLinkedDataProxy = enableLinkedDataProxy;
        this.allowInternalUrls = allowInternalUrls;
        this.urlValidator = new URLValidator(allowInternalUrls);
        this.maxContentLength = maxContentLength;
        this.invalidateCache = invalidateCache;
        this.enableWebIDSignUp = enableWebIDSignUp;
        this.oidcRefreshTokensPropertiesPath = oidcRefreshTokensPropertiesPath;
        this.oidcRefreshTokens = new Properties();
        if (googleClientID != null) this.property(Google.clientID.getURI(), googleClientID);
        if (googleClientSecret != null) this.property(Google.clientSecret.getURI(), googleClientSecret);
        if (orcidClientID != null) this.property(ORCID.clientID.getURI(), orcidClientID);
        if (orcidClientSecret != null) this.property(ORCID.clientSecret.getURI(), orcidClientSecret);

        try
        {
            this.uploadRoot = new URI(uploadRootString);
        }
        catch (URISyntaxException ex)
        {
            if (log.isErrorEnabled()) log.error("Upload root URI syntax error: {}", ex);
            throw new IllegalStateException(ex);
        }
        
        if (googleClientID != null && oidcRefreshTokensPropertiesPath == null)
        {
            if (log.isErrorEnabled()) log.error("Google OIDC signup is enabled (clientID client is provided) but refresh token cache is not configured (ldhc:oidcRefreshTokens)");
            throw new IllegalStateException("Google OIDC signup is enabled (clientID client is provided) but refresh token cache is not configured (ldhc:oidcRefreshTokens)");
        }
        if (oidcRefreshTokensPropertiesPath != null)
        {
            try (InputStream propertiesStream = new FileInputStream(oidcRefreshTokensPropertiesPath))
            {
                if (propertiesStream == null)
                {
                    if (log.isErrorEnabled()) log.error(".properties file with OIDC refresh tokens not found (ldhc:oidcRefreshTokens)");
                    throw new IllegalStateException(".properties file with OIDC refresh tokens not found (ldhc:oidcRefreshTokens)");
                }

                this.oidcRefreshTokens.load(propertiesStream);
            }
            catch (IOException ex)
            {
                if (log.isErrorEnabled()) log.error("Cannot read .properties file with OIDC refresh tokens: {}", ex);
                throw new IllegalStateException(ex);
            }
        }

        if (notificationAddressString != null)
        {
            try
            {
                InternetAddress[] notificationAddresses = InternetAddress.parse(notificationAddressString);
                // if (notificationAddresses.size() == 0) throw Exception...
                notificationAddress = notificationAddresses[0];
            }
            catch (AddressException ex)
            {
                throw new IllegalStateException(ex);
            }
        }
        else notificationAddress = null;

        try
        {
            javax.xml.parsers.SAXParserFactory factory = javax.xml.parsers.SAXParserFactory.newInstance();
            javax.xml.parsers.SAXParser parser = factory.newSAXParser();
            org.xml.sax.XMLReader reader = parser.getXMLReader();
            if (log.isDebugEnabled()) log.debug("SAXParserFactory class: {}", factory.getClass().getName());
            if (log.isDebugEnabled()) log.debug("XMLReader class: {}", reader.getClass().getName());
        }
        catch (ParserConfigurationException | SAXException e)
        {
            if (log.isErrorEnabled()) log.error("Failed to get XML parser info", e);
        }

        // add RDF/POST reader
        RDFLanguages.register(RDFLanguages.RDFPOST);
        RDFParserRegistry.registerLangTriples(RDFLanguages.RDFPOST, new RDFPostReaderFactory());

        // register ResultSet languages until we start using Jena 5.x with https://github.com/apache/jena/pull/2510
        RDFLanguages.register(ResultSetLang.RS_XML);
        RDFLanguages.register(ResultSetLang.RS_JSON);
        RDFLanguages.register(ResultSetLang.RS_CSV);
        RDFLanguages.register(ResultSetLang.RS_TSV);
        RDFLanguages.register(ResultSetLang.RS_Thrift);
        RDFLanguages.register(ResultSetLang.RS_Protobuf);
        // Not output-only text.
        RDFLanguages.register(ResultSetLang.RS_None);
        
        // add HTML/JSON-LD reader
        DocumentLoader documentLoader = new DocumentLoader();
        JsonLdOptions jsonLdOptions = new JsonLdOptions();
        try (InputStream contextStream = servletConfig.getServletContext().getResourceAsStream("/WEB-INF/classes/com/atomgraph/linkeddatahub/schema.org.jsonldcontext.json"))
        {
            String jsonContext = new String(contextStream.readAllBytes(), StandardCharsets.UTF_8);
            documentLoader.addInjectedDoc("http://schema.org", jsonContext);
            documentLoader.addInjectedDoc("https://schema.org", jsonContext);
            jsonLdOptions.setDocumentLoader(documentLoader);

            ParserProfile profile = RiotLib.profile(HtmlJsonLDReaderFactory.HTML, null, ErrorHandlerFactory.getDefaultErrorHandler());
            RDFLanguages.register(HtmlJsonLDReaderFactory.HTML);
            RDFParserRegistry.registerLangTriples(HtmlJsonLDReaderFactory.HTML,
                new HtmlJsonLDReaderFactory(new JsonLDReader(Lang.JSONLD, profile, profile.getErrorHandler()), jsonLdOptions));
        }
        catch (IOException ex)
        {
            if (log.isErrorEnabled()) log.error("schema.org @context not found", ex);
        }

        // register plain RDF/XML writer as default
        RDFWriterRegistry.register(Lang.RDFXML, RDFFormat.RDFXML_PLAIN); 

        // initialize mapping for locally stored vocabularies
        LocationMapper.setGlobalLocationMapper(locationMapper);
        if (log.isTraceEnabled()) log.trace("LocationMapper.get(): {}", locationMapper);
        
        try
        {
            this.contextDataset = getDataset(servletConfig.getServletContext(), contextDatasetURI);

            keyStore = KeyStore.getInstance("PKCS12");
            try (FileInputStream keyStoreInputStream = new FileInputStream(new java.io.File(new URI(clientKeyStoreURIString))))
            {
                keyStore.load(keyStoreInputStream, clientKeyStorePassword.toCharArray());
            }

            trustStore = KeyStore.getInstance("JKS");
            try (FileInputStream trustStoreInputStream = new FileInputStream(new java.io.File(new URI(clientTrustStoreURIString))))
            {
                trustStore.load(trustStoreInputStream, clientTrustStorePassword.toCharArray());
            }
            
            client = getClient(keyStore, clientKeyStorePassword, trustStore, maxConnPerRoute, maxTotalConn, null, false);
            externalClient = getClient(keyStore, clientKeyStorePassword, trustStore, maxConnPerRoute, maxTotalConn, null, false);
            importClient = getClient(keyStore, clientKeyStorePassword, trustStore, maxConnPerRoute, maxTotalConn, maxRequestRetries, true);
            noCertClient = getNoCertClient(trustStore, maxConnPerRoute, maxTotalConn, maxRequestRetries);
            
            if (maxContentLength != null)
            {
                client.register(new ContentLengthLimitFilter(maxContentLength));
                externalClient.register(new ContentLengthLimitFilter(maxContentLength));
                importClient.register(new ContentLengthLimitFilter(maxContentLength));
                noCertClient.register(new ContentLengthLimitFilter(maxContentLength));
            }
            
            if (proxyHostname != null)
            {
                ClientRequestFilter rewriteFilter = new ClientUriRewriteFilter(baseURI.getHost(), proxyScheme, proxyHostname, proxyPort); // proxyPort can be null

                client.register(rewriteFilter);
                externalClient.register(rewriteFilter);
                importClient.register(rewriteFilter);
                noCertClient.register(rewriteFilter);
            }
            
            Certificate secretaryCert = keyStore.getCertificate(secretaryCertAlias);
            if (secretaryCert == null)
            {
                if (log.isErrorEnabled()) log.error("Secretary certificate with alias {} does not exist in client keystore {}", secretaryCertAlias, clientKeyStoreURIString);
                throw new IllegalStateException(new CertificateException("Secretary certificate with alias '" + secretaryCertAlias + "' does not exist in client keystore '" + clientKeyStoreURIString + "'"));
            }
            if (!(secretaryCert instanceof X509Certificate))
            {
                if (log.isErrorEnabled()) log.error("Secretary certificate with alias {} is not a X509Certificate", secretaryCertAlias);
                throw new IllegalStateException(new CertificateException("Secretary certificate with alias " + secretaryCertAlias + " is not a X509Certificate"));
            }
            X509Certificate secretaryX509Cert = (X509Certificate)secretaryCert;
            secretaryX509Cert.checkValidity();// check if secretary WebID client certificate is valid
            secretaryWebIDURI = WebIDFilter.getWebIDURI(secretaryX509Cert);
            if (secretaryWebIDURI == null)
            {
                if (log.isErrorEnabled()) log.error("Secretary certificate with alias {} is not a valid WebID sertificate (SNA URI is missing)", secretaryCertAlias);
                throw new IllegalStateException(new CertificateException("Secretary certificate with alias " + secretaryCertAlias + " not a valid WebID sertificate (SNA URI is missing)"));
            }
            
            SP.init(BuiltinPersonalities.model);
            BuiltinPersonalities.model.add(Authorization.class, AuthorizationImpl.factory);
            BuiltinPersonalities.model.add(Agent.class, AgentImpl.factory);
            BuiltinPersonalities.model.add(UserAccount.class, UserAccountImpl.factory);
            BuiltinPersonalities.model.add(AdminApplication.class, new com.atomgraph.linkeddatahub.apps.model.admin.impl.ApplicationImplementation());
            BuiltinPersonalities.model.add(EndUserApplication.class, new com.atomgraph.linkeddatahub.apps.model.end_user.impl.ApplicationImplementation());
            BuiltinPersonalities.model.add(com.atomgraph.linkeddatahub.apps.model.Application.class, new com.atomgraph.linkeddatahub.apps.model.impl.ApplicationImplementation());
            BuiltinPersonalities.model.add(com.atomgraph.linkeddatahub.apps.model.Dataset.class, new com.atomgraph.linkeddatahub.apps.model.impl.DatasetImplementation());
            BuiltinPersonalities.model.add(com.atomgraph.linkeddatahub.apps.model.Package.class, new com.atomgraph.linkeddatahub.apps.model.impl.PackageImplementation());
            BuiltinPersonalities.model.add(Service.class, new com.atomgraph.linkeddatahub.model.impl.ServiceImplementation());
            BuiltinPersonalities.model.add(Import.class, ImportImpl.factory);
            BuiltinPersonalities.model.add(RDFImport.class, RDFImportImpl.factory);
            BuiltinPersonalities.model.add(CSVImport.class, CSVImportImpl.factory);
            BuiltinPersonalities.model.add(com.atomgraph.linkeddatahub.model.File.class, FileImpl.factory);

            // Build ServiceContext map: keyed by service URI, proxy derived from the app type that references each service.
            // Iterating ldt:service statements (app → service) naturally excludes orphan services.
            serviceContextMap = new HashMap<>();
            org.apache.jena.rdf.model.Model ctxUnion = contextDataset.getUnionModel();
            org.apache.jena.rdf.model.StmtIterator serviceIt = ctxUnion.listStatements(null, LDT.service, (org.apache.jena.rdf.model.RDFNode) null);
            try
            {
                while (serviceIt.hasNext())
                {
                    org.apache.jena.rdf.model.Statement stmt = serviceIt.nextStatement();
                    Resource app = stmt.getSubject();
                    Resource svcResource = stmt.getResource();
                    URI proxy;
                    
                    if (app.hasProperty(RDF.type, LAPP.AdminApplication))
                        proxy = backendProxyAdmin;
                    else if (app.hasProperty(RDF.type, LAPP.EndUserApplication))
                        proxy = backendProxyEndUser;
                    else
                        continue;
                    
                    serviceContextMap.put(svcResource.getURI(),
                        new com.atomgraph.linkeddatahub.model.ServiceContext(svcResource.as(com.atomgraph.linkeddatahub.model.Service.class), noCertClient, mediaTypes, maxGetRequestSize, proxy));
                }
            }
            finally
            {
                serviceIt.close();
            }

            // TO-DO: config property for cacheModelLoads
            endUserOntModelSpecs = new HashMap<>();
            dataManager = new DataManagerImpl(locationMapper, new HashMap<>(), GraphStoreClient.create(client, mediaTypes), cacheModelLoads, preemptiveAuth, resolvingUncached);
            ontModelSpec = OntModelSpec.OWL_MEM_RDFS_INF;
            ontModelSpec.setImportModelGetter(dataManager);
            OntDocumentManager.getInstance().setFileManager((FileManager)dataManager);
            OntDocumentManager.getInstance().setCacheModels(true); // need to re-set after changing FileManager
            ontModelSpec.setDocumentManager(OntDocumentManager.getInstance());

            if (mailUser != null && mailPassword !=  null) // enable SMTP authentication
            {
                emailProperties.put("mail.smtp.auth", "true");
                emailProperties.put("mail.smtp.starttls.enable", "true"); // connect via TLS https://support.google.com/a/answer/2956491?hl=en
                authenticator = new Authenticator() 
                {
                    @Override
                    protected PasswordAuthentication getPasswordAuthentication()
                    {
                        return new PasswordAuthentication(mailUser, mailPassword);
                    }
                };
            }
            else authenticator = null;

            if (smtpHost == null) throw new IllegalStateException(new IllegalStateException("Cannot initialize email service: SMTP host not configured"));
            if (smtpPort == null) throw new IllegalStateException(new IllegalStateException("Cannot initialize email service: SMTP port not configured"));
            emailProperties.put("mail.smtp.host", smtpHost);
            emailProperties.put("mail.smtp.port", Integer.valueOf(smtpPort));
            
            try
            {
                this.messageDigest = MessageDigest.getInstance("SHA1");
            }
            catch (NoSuchAlgorithmException ex)
            {
                if (log.isErrorEnabled()) log.error("SHA1 algorithm not found", ex);
                throw new InternalServerErrorException(ex);
            }

            xsltProc.registerExtensionFunction(new UUID());
            xsltProc.registerExtensionFunction(new DecodeURI());
            xsltProc.registerExtensionFunction(new com.atomgraph.linkeddatahub.writer.function.URLDecode());
            xsltProc.registerExtensionFunction(new com.atomgraph.linkeddatahub.writer.function.Construct(xsltProc));
            xsltProc.registerExtensionFunction(new com.atomgraph.linkeddatahub.writer.function.SendHTTPRequest(xsltProc, client));
            
            Model mappingModel = locationMapper.toModel();
            ResIterator prefixedMappings = mappingModel.listResourcesWithProperty(LocationMappingVocab.prefix);
            try
            {
                while (prefixedMappings.hasNext())
                {
                    Resource prefixMapping = prefixedMappings.next();
                    String prefix = prefixMapping.getRequiredProperty(LocationMappingVocab.prefix).getString();
                    // register mapped RDF documents in the XSLT processor so that document() returns them cached, throughout multiple transformations
                    TreeInfo doc = xsltProc.getUnderlyingConfiguration().buildDocumentTree(dataManager.resolve("", prefix));
                    xsltProc.getUnderlyingConfiguration().getGlobalDocumentPool().add(doc, prefix);
                }
                
                // register HTTPS URL of translations.rdf so it doesn't have to be requested repeatedly
                try (InputStream translations = servletConfig.getServletContext().getResourceAsStream(XSLTWriterBase.TRANSLATIONS_PATH))
                {
                    TreeInfo doc = xsltProc.getUnderlyingConfiguration().buildDocumentTree(new StreamSource(translations));
                    xsltProc.getUnderlyingConfiguration().getGlobalDocumentPool().add(doc, baseURI.resolve(XSLTWriterBase.TRANSLATIONS_PATH).toString());
                }
            }
            catch (TransformerException ex)
            {
                if (log.isErrorEnabled()) log.error("Error reading mapped RDF document: {}", ex);
                throw new IllegalStateException(ex);
            }
            finally
            {
                prefixedMappings.close();
            }
            
            xsltComp = xsltProc.newXsltCompiler();
            xsltComp.setParameter(new QName("ldh", LDH.base.getNameSpace(), LDH.base.getLocalName()), new XdmAtomicValue(baseURI));
            xsltComp.setURIResolver(new XsltResolver(LocationMapper.get(), new HashMap<>(), GraphStoreClient.create(client, mediaTypes), false, false, true)); // default Xerces parser does not support HTTPS
            xsltExec = xsltComp.compile(stylesheet);
        }
        catch (FileNotFoundException ex)
        {
            if (log.isErrorEnabled()) log.error("File not found", ex);
            throw new IllegalStateException(ex);
        }
        catch (IOException ex)
        {
            if (log.isErrorEnabled()) log.error("Could not load file", ex);
            throw new IllegalStateException(ex);
        }
        catch (KeyStoreException ex)
        {
            if (log.isErrorEnabled()) log.error("Key store error", ex);
            throw new IllegalStateException(ex);
        }
        catch (NoSuchAlgorithmException ex)
        {
            if (log.isErrorEnabled()) log.error("No such algorithm", ex);
            throw new IllegalStateException(ex);
        }
        catch (CertificateException ex)
        {
            if (log.isErrorEnabled()) log.error("Certificate error", ex);
            throw new IllegalStateException(ex);
        }
        catch (KeyManagementException | UnrecoverableKeyException ex)
        {
            if (log.isErrorEnabled()) log.error("Key management error", ex);
            throw new IllegalStateException(ex);
        }
        catch (URISyntaxException ex)
        {
            if (log.isErrorEnabled()) log.error("URI syntax error", ex);
            throw new IllegalStateException(ex);
        }
        catch (SaxonApiException ex)
        {
            if (log.isErrorEnabled()) log.error("System XSLT stylesheet error", ex);
            throw new IllegalStateException(ex);
        }
    }
    
    /**
     * Post-construct initialization.
     * Additional initialization (e.g. registering JAX-RS providers and factories) that cannot be cleanly done in the class constructor.
     */
    @PostConstruct
    public void init()
    {
        register(MultiPartFeature.class);

        registerResourceClasses();
        registerContainerRequestFilters();
        registerContainerResponseFilters();
        registerExceptionMappers();
        registerClientFilters();
        
        eventBus.register(this); // this system application will be receiving events about context changes
        
        register(new ValidatingModelProvider(getMessageDigest()));
        register(new ResultSetProvider());
        register(new QueryProvider());
        register(new QueryParamProvider());
        register(new UpdateRequestProvider());
        register(new ModelXSLTWriter(getXsltExecutable(), getOntModelSpec(), getDataManager(), getMessageDigest())); // writes (X)HTML responses
        register(new ResultSetXSLTWriter(getXsltExecutable(), getOntModelSpec(), getDataManager(), getMessageDigest())); // writes (X)HTML responses

        final com.atomgraph.linkeddatahub.Application system = this;
        register(new AbstractBinder()
        {
            @Override
            protected void configure()
            {
                bind(system).to(com.atomgraph.linkeddatahub.Application.class);
            }
        });
        register(new AbstractBinder()
        {
            @Override
            protected void configure()
            {
                bind(new com.atomgraph.client.MediaTypes()).to(com.atomgraph.client.MediaTypes.class).to(com.atomgraph.core.MediaTypes.class);
            }
        });
        register(new AbstractBinder()
        {
            @Override
            protected void configure()
            {
                bindFactory(AgentContextFactory.class).to(new TypeLiteral<Optional<AgentContext>>() {}).
                in(RequestScoped.class);
            }
        });
        register(new AbstractBinder()
        {
            @Override
            protected void configure()
            {
                bindFactory(AuthorizationContextFactory.class).to(new TypeLiteral<Optional<AuthorizationContext>>() {}).
                in(RequestScoped.class);
            }
        });
        register(new AbstractBinder()
        {
            @Override
            protected void configure()
            {
                bindFactory(ServiceFactory.class).to(new TypeLiteral<Optional<Service>>() {}).
                in(RequestScoped.class);
            }
        });
        register(new AbstractBinder()
        {
            @Override
            protected void configure()
            {
                bindFactory(ApplicationFactory.class).to(new TypeLiteral<Optional<com.atomgraph.linkeddatahub.apps.model.Application>>() {}).
                in(RequestScoped.class);
            }
        });
        register(new AbstractBinder()
        {
            @Override
            protected void configure()
            {
                bindFactory(com.atomgraph.linkeddatahub.server.factory.UnwrappedApplicationFactory.class).to(com.atomgraph.linkeddatahub.apps.model.Application.class).
                in(RequestScoped.class);
            }
        });
        register(new AbstractBinder()
        {
            @Override
            protected void configure()
            {
                bindFactory(com.atomgraph.linkeddatahub.server.factory.DatasetFactory.class).to(new TypeLiteral<Optional<com.atomgraph.linkeddatahub.apps.model.Dataset>>() {}).
                in(RequestScoped.class);
            }
        });
        register(new AbstractBinder()
        {
            @Override
            protected void configure()
            {
                bindFactory(OntologyFactory.class).to(new TypeLiteral<Optional<Ontology>>() {}).
                in(RequestScoped.class);
            }
        });
        register(new AbstractBinder()
        {
            @Override
            protected void configure()
            {
                bindFactory(new com.atomgraph.core.factory.DataManagerFactory(getDataManager())).to(com.atomgraph.core.util.jena.DataManager.class);
            }
        });
        register(new AbstractBinder()
        {
            @Override
            protected void configure()
            {
                bindFactory(DataManagerFactory.class).to(com.atomgraph.client.util.DataManager.class).
                in(RequestScoped.class);
            }
        });
        register(new AbstractBinder()
        {
            @Override
            protected void configure()
            {
                bindFactory(XsltExecutableSupplierFactory.class).to(XsltExecutableSupplier.class).
                in(RequestScoped.class);
            }
        });
        register(new AbstractBinder()
        {
            @Override
            protected void configure()
            {
                bindFactory(ModeFactory.class).to(new TypeLiteral<List<Mode>>() {}).
                in(RequestScoped.class);
            }
        });
        
//        if (log.isTraceEnabled()) log.trace("Application.init() with Classes: {} and Singletons: {}", getClasses(), getSingletons());
    }
    
    /**
     * Registers JAX-RS resource classes.
     */
    protected void registerResourceClasses()
    {
        register(Dispatcher.class);

        // Conditionally register Google OAuth endpoints if configured
        if (getProperty(com.atomgraph.linkeddatahub.vocabulary.Google.clientID.getURI()) != null &&
            getProperty(com.atomgraph.linkeddatahub.vocabulary.Google.clientSecret.getURI()) != null)
        {
            register(com.atomgraph.linkeddatahub.resource.oauth2.google.Authorize.class);
            register(com.atomgraph.linkeddatahub.resource.oauth2.google.Login.class);
            if (log.isDebugEnabled()) log.debug("Google OAuth endpoints registered");
        }

        // Conditionally register ORCID OAuth endpoints if configured
        if (getProperty(com.atomgraph.linkeddatahub.vocabulary.ORCID.clientID.getURI()) != null &&
            getProperty(com.atomgraph.linkeddatahub.vocabulary.ORCID.clientSecret.getURI()) != null)
        {
            register(com.atomgraph.linkeddatahub.resource.oauth2.orcid.Authorize.class);
            register(com.atomgraph.linkeddatahub.resource.oauth2.orcid.Login.class);
            if (log.isDebugEnabled()) log.debug("ORCID OAuth endpoints registered");
        }
    }
    
    /**
     * Registers JAX-RS container request filters.
     */
    protected void registerContainerRequestFilters()
    {
        register(new HttpMethodOverrideFilter());
        register(ApplicationFilter.class);
        register(OntologyFilter.class);
        register(ProxiedWebIDFilter.class);
        register(ProxyRequestFilter.class);
        register(AuthorizationFilter.class);
        if (getMaxContentLength() != null) register(new ContentLengthLimitFilter(getMaxContentLength()));
        register(new RDFPostMediaTypeInterceptor()); // for application/x-www-form-urlencoded
        
        // Conditionally register Google OAuth filter if configured
        if (getProperty(com.atomgraph.linkeddatahub.vocabulary.Google.clientID.getURI()) != null &&
            getProperty(com.atomgraph.linkeddatahub.vocabulary.Google.clientSecret.getURI()) != null)
        {
            register(com.atomgraph.linkeddatahub.server.filter.request.auth.google.IDTokenFilter.class);
            if (log.isDebugEnabled()) log.debug("Google OAuth filter registered");
        }

        // Conditionally register ORCID OAuth filter if configured
        if (getProperty(com.atomgraph.linkeddatahub.vocabulary.ORCID.clientID.getURI()) != null &&
            getProperty(com.atomgraph.linkeddatahub.vocabulary.ORCID.clientSecret.getURI()) != null)
        {
            register(com.atomgraph.linkeddatahub.server.filter.request.auth.orcid.IDTokenFilter.class);
            if (log.isDebugEnabled()) log.debug("ORCID OAuth filter registered");
        }
    }

    /**
     * Registers JAX-RS container response filters.
     */
    protected void registerContainerResponseFilters()
    {
        register(new CORSFilter());
        register(new ResponseHeadersFilter());
        register(new XsltExecutableFilter());
        if (isInvalidateCache()) register(new CacheInvalidationFilter());
//        register(new ProvenanceFilter());
    }
    
    /**
     * Registers JAX-RS extension mappers.
     */
    protected void registerExceptionMappers()
    {
        register(NotFoundExceptionMapper.class);
        register(ConfigurationExceptionMapper.class);
        register(OntologyExceptionMapper.class);
        register(ModelExceptionMapper.class);
        register(SPINConstraintViolationExceptionMapper.class);
        register(SHACLConstraintViolationExceptionMapper.class);
        register(DatatypeFormatExceptionMapper.class);
        register(QueryExecExceptionMapper.class);
        register(RiotExceptionMapper.class);
        register(RiotParseExceptionMapper.class); // move to Processor?
        register(NotAcceptableExceptionMapper.class);
        register(ClientErrorExceptionMapper.class);
        register(HttpHostConnectExceptionMapper.class);
        register(InternalURLExceptionMapper.class);
        register(BadGatewayExceptionMapper.class);
        register(OntClassNotFoundExceptionMapper.class);
        register(InvalidWebIDPublicKeyExceptionMapper.class);
        register(InvalidWebIDURIExceptionMapper.class);
        register(WebIDCertificateExceptionMapper.class);
        register(WebIDDelegationExceptionMapper.class);
        register(WebIDLoadingExceptionMapper.class);
        register(TokenExpiredExceptionMapper.class);
        register(QueryParseExceptionMapper.class);
        register(AuthenticationExceptionMapper.class);
        register(ForbiddenExceptionMapper.class);
        register(AuthorizationExceptionMapper.class);
        register(MessagingExceptionMapper.class);
    }
    
    /**
     * Registers JAX-RS client filters.
     */
    protected void registerClientFilters()
    {
        ServiceLoader.load(JSONGRDDLFilterProvider.class).forEach(provider ->
        {
            try
            {
                JSONGRDDLFilter filter = provider.getFilter(xsltComp);
                client.register(filter);
                externalClient.register(filter);
            }
            catch (SaxonApiException ex)
            {
                if (log.isErrorEnabled()) log.error("Failed to initialize GRDDL client filter for {}", provider.getClass().getSimpleName());
            }
        });
    }
    
    /**
     * Retrieves dataset from file URL.
     * 
     * @param servletContext servlet context
     * @param uri file URL (can be relative)
     * @return RDF dataset
     * @throws FileNotFoundException thrown if file not found
     * @throws MalformedURLException thrown if location URL is malformed
     * @throws IOException error reading file
     */
    public static Dataset getDataset(final ServletContext servletContext, final URI uri) throws FileNotFoundException, MalformedURLException, IOException
    {
        String baseURI = servletContext.getResource("/").toString();

        try (InputStream datasetStream = (uri.isAbsolute() ? new FileInputStream(new java.io.File(uri)) : servletContext.getResourceAsStream(uri.toString())))
        {
            if (datasetStream == null) throw new IOException("Dataset not found at URI: " + uri.toString());
            Lang lang = RDFDataMgr.determineLang(uri.toString(), null, null);
            if (lang == null) throw new IOException("Could not determing RDF format from dataset URI: " + uri.toString());

            Dataset dataset = DatasetFactory.create();
            if (log.isDebugEnabled()) log.debug("Loading Model from dataset: {}", uri);
            RDFDataMgr.read(dataset, datasetStream, baseURI, lang);
            return dataset;
        }
    }

    /**
     * Queries RDF dataset and returns result.
     * 
     * @param dataset RDF dataset
     * @param query SPARQL query
     * @return result model
     */
    public final Model getModel(Dataset dataset, Query query)
    {
        if (dataset == null) throw new IllegalArgumentException("Dataset cannot be null");
        if (query == null) throw new IllegalArgumentException("Query cannot be null");
        
        try (QueryExecution qex = QueryExecution.create(query, dataset))
        {
            if (query.isDescribeType()) return qex.execDescribe();
            if (query.isConstructType()) return qex.execConstruct();
            
            throw new IllegalStateException("Query is not DESCRIBE or CONSTRUCT");
        }
    }

    /**
     * Handles signup event.
     * Invoked every time a new agent has signed up.
     * 
     * @param event signup event
     * @see com.atomgraph.linkeddatahub.resource.admin.SignUp
    */
    @Subscribe
    public void handleSignUp(SignUp event)
    {
        getWebIDModelCache().remove(event.getSecretaryWebID()); // clear secretary WebID from cache to get new acl:delegates statements after new signup
    }

    /**
     * Handles authorization creation event.
     * 
     * @param event creation event
     * @throws MessagingException thrown if email could not be sent
     * @throws UnsupportedEncodingException email encoding error
     */
    @Subscribe
    public void handleAuthorizationCreated(AuthorizationCreated event) throws MessagingException, UnsupportedEncodingException
    {
        String emailSubject = servletConfig.getServletContext().getInitParameter(LDHC.authorizationEMailSubject.getURI());
        if (emailSubject == null) throw new InternalServerErrorException(new ConfigurationException(LDHC.authorizationEMailSubject));
        
        String emailText = servletConfig.getServletContext().getInitParameter(LDHC.authorizationEMailText.getURI());
        if (emailText == null) throw new InternalServerErrorException(new ConfigurationException(LDHC.authorizationEMailText));

        Resource owner = event.getApplication().getMaker();
        Resource auth = event.getAuthorization();
        if (auth.hasProperty(ACL.agent))
        {
            Resource agent = auth.getPropertyResourceValue(ACL.agent);
            // make sure the client has WebID delegation enabled, otherwise it will not have authenticated access
            Model agentModel = event.getGraphStoreClient().getModel(agent.getURI());
            if (!agentModel.containsResource(agent)) throw new IllegalStateException("Could not load agent's <" + agent.getURI() + "> description");
            agent = agentModel.getResource(agent.getURI());

            final String name;
            if (agent.hasProperty(FOAF.givenName) && agent.hasProperty(FOAF.familyName))
            {
                String givenName = agent.getProperty(FOAF.givenName).getString();
                String familyName = agent.getProperty(FOAF.familyName).getString();
                name = givenName + " " + familyName;
            }
            else
            {
                if (agent.hasProperty(FOAF.name)) name = agent.getProperty(FOAF.name).getString();
                else throw new IllegalStateException("Agent '" + agent + "' does not have either foaf:givenName/foaf:familyName or foaf:name");
            }

            // we expect foaf:mbox value as mailto: URI (it gets converted from literal in Model provider)
            String mbox = agent.getRequiredProperty(FOAF.mbox).getResource().getURI().substring("mailto:".length());
            String accessToList = auth.listProperties(ACL.accessTo).toList().stream().map(stmt -> stmt.getResource().getURI()).collect(Collectors.joining("\n"));
            String accessToClassList = auth.listProperties(ACL.accessToClass).toList().stream().map(stmt -> stmt.getResource().getURI()).collect(Collectors.joining("\n"));

            MessageBuilder builder = getMessageBuilder().
                subject(String.format(emailSubject,
                    event.getApplication().getProperty(DCTerms.title).getString())).
                to(mbox, name).
                textBodyPart(String.format(emailText, owner.getURI(), accessToList, accessToClassList, event.getApplication().getBaseURI()));

            if (getNotificationAddress() != null) builder = builder.from(getNotificationAddress());

            EMailListener.submit(builder.build());
        }
    }
    
    /**
     * Matches application by type and request URL.
     * 
     * @param absolutePath request URL without the query string
     * @return app resource or null, if none matched
     */
    public Resource matchApp(URI absolutePath)
    {
        return getAppByOrigin(getContextModel(), LAPP.Application, absolutePath); // make sure we return an immutable model
    }
    
    /**
     * Returns application with the longest URI key.
     * 
     * @param lengthMap length to app map
     * @return app resource
     */
    public Resource getLongestURIResource(Map<Integer, Resource> lengthMap)
    {
        // select the app with the longest URI match, as the model contains a pair of EndUserApplication/AdminApplication
        TreeMap<Integer, Resource> apps = new TreeMap(lengthMap);
        if (!apps.isEmpty()) return apps.lastEntry().getValue();
        
        return null;
    }
    
    /**
     * Normalizes a URI origin by adding explicit default ports (80 for HTTP, 443 for HTTPS).
     * An origin consists of scheme, hostname, and port.
     * This allows comparing origins with implicit and explicit default ports.
     *
     * @param uri the URI to normalize
     * @return normalized origin string in format "scheme://host:port"
     * @see <a href="https://developer.mozilla.org/en-US/docs/Glossary/Origin">Origin - MDN Web Docs</a>
     */
    public static String normalizeOrigin(URI uri)
    {
        if (uri == null) throw new IllegalArgumentException("URI cannot be null");

        String scheme = uri.getScheme();
        String host = uri.getHost();
        int port = uri.getPort();

        if (port == -1)
        {
            if ("https".equals(scheme)) port = 443;
            else if ("http".equals(scheme)) port = 80;
        }

        return scheme + "://" + host + ":" + port;
    }

    /**
     * Finds application by origin matching from the application model.
     * Applications are filtered by type first.
     *
     * @param model application model
     * @param type application type
     * @param absolutePath request URL (without the query string)
     * @return app resource or null if no match found
     */
    public Resource getAppByOrigin(Model model, Resource type, URI absolutePath)
    {
        if (model == null) throw new IllegalArgumentException("Model cannot be null");
        if (type == null) throw new IllegalArgumentException("Resource cannot be null");
        if (absolutePath == null) throw new IllegalArgumentException("URI cannot be null");

        String requestOrigin = normalizeOrigin(absolutePath);

        ResIterator it = model.listSubjectsWithProperty(RDF.type, type);
        try
        {
            while (it.hasNext())
            {
                Resource app = it.next();

                // Use origin-based matching - return immediately on match since origins are unique
                if (app.hasProperty(LAPP.origin))
                {
                    URI appOriginURI = URI.create(app.getPropertyResourceValue(LAPP.origin).getURI());
                    String normalizedAppOrigin = normalizeOrigin(appOriginURI);

                    if (requestOrigin.equals(normalizedAppOrigin)) return app;
                }
            }
        }
        finally
        {
            it.close();
        }

        return null;
    }
    
    /**
     * Matches dataset resource by type and request URL.
     * 
     * @param type dataset type
     * @param absolutePath request URL without the query string
     * @return dataset resource, or null if non matched
     */
    public Resource matchDataset(Resource type, URI absolutePath)
    {
        return matchDataset(getContextModel(), type, absolutePath); // make sure we return an immutable model
    }
    
    /**
     * Matches dataset by type and request URL in a given application model.
     * It finds the apps where request URL is relative to the app base URI, and returns the one with the longest match.
     * 
     * @param appModel application model
     * @param type application type
     * @param absolutePath request URL without the query string
     * @return dataset resource or null, if none matched
     */
    public Resource matchDataset(Model appModel, Resource type, URI absolutePath)
    {
        return getLongestURIResource(getLengthMap(getRelativeDatasets(appModel, type, absolutePath)));
    }
    
    /**
     * Builds a base URI to dataset resource map from the application model.
     * Datasets are filtered by type first.
     * 
     * @param model application model
     * @param type dataset type
     * @param absolutePath request URL (without the query string)
     * @return URI to dataset map
     */
    public Map<URI, Resource> getRelativeDatasets(Model model, Resource type, URI absolutePath)
    {
        if (model == null) throw new IllegalArgumentException("Model cannot be null");
        if (type == null) throw new IllegalArgumentException("Resource cannot be null");
        if (absolutePath == null) throw new IllegalArgumentException("URI cannot be null");

        Map<URI, Resource> datasets = new HashMap<>();
        
        ResIterator it = model.listSubjectsWithProperty(RDF.type, type);
        try
        {
            while (it.hasNext())
            {
                Resource dataset = it.next();
                
                if (!dataset.hasProperty(LAPP.prefix))
                    throw new InternalServerErrorException(new IllegalStateException("Dataset resource <" + dataset.getURI() + "> has no lapp:prefix value"));
                
                URI prefix = URI.create(dataset.getPropertyResourceValue(LAPP.prefix).getURI());
                URI relative = prefix.relativize(absolutePath);
                if (!relative.isAbsolute() && !relative.toString().equals("")) datasets.put(prefix, dataset);
            }
        }
        finally
        {
            it.close();
        }

        return datasets;
    }
    
    /**
     * Returns a map of applications by the length of their base URIs.
     * 
     * @param apps base URI to application map
     * @return base URI length to application map
     */
    public Map<Integer, Resource> getLengthMap(Map<URI, Resource> apps)
    {
        if (apps == null) throw new IllegalArgumentException("Map cannot be null");

        Map<Integer, Resource> lengthMap = new HashMap<>();
        
        apps.entrySet().iterator().forEachRemaining(entry ->
            lengthMap.put(entry.getKey().toString().length(), entry.getValue())
        );
        
        return lengthMap;
    }

    /**
     * Submits CSV import for asynchronous execution.
     * 
     * @param csvImport import resource
     * @param app current application
     * @param service current SPARQL service
     * @param adminService current admin SPARQL service
     * @param baseURI application's base URI
     * @param gsc Graph Store client
     */
    public void submitImport(CSVImport csvImport, com.atomgraph.linkeddatahub.apps.model.Application app, Service service, Service adminService, String baseURI, GraphStoreClient gsc)
    {
        new ImportExecutor(importThreadPool).start(service, adminService, this, baseURI, gsc, csvImport);
    }

    /**
     * Submits RDF import for asynchronous execution.
     *
     * @param rdfImport import resource
     * @param app current application
     * @param service current SPARQL service
     * @param adminService current admin SPARQL service
     * @param baseURI application's base URI
     * @param gsc Graph Store client
     */
    public void submitImport(RDFImport rdfImport, com.atomgraph.linkeddatahub.apps.model.Application app, Service service, Service adminService, String baseURI, GraphStoreClient gsc)
    {
        new ImportExecutor(importThreadPool).start(service, adminService, this, baseURI, gsc, rdfImport);
    }
    
    /**
     * Builds JAX-RS client instance from given configuration.
     * 
     * @param keyStore keystore
     * @param keyStorePassword keystore password
     * @param trustStore truststore
     * @param maxConnPerRoute max connections per route
     * @param maxTotalConn max total connections
     * @param maxRequestRetries maximum number of times that the HTTP client will retry a request
     * @param buffered true if request entity should be buffered
     * @return client instance
     * @throws NoSuchAlgorithmException SSL algorithm error
     * @throws KeyStoreException keystore loading error
     * @throws UnrecoverableKeyException key loading error
     * @throws KeyManagementException key loading error
     */
    public static Client getClient(KeyStore keyStore, String keyStorePassword, KeyStore trustStore, Integer maxConnPerRoute, Integer maxTotalConn, Integer maxRequestRetries, boolean buffered) throws NoSuchAlgorithmException, KeyStoreException, UnrecoverableKeyException, KeyManagementException
    {
        if (keyStore == null) throw new IllegalArgumentException("KeyStore cannot be null");
        if (keyStorePassword == null) throw new IllegalArgumentException("KeyStore password string cannot be null");
        if (trustStore == null) throw new IllegalArgumentException("KeyStore (truststore) cannot be null");

        // for client authentication
        KeyManagerFactory kmf = KeyManagerFactory.getInstance(KeyManagerFactory.getDefaultAlgorithm());
        kmf.init(keyStore, keyStorePassword.toCharArray());

        // for trusting server certificate
        TrustManagerFactory tmf = TrustManagerFactory.getInstance(TrustManagerFactory.getDefaultAlgorithm());
        tmf.init(trustStore);

        SSLContext ctx = SSLContext.getInstance("SSL");
        ctx.init(kmf.getKeyManagers(), tmf.getTrustManagers(), null);

        Registry<ConnectionSocketFactory> socketFactoryRegistry = RegistryBuilder.<ConnectionSocketFactory>create().
            register("https", new SSLConnectionSocketFactory(ctx, NoopHostnameVerifier.INSTANCE)).
            register("http", new PlainConnectionSocketFactory()).
            build();

        PoolingHttpClientConnectionManager conman = new PoolingHttpClientConnectionManager(socketFactoryRegistry)
        {

            // https://github.com/eclipse-ee4j/jersey/issues/4449

            @Override
            public void close()
            {
                super.shutdown();
            }

            @Override
            public void shutdown()
            {
                // Disable shutdown of the pool. This will be done later, when this factory is closed
                // This is a workaround for finalize method on jerseys ClientRuntime which
                // closes the client and shuts down the connection pool when it is garbage collected
            };
            
            // https://github.com/eclipse-ee4j/jersey/issues/2855
            
            @Override
            public void releaseConnection(final HttpClientConnection managedConn, final Object state, final long keepalive, final TimeUnit timeUnit)
            {
                // set state to null to allow reuse of connections
                super.releaseConnection(managedConn, null, keepalive, timeUnit);
            }

        };
        if (maxConnPerRoute != null) conman.setDefaultMaxPerRoute(maxConnPerRoute);
        if (maxTotalConn != null) conman.setMaxTotal(maxTotalConn);
        
        ClientConfig config = new ClientConfig();
        config.connectorProvider(new ApacheConnectorProvider());
        config.register(MultiPartFeature.class);
        config.register(new ModelProvider());
        config.register(new DatasetProvider());
        config.register(new ResultSetProvider());
        config.register(new QueryProvider());
        config.register(new UpdateRequestProvider());
        config.property(ClientProperties.FOLLOW_REDIRECTS, true);
        config.property(ClientProperties.REQUEST_ENTITY_PROCESSING, RequestEntityProcessing.BUFFERED); // https://stackoverflow.com/questions/42139436/jersey-client-throws-cannot-retry-request-with-a-non-repeatable-request-entity
        config.property(ApacheClientProperties.CONNECTION_MANAGER, conman);
        
        if (maxRequestRetries != null)
            config.property(ApacheClientProperties.RETRY_HANDLER, (HttpRequestRetryHandler) (IOException ex, int executionCount, HttpContext context) ->
            {
                // Extract the HTTP host from the context
                HttpHost targetHost = (HttpHost)context.getAttribute(HttpCoreContext.HTTP_TARGET_HOST);
                String serverName = targetHost != null ? targetHost.getHostName() : "Unknown";

                if (executionCount > maxRequestRetries)
                {
                    if (log.isWarnEnabled()) log.warn("Maximum tries reached for client HTTP pool to server '{}'", serverName);
                    return false;
                }
                if (ex instanceof org.apache.http.NoHttpResponseException)
                {
                    if (log.isWarnEnabled()) log.warn("No response from server '{}' on {} call", serverName, executionCount);
                    return true;
                }
                return false;
            });

        return ClientBuilder.newBuilder().
            withConfig(config).
            sslContext(ctx).
            hostnameVerifier(NoopHostnameVerifier.INSTANCE). // has no effect due to the custom SSLContext
            build();
    }
    
    /**
     * Builds HTTP client instance without TLS client certificates.
     * 
     * @param trustStore client truststore
     * @param maxConnPerRoute max connections per route
     * @param maxTotalConn max total connections
     * @param maxRequestRetries maximum number of times that the HTTP client will retry a request
     * @return client instance
     */
    public static Client getNoCertClient(KeyStore trustStore, Integer maxConnPerRoute, Integer maxTotalConn, Integer maxRequestRetries)
    {
        try
        {
            // for trusting server certificate
            TrustManagerFactory tmf = TrustManagerFactory.getInstance(TrustManagerFactory.getDefaultAlgorithm());
            tmf.init(trustStore);
            
            SSLContext ctx = SSLContext.getInstance("SSL");
            ctx.init(null, tmf.getTrustManagers(), null);

            Registry<ConnectionSocketFactory> socketFactoryRegistry = RegistryBuilder.<ConnectionSocketFactory>create().
                register("https", new SSLConnectionSocketFactory(ctx, NoopHostnameVerifier.INSTANCE)).
                register("http", new PlainConnectionSocketFactory()).
                build();
        
            PoolingHttpClientConnectionManager conman = new PoolingHttpClientConnectionManager(socketFactoryRegistry)
            {

                // https://github.com/eclipse-ee4j/jersey/issues/4449
                
                @Override
                public void close()
                {
                    super.shutdown();
                }

                @Override
                public void shutdown()
                {
                    // Disable shutdown of the pool. This will be done later, when this factory is closed
                    // This is a workaround for finalize method on jerseys ClientRuntime which
                    // closes the client and shuts down the connection pool when it is garbage collected
                };
                
                // https://github.com/eclipse-ee4j/jersey/issues/2855

                @Override
                public void releaseConnection(final HttpClientConnection managedConn, final Object state, final long keepalive, final TimeUnit timeUnit)
                {
                    // set state to null to allow reuse of connections
                    super.releaseConnection(managedConn, null, keepalive, timeUnit);
                }
                
            };
            if (maxConnPerRoute != null) conman.setDefaultMaxPerRoute(maxConnPerRoute);
            if (maxTotalConn != null) conman.setMaxTotal(maxTotalConn);

            ClientConfig config = new ClientConfig();
            config.connectorProvider(new ApacheConnectorProvider());
            config.register(MultiPartFeature.class);
            config.register(new ModelProvider());
            config.register(new DatasetProvider());
            config.register(new ResultSetProvider());
            config.register(new QueryProvider());
            config.register(new UpdateRequestProvider()); // TO-DO: UpdateRequestProvider
            config.property(ClientProperties.FOLLOW_REDIRECTS, true);
            config.property(ClientProperties.REQUEST_ENTITY_PROCESSING, RequestEntityProcessing.BUFFERED); // https://stackoverflow.com/questions/42139436/jersey-client-throws-cannot-retry-request-with-a-non-repeatable-request-entity
            config.property(ApacheClientProperties.CONNECTION_MANAGER, conman);
            
            if (maxRequestRetries != null)
                config.property(ApacheClientProperties.RETRY_HANDLER, (HttpRequestRetryHandler) (IOException ex, int executionCount, HttpContext context) ->
                {
                    // Extract the HTTP host from the context
                    HttpHost targetHost = (HttpHost)context.getAttribute(HttpCoreContext.HTTP_TARGET_HOST);
                    String serverName = targetHost != null ? targetHost.getHostName() : "Unknown";

                    if (executionCount > maxRequestRetries)
                    {
                        if (log.isWarnEnabled()) log.warn("Maximum tries reached for client HTTP pool to server '{}'", serverName);
                        return false;
                    }
                    if (ex instanceof org.apache.http.NoHttpResponseException)
                    {
                        if (log.isWarnEnabled()) log.warn("No response from server '{}' on {} call", serverName, executionCount);
                        return true;
                    }
                    return false;
                });
        
            return ClientBuilder.newBuilder().
                withConfig(config).
                sslContext(ctx).
                hostnameVerifier(NoopHostnameVerifier.INSTANCE). // has no effect due to the custom SSLContext
                build();
        }
        catch (NoSuchAlgorithmException ex)
        {
            if ( log.isErrorEnabled()) log.error("No such algorithm: {}", ex);
            throw new IllegalStateException(ex);
        }
        catch (KeyStoreException ex)
        {
            if ( log.isErrorEnabled()) log.error("Key store error: {}", ex);
            throw new IllegalStateException(ex);
        }
        catch (KeyManagementException ex)
        {
            if ( log.isErrorEnabled()) log.error("Key management error: {}", ex);
            throw new IllegalStateException(ex);
        }
    }
    
    /**
     * Returns servlet configuration.
     * Context parameters can be accessed through it.
     * 
     * @return servlet config object
     */
    public ServletConfig getServletConfig()
    {
        return servletConfig;
    }
    
    /**
     * Event bus that can be used for event registration.
     * 
     * @return event bus object
     */
    public EventBus getEventBus()
    {
        return eventBus;
    }
    
    /**
     * Gets Jena's <code>DataManager</code> implementation.
     * 
     * @return data manager instance
     */
    public DataManager getDataManager()
    {
        return dataManager;
    }
 
    /**
     * Returns a map of application URIs to ontology specifications.
     * 
     * @return URI to ontology specification map
     */
    protected Map<String, OntModelSpec> getEndUserOntModelSpecs()
    {
        return endUserOntModelSpecs;
    }

    /**
     * Returns ontology specification for the specified end-user application.
     * 
     * @param app end-user application resource
     * @return ontology specification 
     */
    public OntModelSpec getOntModelSpec(EndUserApplication app)
    {
        if (!getEndUserOntModelSpecs().containsKey(app.getURI()))
        {
            OntModelSpec appOntModelSpec = new OntModelSpec(OntModelSpec.OWL_MEM_RDFS_INF);
            appOntModelSpec.setDocumentManager(new OntDocumentManager());
            appOntModelSpec.getDocumentManager().setFileManager(new DataManagerImpl(LocationMapper.get(), new HashMap<>(), GraphStoreClient.create(getClient(), getMediaTypes()), true, isPreemptiveAuth(), isResolvingUncached()));
            
            getEndUserOntModelSpecs().put(app.getURI(), appOntModelSpec);
        }
        
        return getEndUserOntModelSpecs().get(app.getURI());
    }
    
    /**
     * Returns a registry of readable and writeable media types.
     * 
     * @return registry object
     */
    public MediaTypes getMediaTypes()
    {
        return mediaTypes;
    }
    
    /**
     * Returns the default system HTTP client.
     * 
     * @return client object
     */
    public Client getClient()
    {
        return client;
    }
    
    /**
     * Returns the external HTTP client.
     * It is used by the Linked Data browser to avoid sharing the connection pool with the system client.
     *
     * @return client object
     */
    public Client getExternalClient()
    {
        return externalClient;
    }

    /**
     * Returns the service context for the given service (client + proxy configuration).
     * The context is keyed by the service's URI string.
     *
     * @param service SPARQL service
     * @return service context, or {@code null} if the service is not registered
     */
    public com.atomgraph.linkeddatahub.model.ServiceContext getServiceContext(com.atomgraph.linkeddatahub.model.Service service)
    {
        if (service == null) throw new IllegalArgumentException("Service cannot be null");
        return serviceContextMap.get(service.getURI());
    }

    /**
     * Returns the frontend proxy URI used for cache invalidation BAN requests.
     *
     * @return frontend proxy URI, or {@code null} if not configured
     */
    public URI getFrontendProxy()
    {
        return frontendProxy;
    }

    /**
     * Bans URL from the proxy cache using the given proxy URI.
     *
     * @param proxyURI proxy URI
     * @param url banned URL
     * @param urlEncode if true, the banned URL value will be URL-encoded
     */
    public void ban(URI proxyURI, String url, boolean urlEncode)
    {
        if (proxyURI == null) throw new IllegalArgumentException("Proxy URI cannot be null");
        if (url == null) throw new IllegalArgumentException("URL cannot be null");

        // Extract path from URL - Varnish req.url only contains the path, not the full URL
        URI uri = URI.create(url);
        String path = uri.getPath();
        if (uri.getQuery() != null) path += "?" + uri.getQuery();

        final String urlValue = urlEncode ? UriComponent.encode(path, UriComponent.Type.UNRESERVED) : path;

        try (Response cr = getClient().target(proxyURI).
                request().
                header(CacheInvalidationFilter.HEADER_NAME, urlValue).
                method("BAN", Response.class))
        {
            // Response automatically closed by try-with-resources
        }
    }

    /**
     * Returns the system base URI.
     * 
     * @return base URI
     */
    public URI getBaseURI()
    {
        return baseURI;
    }
    
    /**
     * Returns the URI of the secretary agent.
     * 
     * @return WebID URI
     */
    public URI getSecretaryWebIDURI()
    {
        return secretaryWebIDURI;
    }
    
    /**
     * Returns the document type query.
     * Used to retrieve the document type metadata.
     * 
     * @return query object
     */
    public Query getDocumentTypeQuery()
    {
        return documentTypeQuery.cloneQuery();
    }

    /**
     * Returns the document owner query.
     * Used to retrieve the document owner metadata.
     * 
     * @return query object
     */
    public Query getDocumentOwnerQuery()
    {
        return documentOwnerQuery.cloneQuery();
    }
    
    /**
     * Returns the authorization query.
     * Used to check access to end-user apps.
     * 
     * @return query object
     */
    public Query getACLQuery()
    {
        return aclQuery.cloneQuery();
    }
    
    /**
     * Returns the owner authorization query.
     * Used to check access to admin apps.
     * 
     * @return query object
     */
    public Query getOwnerACLQuery()
    {
        return ownerAclQuery.cloneQuery();
    }
    
    /**
     * Returns the WebID validation query.
     * 
     * @return query object
     */
    public Query getWebIDQuery()
    {
        return webIDQuery.cloneQuery();
    }
    
    /**
     * Returns the agent lookup query.
     * 
     * @return query object
     */
    public Query getAgentQuery()
    {
        return agentQuery.cloneQuery();
    }
    
    /**
     * Returns the user account lookup query.
     * 
     * @return query object
     */
    public Query getUserAccountQuery()
    {
        return userAccountQuery.cloneQuery();
    }
    
    /**
     * Returns ontology load query.
     * 
     * @return query object
     */
    public Query getOntologyQuery()
    {
        return ontologyQuery.cloneQuery();
    }
    
    /**
     * Returns maximum <code>GET</code> request size sent by the HTTP client.
     * Requests over maximum size fall back to the <code>POST</code> method.
     * 
     * @return size in bytes
     */
    public Integer getMaxGetRequestSize()
    {
        return maxGetRequestSize;
    }

    /**
     * Returns true if HTTP Basic auth credentials should be sent preemptively.
     * 
     * @return true if preemptively
     */
    public boolean isPreemptiveAuth()
    {
        return preemptiveAuth;
    }
    
    /**
     * The default specification of ontology models.
     * 
     * @return spec object
     */
    public OntModelSpec getOntModelSpec()
    {
        return ontModelSpec;
    }
    
    /**
     * Returns Saxon's XSLT compiler.
     * 
     * @return compiler object
     */
    public XsltCompiler getXsltCompiler()
    {
        return xsltComp;
    }
    
    /**
     * Returns Saxon's XSLT executable.
     * 
     * @return executable object
     */
    public XsltExecutable getXsltExecutable()
    {
        return xsltExec;
    }

    /**
     * Returns true if XSLT stylesheets are cached.
     * 
     * @return true if cached
     */
    public boolean isCacheStylesheet()
    {
        return cacheStylesheet;
    }

    /**
     * Returns true if non-cached URI are dereferenced by the HTTP client.
     * 
     * @return true if resolving
     */
    public boolean isResolvingUncached()
    {
        return resolvingUncached;
    }
    
    /**
     * Returns URL of the server directory for uploaded files.
     * 
     * @return path as URI
     */
    public URI getUploadRoot()
    {
        return uploadRoot;
    }
    
    /**
     * Returns RDF dataset with LinkedDataHub application descriptions.
     *
     * @return RDF dataset
     */
    protected Dataset getContextDataset()
    {
        return contextDataset;
    }

    /**
     * Returns the URI of the context dataset file.
     *
     * @return context dataset URI
     */
    protected URI getContextDatasetURI()
    {
        return contextDatasetURI;
    }

    /**
     * Returns RDF model with LinkedDataHub application descriptions.
     * This method returns a union of all named graphs from the context dataset.
     *
     * @return RDF model (read-only union of all named graphs)
     */
    public Model getContextModel()
    {
        return ModelFactory.createModelForGraph(new GraphReadOnly(getContextDataset().getUnionModel().getGraph()));
    }

    /**
     * Retrieves a dataspace model by application from the context dataset.
     *
     * @param application the dataspace application
     * @return the model for the specified dataspace, or null if not found
     */
    public Model getDataspaceModel(com.atomgraph.linkeddatahub.apps.model.Application application)
    {
        if (application == null) throw new IllegalArgumentException("Application cannot be null");
        return ModelFactory.createModelForGraph(new GraphReadOnly(getContextDataset().getNamedModel(application.getURI()).getGraph()));
    }

    /**
     * Updates a dataspace by replacing its named graph with a new Model.
     * This is a template method that can be overridden by subclasses to provide alternative implementations
     * (e.g., HTTP-based updates using GraphStoreClient to a remote triplestore).
     *
     * Default implementation uses file-based operations via SystemConfigFileManager.
     *
     * @param application the dataspace application to update
     * @param newModel the new RDF model to replace the existing named graph
     * @throws IOException if an I/O error occurs
     */
    public void updateApp(com.atomgraph.linkeddatahub.apps.model.Application application, Model newModel) throws IOException
    {
        if (application == null) throw new IllegalArgumentException("Application cannot be null");
        if (newModel == null) throw new IllegalArgumentException("Model cannot be null");

        synchronized (getContextDataset())
        {
            String dataspaceURI = application.getURI();

            // Update the named graph in the dataset
            getContextDataset().removeNamedModel(dataspaceURI).
                addNamedModel(dataspaceURI, newModel);

            // Write the updated dataset back to file using RDFDataMgr
            // Support both absolute file:// URIs and relative webapp paths (like getDataset does)
            try (java.io.OutputStream out = (getContextDatasetURI().isAbsolute() ?
                    new FileOutputStream(new java.io.File(getContextDatasetURI())) :
                    new FileOutputStream(getServletConfig().getServletContext().getRealPath(getContextDatasetURI().toString()))))
            {
                Lang lang = RDFDataMgr.determineLang(getContextDatasetURI().toString(), null, null);
                if (lang == null) throw new IOException("Could not determine RDF format from dataset URI: " + getContextDatasetURI().toString());

                RDFDataMgr.write(out, getContextDataset(), lang);
                if (log.isInfoEnabled()) log.info("Updated dataspace <{}> in context dataset: {}", dataspaceURI, getContextDatasetURI());
            }
        }
    }

    /**
     * Returns true if configured to invalidate HTTP proxy cache of triplestore results.
     *
     * @return true if invalidated
     */
    public boolean isInvalidateCache()
    {
        return invalidateCache;
    }

    /**
     * Returns max age of authentication cookies.
     * 
     * @return maximum age in seconds
     */
    public Integer getCookieMaxAge()
    {
        return cookieMaxAge;
    }

    /**
     * Returns true if Linked Data proxy is enabled.
     * 
     * @return true if enabled
     */
    public boolean isEnableLinkedDataProxy()
    {
        return enableLinkedDataProxy;
    }

    /**
     * Returns true if internal/private network URLs are allowed (SSRF protection disabled).
     *
     * @return true if internal URLs are allowed
     */
    public boolean isAllowInternalUrls()
    {
        return allowInternalUrls;
    }

    /**
     * Returns the shared URLValidator instance configured for this application.
     *
     * @return the URL validator
     */
    public URLValidator getURLValidator()
    {
        return urlValidator;
    }

    /**
     * Maximum allowed request body size.
     * 
     * @return size in bytes
     */
    public Integer getMaxContentLength()
    {
        return maxContentLength;
    }

    /**
     * Keystore of the HTTP client.
     * 
     * @return keystore instance
     */
    public KeyStore getKeyStore()
    {
        return keyStore;
    }
    
    /**
     * Truststore of the HTTP client.
     * 
     * @return truststore instance
     */
    public KeyStore getTrustStore()
    {
        return trustStore;
    }

    /**
     * HTTP client instance used for CSV/RDF imports only.
     * 
     * @return client instance
     */
    public Client getImportClient()
    {
        return importClient;
    }

    /**
     * HTTP client instance that does not send the secretary's WebID client certificate.
     * 
     * @return client instance
     */
    public Client getNoCertClient()
    {
        return noCertClient;
    }
    
    /**
     * The email address from which notification emails are sent.
     * 
     * @return email address
     */
    public Address getNotificationAddress()
    {
        return notificationAddress;
    }
    
    /**
     * Returns a builder for SMTP email messages.
     * The builder is pre-configured with SMTP server credentials.
     * 
     * @return builder object
     */
    public final MessageBuilder getMessageBuilder()
    {
        if (authenticator != null) return MessageBuilder.fromPropertiesAndAuth(emailProperties, authenticator);
        else return MessageBuilder.fromProperties(emailProperties);
    }
    
    /**
     * A map of cached WebID documents.
     * WebID URI is the cache key. Entries expire after the configured period of time.
     * 
     * @return URI to model map
     */
    public ExpiringMap<URI, Model> getWebIDModelCache()
    {
        return webIDmodelCache;
    }

    /**
     * A map of cached OpenID connect agent graphs.
     * User ID (ID token subject) is the cache key. Entries expire after the configured period of time.
     *
     * @return URI to model map
     */
    public ExpiringMap<String, Model> getOIDCModelCache()
    {
        return oidcModelCache;
    }

    /**
     * A map of cached JWKS (JSON Web Key Set) responses for JWT verification.
     * JWKS endpoint URI is the cache key. Entries expire after 1 day.
     *
     * @return JWKS endpoint to JsonObject map
     */
    public ExpiringMap<String, jakarta.json.JsonObject> getJWKSCache()
    {
        return jwksCache;
    }

    /**
     * A map of cached (compiled) XSLT stylesheets.
     * Stylesheet URI is the cache key.
     *
     * @return URI to stylesheet map
     */
    public Map<URI, XsltExecutable> getXsltExecutableCache()
    {
        return xsltExecutableCache;
    }
    
    /**
     * Message digest used in SHA1 hashing.
     * 
     * @return digest object
     */
    public MessageDigest getMessageDigest()
    {
        return messageDigest;
    }
    
    /**
     * Returns list of locales for languages supported by the UI.
     * 
     * @return locale list
     */
    public List<Locale> getSupportedLanguages()
    {
        return supportedLanguages;
    }
    
    /**
     * Returns true if WebID signup is enabled.
     * 
     * @return true if enabled
     */
    public boolean isEnableWebIDSignUp()
    {
        return enableWebIDSignUp;
    }
    
    /**
     * Gets refresh token from persistent storage.
     * 
     * @param clientID OAuth client ID
     * @return refresh token
     */
    public String getRefreshToken(String clientID)
    {
        return oidcRefreshTokens.getProperty(clientID);
    }
    
    /**
     * Persistently stores refresh token.
     * 
     * @param clientID OAuth client ID
     * @param refreshToken refresh token value
     * @throws IOException error writing the properties file
     */
    public void storeRefreshToken(String clientID, String refreshToken) throws IOException
    {
        oidcRefreshTokens.put(clientID, refreshToken);
        
        try (FileOutputStream fos = new FileOutputStream(oidcRefreshTokensPropertiesPath))
        {
            oidcRefreshTokens.store(fos, null);
        }
    }
    
}