From e802a32ec7d0b37d8952903650f6dd5b99e22007 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=C3=81lvaro=20Tejero=20Cantero?= <alvorithm@teje.ro>
Date: Fri, 7 Aug 2026 01:15:18 +0200
Subject: [PATCH] :sparkles: Refuse a mutating query from the graph console

`debug/query-session!` ran whatever it was handed against the session
connection. A session graph is a projection of a file, rebuilt from that
file by Reload, so a mutation from the console produces a graph no
rebuild reproduces and no query result explains.

Bind the statement against the live schema first. A statement that does
not bind reports the binder's own message and executes nothing, which
also turns a misspelt table or property into an immediate error instead
of an empty result. A statement that binds runs only when the engine's
own read/write analysis calls it read-only.

The console's query box is labelled read-only. Load, Reload, Unload and
live sync are unaffected: they are separate handlers and do not go
through this path.

AI-assisted-by: mixed models
---
 .../app/templates/graph-console.tmpl          |  4 ++--
 backend/src/app/graph/debug.clj               | 22 ++++++++++++++++---
 2 files changed, 21 insertions(+), 5 deletions(-)

diff --git a/backend/resources/app/templates/graph-console.tmpl b/backend/resources/app/templates/graph-console.tmpl
index 7a7a8f8b83..4be3025d54 100644
--- a/backend/resources/app/templates/graph-console.tmpl
+++ b/backend/resources/app/templates/graph-console.tmpl
@@ -88,8 +88,8 @@ Graph Console
     </fieldset>
 
     <fieldset>
-      <legend>Query graph (<a href="https://docs.ladybugdb.com/cypher/"
-                              target="_blank">LadybugDB Cypher</a>)</legend>
+      <legend>Query graph, read-only (<a href="https://docs.ladybugdb.com/cypher/"
+                                         target="_blank">LadybugDB Cypher</a>)</legend>
       <form id="graph-query-form" method="post" action="/dbg/actions/graph-query">
         <div class="row">
           <textarea name="query" rows="8" style="width:100%; font-family: monospace;"
diff --git a/backend/src/app/graph/debug.clj b/backend/src/app/graph/debug.clj
index 0f6146a534..277b1ae177 100644
--- a/backend/src/app/graph/debug.clj
+++ b/backend/src/app/graph/debug.clj
@@ -200,7 +200,14 @@
         (throw cause)))))
 
 (defn query-session!
-  "Run `statement` against the in-memory graph for `profile-id`."
+  "Run a read-only `statement` against the in-memory graph for `profile-id`.
+
+  The statement is bound against the live schema before it runs, so a query
+  naming a table or a property that does not exist reports the binder's own
+  message and executes nothing. The engine's read/write analysis then decides
+  whether it may run at all: the console is an inspection surface, and a
+  session graph is rebuilt from the file by Reload, so a mutation from here
+  would produce a graph no rebuild reproduces."
   [profile-id statement]
   (when (str/blank? statement)
     (ex/raise :type :validation
@@ -208,8 +215,17 @@
               :hint "cypher query is required"))
   (if-let [{:keys [conn lock]} (get @sessions (session-key profile-id))]
     (locking lock
-      (-> (ladybug/query-on-connection! conn statement)
-          format-query-result))
+      (let [{:keys [ok? error read-only?]} (ladybug/validate-on-connection! conn statement)]
+        (when-not ok?
+          (ex/raise :type :validation
+                    :code :graph-query-invalid
+                    :hint error))
+        (when-not read-only?
+          (ex/raise :type :validation
+                    :code :graph-query-not-read-only
+                    :hint "the graph console runs read-only queries"))
+        (-> (ladybug/query-on-connection! conn statement)
+            format-query-result)))
     (ex/raise :type :not-found
               :code :graph-session-not-loaded
               :hint "load a file graph before running queries")))