AtomGraph · namedgraph · Dec 12, 2025 · Dec 12, 2025 · Dec 14, 2025 · Dec 14, 2025
diff --git a/README.md b/README.md
@@ -187,7 +187,7 @@ The options are described in more detail in the [configuration documentation](ht
 
   If you need to start fresh and wipe the existing setup (e.g. after configuring a new base URI), you can do that using
   ```shell
-  sudo rm -rf data uploads && docker-compose down -v
+  sudo rm -rf fuseki uploads ssl datasets && docker-compose down -v
   ```
 
 _:warning: This will **remove the persisted data and files** as well as Docker volumes._

diff --git a/bin/admin/install-package.sh b/bin/admin/install-package.sh
@@ -0,0 +1,101 @@
+#!/usr/bin/env bash
+
+print_usage()
+{
+    printf "Installs a LinkedDataHub package.\n"
+    printf "\n"
+    printf "Usage:  %s options\n" "$0"
+    printf "\n"
+    printf "Options:\n"
+    printf "  -b, --base BASE_URL                  Base URL of the application\n"
+    printf "  -f, --cert-pem-file CERT_FILE        .pem file with the WebID certificate of the agent\n"
+    printf "  -p, --cert-password CERT_PASSWORD    Password of the WebID certificate\n"
+    printf "  --proxy PROXY_URL                    The host this request will be proxied through (optional)\n"
+    printf "  --package PACKAGE_URI                URI of the package to install (e.g., https://packages.linkeddatahub.com/skos/#this)\n"
+    printf "\n"
+    printf "Example:\n"
+    printf "  %s -b https://localhost:4443/ -f ssl/owner/cert.pem -p Password --package https://packages.linkeddatahub.com/skos/#this\n" "$0"
+}
+
+hash curl 2>/dev/null || { echo >&2 "curl not on \$PATH. Aborting."; exit 1; }
+
+unknown=()
+while [[ $# -gt 0 ]]
+do
+    key="$1"
+
+    case $key in
+        -b|--base)
+        base="$2"
+        shift # past argument
+        shift # past value
+        ;;
+        -f|--cert-pem-file)
+        cert_pem_file="$2"
+        shift # past argument
+        shift # past value
+        ;;
+        -p|--cert-password)
+        cert_password="$2"
+        shift # past argument
+        shift # past value
+        ;;
+        --proxy)
+        proxy="$2"
+        shift # past argument
+        shift # past value
+        ;;
+        --package)
+        package_uri="$2"
+        shift # past argument
+        shift # past value
+        ;;
+        *)    # unknown option
+        unknown+=("$1") # save it in an array for later
+        shift # past argument
+        ;;
+    esac
+done
+set -- "${unknown[@]}" # restore args
+
+if [ -z "$base" ] ; then
+    print_usage
+    exit 1
+fi
+if [ -z "$cert_pem_file" ] ; then
+    print_usage
+    exit 1
+fi
+if [ -z "$cert_password" ] ; then
+    print_usage
+    exit 1
+fi
+if [ -z "$package_uri" ] ; then
+    print_usage
+    exit 1
+fi
+
+# Convert base URL to admin base URL
+admin_uri() {
+    local uri="$1"
+    echo "$uri" | sed 's|://|://admin.|'
+}
+
+admin_base=$(admin_uri "$base")
+target_url="${admin_base}install-package"
+
+if [ -n "$proxy" ]; then
+    admin_proxy=$(admin_uri "$proxy")
+    # rewrite target hostname to proxy hostname
+    url_host=$(echo "$target_url" | cut -d '/' -f 1,2,3)
+    proxy_host=$(echo "$admin_proxy" | cut -d '/' -f 1,2,3)
+    final_url="${target_url/$url_host/$proxy_host}"
+else
+    final_url="$target_url"
+fi
+
+# POST to install-package endpoint
+curl -k -w "%{http_code}\n" -E "${cert_pem_file}":"${cert_password}" \
+    -H "Accept: text/turtle" \
+    -d "package-uri=${package_uri}" \
+    "${final_url}"
diff --git a/config/system.trig b/config/system.trig
@@ -18,7 +18,7 @@
 <urn:linkeddatahub:apps/admin> a lapp:Application, lapp:AdminApplication ;
     dct:title "LinkedDataHub admin" ;
     # ldt:base <https://admin.localhost:4443/> ;
-    ldh:origin <https://admin.localhost:4443> ;
+    lapp:origin <https://admin.localhost:4443> ;
     ldt:ontology <https://w3id.org/atomgraph/linkeddatahub/admin#> ;
     ldt:service <urn:linkeddatahub:services/admin> ;
     ac:stylesheet <static/com/atomgraph/linkeddatahub/xsl/bootstrap/2.3.2/admin/layout.xsl> ;
@@ -38,7 +38,7 @@
 <urn:linkeddatahub:apps/end-user> a lapp:Application, lapp:EndUserApplication ;
     dct:title "LinkedDataHub" ;
     # ldt:base <https://localhost:4443/> ;
-    ldh:origin <https://localhost:4443> ;
+    lapp:origin <https://localhost:4443> ;
     ldt:ontology <https://localhost:4443/ns#> ;
     ldt:service <urn:linkeddatahub:services/end-user> ;
     lapp:adminApplication <urn:linkeddatahub:apps/admin> ;

diff --git a/http-tests/admin/packages/install-package-400.sh b/http-tests/admin/packages/install-package-400.sh
@@ -0,0 +1,16 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+initialize_dataset "$END_USER_BASE_URL" "$TMP_END_USER_DATASET" "$END_USER_ENDPOINT_URL"
+initialize_dataset "$ADMIN_BASE_URL" "$TMP_ADMIN_DATASET" "$ADMIN_ENDPOINT_URL"
+purge_cache "$END_USER_VARNISH_SERVICE"
+purge_cache "$ADMIN_VARNISH_SERVICE"
+purge_cache "$FRONTEND_VARNISH_SERVICE"
+
+# Missing package-uri parameter should return 400 Bad Request
+curl -k -w "%{http_code}\n" -o /dev/null -s \
+  -E "$OWNER_CERT_FILE":"$OWNER_CERT_PWD" \
+  -X POST \
+  -H "Content-Type: application/x-www-form-urlencoded" \
+  "${ADMIN_BASE_URL}packages/install" \
+| grep -q "$STATUS_BAD_REQUEST"
diff --git a/http-tests/admin/packages/install-package-403.sh b/http-tests/admin/packages/install-package-403.sh
@@ -0,0 +1,16 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+initialize_dataset "$END_USER_BASE_URL" "$TMP_END_USER_DATASET" "$END_USER_ENDPOINT_URL"
+initialize_dataset "$ADMIN_BASE_URL" "$TMP_ADMIN_DATASET" "$ADMIN_ENDPOINT_URL"
+purge_cache "$END_USER_VARNISH_SERVICE"
+purge_cache "$ADMIN_VARNISH_SERVICE"
+purge_cache "$FRONTEND_VARNISH_SERVICE"
+
+# Unauthorized access (without certificate) should return 403 Forbidden
+curl -k -w "%{http_code}\n" -o /dev/null -s \
+  -X POST \
+  -H "Content-Type: application/x-www-form-urlencoded" \
+  --data-urlencode "package-uri=https://packages.linkeddatahub.com/skos/#this" \
+  "${ADMIN_BASE_URL}packages/install" \
+| grep -q "$STATUS_FORBIDDEN"
diff --git a/http-tests/admin/packages/install-package-404.sh b/http-tests/admin/packages/install-package-404.sh
@@ -0,0 +1,18 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+initialize_dataset "$END_USER_BASE_URL" "$TMP_END_USER_DATASET" "$END_USER_ENDPOINT_URL"
+initialize_dataset "$ADMIN_BASE_URL" "$TMP_ADMIN_DATASET" "$ADMIN_ENDPOINT_URL"
+purge_cache "$END_USER_VARNISH_SERVICE"
+purge_cache "$ADMIN_VARNISH_SERVICE"
+purge_cache "$FRONTEND_VARNISH_SERVICE"
+
+# Invalid/non-existent package URI should return 404 Not Found
+# (the HTTP client error from the remote package server is re-thrown)
+curl -k -w "%{http_code}\n" -o /dev/null -s \
+  -E "$OWNER_CERT_FILE":"$OWNER_CERT_PWD" \
+  -X POST \
+  -H "Content-Type: application/x-www-form-urlencoded" \
+  --data-urlencode "package-uri=https://packages.linkeddatahub.com/nonexistent/#package" \
+  "${ADMIN_BASE_URL}packages/install" \
+| grep -q "$STATUS_NOT_FOUND"
diff --git a/http-tests/admin/packages/install-package.sh b/http-tests/admin/packages/install-package.sh
@@ -0,0 +1,28 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+initialize_dataset "$END_USER_BASE_URL" "$TMP_END_USER_DATASET" "$END_USER_ENDPOINT_URL"
+initialize_dataset "$ADMIN_BASE_URL" "$TMP_ADMIN_DATASET" "$ADMIN_ENDPOINT_URL"
+purge_cache "$END_USER_VARNISH_SERVICE"
+purge_cache "$ADMIN_VARNISH_SERVICE"
+purge_cache "$FRONTEND_VARNISH_SERVICE"
+
+# test package URI (SKOS package)
+package_uri="https://packages.linkeddatahub.com/skos/#this"
+
+# install package via POST to packages/install endpoint
+curl -k -w "%{http_code}\n" -o /dev/null -f -s \
+  -E "$OWNER_CERT_FILE":"$OWNER_CERT_PWD" \
+  -X POST \
+  -H "Content-Type: application/x-www-form-urlencoded" \
+  --data-urlencode "package-uri=$package_uri" \
+  "${ADMIN_BASE_URL}packages/install" \
+| grep -q "$STATUS_SEE_OTHER"
+
+# verify package stylesheet was installed (should return 200)
+curl -k -f -s -o /dev/null \
+  "$END_USER_BASE_URL"static/com/linkeddatahub/packages/skos/layout.xsl
+
+# verify master stylesheet was regenerated and includes package import
+curl -k -s "${END_USER_BASE_URL}static/localhost/layout.xsl" \
+  | grep -q "com/linkeddatahub/packages/skos/layout.xsl"
diff --git a/http-tests/admin/packages/install-uninstall-package.sh b/http-tests/admin/packages/install-uninstall-package.sh
@@ -0,0 +1,46 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+initialize_dataset "$END_USER_BASE_URL" "$TMP_END_USER_DATASET" "$END_USER_ENDPOINT_URL"
+initialize_dataset "$ADMIN_BASE_URL" "$TMP_ADMIN_DATASET" "$ADMIN_ENDPOINT_URL"
+purge_cache "$END_USER_VARNISH_SERVICE"
+purge_cache "$ADMIN_VARNISH_SERVICE"
+purge_cache "$FRONTEND_VARNISH_SERVICE"
+
+# test package URI (SKOS package)
+package_uri="https://packages.linkeddatahub.com/skos/#this"
+
+# install package
+curl -k -w "%{http_code}\n" -o /dev/null -f -s \
+  -E "$OWNER_CERT_FILE":"$OWNER_CERT_PWD" \
+  -X POST \
+  -H "Content-Type: application/x-www-form-urlencoded" \
+  --data-urlencode "package-uri=$package_uri" \
+  "$ADMIN_BASE_URL"packages/install \
+| grep -q "$STATUS_SEE_OTHER"
+
+# verify package stylesheet was installed (should return 200)
+curl -k -f -s -o /dev/null \
+  "${END_USER_BASE_URL}static/com/linkeddatahub/packages/skos/layout.xsl"
+
+# verify master stylesheet includes package
+curl -k -s "$END_USER_BASE_URL"static/localhost/layout.xsl \
+  | grep -q "com/linkeddatahub/packages/skos/layout.xsl"
+
+# uninstall package
+curl -k -w "%{http_code}\n" -o /dev/null -f -s \
+  -E "$OWNER_CERT_FILE":"$OWNER_CERT_PWD" \
+  -X POST \
+  -H "Content-Type: application/x-www-form-urlencoded" \
+  --data-urlencode "package-uri=$package_uri" \
+  "$ADMIN_BASE_URL"packages/uninstall \
+| grep -q "$STATUS_SEE_OTHER"
+
+# verify package stylesheet was deleted (should return 404)
+curl -k -w "%{http_code}\n" -o /dev/null -s \
+  "${END_USER_BASE_URL}static/com/linkeddatahub/packages/skos/layout.xsl" \
+| grep -q "$STATUS_NOT_FOUND"
+
+# verify master stylesheet no longer includes package
+curl -k -s "$END_USER_BASE_URL"static/localhost/layout.xsl \
+  | grep -v -q "com/linkeddatahub/packages/skos/layout.xsl"
diff --git a/http-tests/admin/packages/uninstall-package-400.sh b/http-tests/admin/packages/uninstall-package-400.sh
@@ -0,0 +1,16 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+initialize_dataset "$END_USER_BASE_URL" "$TMP_END_USER_DATASET" "$END_USER_ENDPOINT_URL"
+initialize_dataset "$ADMIN_BASE_URL" "$TMP_ADMIN_DATASET" "$ADMIN_ENDPOINT_URL"
+purge_cache "$END_USER_VARNISH_SERVICE"
+purge_cache "$ADMIN_VARNISH_SERVICE"
+purge_cache "$FRONTEND_VARNISH_SERVICE"
+
+# Missing package-uri parameter should return 400 Bad Request
+curl -k -w "%{http_code}\n" -o /dev/null -s \
+  -E "$OWNER_CERT_FILE":"$OWNER_CERT_PWD" \
+  -X POST \
+  -H "Content-Type: application/x-www-form-urlencoded" \
+  "{$ADMIN_BASE_URL}packages/uninstall" \
+| grep -q "$STATUS_BAD_REQUEST"
diff --git a/http-tests/admin/packages/uninstall-package.sh b/http-tests/admin/packages/uninstall-package.sh
@@ -0,0 +1,42 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+initialize_dataset "$END_USER_BASE_URL" "$TMP_END_USER_DATASET" "$END_USER_ENDPOINT_URL"
+initialize_dataset "$ADMIN_BASE_URL" "$TMP_ADMIN_DATASET" "$ADMIN_ENDPOINT_URL"
+purge_cache "$END_USER_VARNISH_SERVICE"
+purge_cache "$ADMIN_VARNISH_SERVICE"
+purge_cache "$FRONTEND_VARNISH_SERVICE"
+
+# test package URI (SKOS package)
+package_uri="https://packages.linkeddatahub.com/skos/#this"
+
+# first install the package
+curl -k -w "%{http_code}\n" -o /dev/null -f -s \
+  -E "$OWNER_CERT_FILE":"$OWNER_CERT_PWD" \
+  -X POST \
+  -H "Content-Type: application/x-www-form-urlencoded" \
+  --data-urlencode "package-uri=$package_uri" \
+  "${ADMIN_BASE_URL}packages/install" \
+| grep -q "$STATUS_SEE_OTHER"
+
+# verify package stylesheet exists before uninstall (should return 200)
+curl -k -f -s -o /dev/null \
+  "${END_USER_BASE_URL}static/com/linkeddatahub/packages/skos/layout.xsl"
+
+# uninstall package via POST to packages/uninstall endpoint
+curl -k -w "%{http_code}\n" -o /dev/null -f -s \
+  -E "$OWNER_CERT_FILE":"$OWNER_CERT_PWD" \
+  -X POST \
+  -H "Content-Type: application/x-www-form-urlencoded" \
+  --data-urlencode "package-uri=$package_uri" \
+  "${ADMIN_BASE_URL}packages/uninstall" \
+| grep -q "$STATUS_SEE_OTHER"
+
+# verify package stylesheet was deleted (should return 404)
+curl -k -w "%{http_code}\n" -o /dev/null -s \
+  "${END_USER_BASE_URL}static/com/linkeddatahub/packages/skos/layout.xsl" \
+| grep -q "$STATUS_NOT_FOUND"
+
+# verify master stylesheet was regenerated without package import
+curl -k -s "$END_USER_BASE_URL"static/localhost/layout.xsl \
+  | grep -v -q "com/linkeddatahub/packages/skos/layout.xsl"
diff --git a/http-tests/config/system.trig b/http-tests/config/system.trig
@@ -18,7 +18,7 @@
 <urn:linkeddatahub:apps/admin> a lapp:Application, lapp:AdminApplication ;
     dct:title "LinkedDataHub admin" ;
     # ldt:base <https://admin.localhost:4443/> ;
-    ldh:origin <https://admin.localhost:4443> ;
+    lapp:origin <https://admin.localhost:4443> ;
     ldt:ontology <https://w3id.org/atomgraph/linkeddatahub/admin#> ;
     ldt:service <urn:linkeddatahub:services/admin> ;
     ac:stylesheet <static/com/atomgraph/linkeddatahub/xsl/bootstrap/2.3.2/admin/layout.xsl> ;
@@ -38,7 +38,7 @@
 <urn:linkeddatahub:apps/end-user> a lapp:Application, lapp:EndUserApplication ;
     dct:title "LinkedDataHub" ;
     # ldt:base <https://localhost:4443/> ;
-    ldh:origin <https://localhost:4443> ;
+    lapp:origin <https://localhost:4443> ;
     ldt:ontology <https://localhost:4443/ns#> ;
     ldt:service <urn:linkeddatahub:services/end-user> ;
     lapp:adminApplication <urn:linkeddatahub:apps/admin> ;
@@ -57,7 +57,7 @@
 
 <urn:linkeddatahub:apps/test/admin> a lapp:Application, lapp:AdminApplication ;
     dct:title "Test admin" ;
-    ldh:origin <https://admin.test.localhost:4443> ;
+    lapp:origin <https://admin.test.localhost:4443> ;
     ldt:ontology <https://w3id.org/atomgraph/linkeddatahub/admin#> ;
     ldt:service <urn:linkeddatahub:services/test/admin> ;
     ac:stylesheet <static/com/atomgraph/linkeddatahub/xsl/bootstrap/2.3.2/admin/layout.xsl> ;
@@ -76,7 +76,7 @@
 
 <urn:linkeddatahub:apps/test/end-user> a lapp:Application, lapp:EndUserApplication ;
     dct:title "Test" ;
-    ldh:origin <https://test.localhost:4443> ;
+    lapp:origin <https://test.localhost:4443> ;
     ldt:ontology <https://test.localhost:4443/ns#> ;
     ldt:service <urn:linkeddatahub:services/test/end-user> ;
     lapp:adminApplication <urn:linkeddatahub:apps/test/admin> ;

diff --git a/http-tests/proxy/GET-proxied-403.sh b/http-tests/proxy/GET-proxied-403.sh
@@ -0,0 +1,36 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+initialize_dataset "$END_USER_BASE_URL" "$TMP_END_USER_DATASET" "$END_USER_ENDPOINT_URL"
+initialize_dataset "$ADMIN_BASE_URL" "$TMP_ADMIN_DATASET" "$ADMIN_ENDPOINT_URL"
+purge_cache "$END_USER_VARNISH_SERVICE"
+purge_cache "$ADMIN_VARNISH_SERVICE"
+purge_cache "$FRONTEND_VARNISH_SERVICE"
+
+# add agent to the readers group to be able to read documents
+
+add-agent-to-group.sh \
+  -f "$OWNER_CERT_FILE" \
+  -p "$OWNER_CERT_PWD" \
+  --agent "$AGENT_URI" \
+  "${ADMIN_BASE_URL}acl/groups/readers/"
+
+# Test that status codes are correctly proxied through
+# Generate a random UUID for a non-existing resource
+random_uuid=$(cat /proc/sys/kernel/random/uuid 2>/dev/null || uuidgen)
+non_existing_uri="${END_USER_BASE_URL}${random_uuid}/"
+
+# Attempt to proxy a non-existing document on the END_USER_BASE_URL
+# This should return 403 Forbidden (not found resources return 403 in LinkedDataHub)
+http_status=$(curl -k -s -o /dev/null -w "%{http_code}" \
+  -G \
+  -E "$AGENT_CERT_FILE":"$AGENT_CERT_PWD" \
+  -H 'Accept: application/n-triples' \
+  --data-urlencode "uri=${non_existing_uri}" \
+  "$END_USER_BASE_URL" || true)
+
+# Verify that the proxied status code matches the backend status code (403)
+if [ "$http_status" != "403" ]; then
+    echo "Expected HTTP 403 Forbidden for non-existing proxied document, got: $http_status"
+    exit 1
+fi
diff --git a/http-tests/proxy/POST-proxied-form.sh b/http-tests/proxy/POST-proxied-form.sh
@@ -19,7 +19,7 @@ add-agent-to-group.sh \
 
 curl -k -w "%{http_code}\n" -o /dev/null -f -s \
   -X POST \
-  -E "$AGENT_CERT_FILE":"$AGENT_CERT_PWD" \
+  -E "$OWNER_CERT_FILE":"$OWNER_CERT_PWD" \
   -H 'Content-Type: application/x-www-form-urlencoded' \
   -H 'Accept: application/rdf+xml' \
   --url-query "uri=${ADMIN_BASE_URL}clear" \