List space non-approved role claims (ref-scoped)
has assertion: assertion
has provenance: provenance
has publication info: pubinfo
type: Nanopublication
created: 2026-08-19T06:58:30Z
creator: Tobias Kuhn
license: https://creativecommons.org/licenses/by/4.0/
embeds: List space non-approved role claims (ref-scoped)

List space non-approved role claims (ref-scoped)
description: Lists the non-approved role claims of a given space ref (space IRI + root definition): agents who hold a higher-tier role instantiation (admin/maintainer/member) that is NOT in the trust-validated current state, i.e. a self-assigned or otherwise ungranted claim awaiting approval by an equal-or-higher-tier member. Pass the ref's root nanopub (root_np). Observer-tier roles are excluded: they are self-assignable, so a self-declared observer needs no approval and is shown by list-space-observers instead. The higher-tier test is generic — the built-in admin property (gen:hasAdmin) OR a RoleDeclaration whose npa:hasRoleType is gen:AdminRole/gen:MaintainerRole/gen:MemberRole. Per (member, role) only the latest role-instantiation nanopub is considered (by dct:created). Returns one row per member with the claimed tier, the grant nanopub(s) with the claimed role's label (role_assignments_multi_iri + role_assignments_label_multi), and a consistent (approve_np, grant_template) pair for the approve action: the granting nanopublication to derive from and the template to open it with. v2: adds the role_assignments columns. v3: resolves owl:sameAs space aliases (via the ref's validated npa:sameAsSpace edges in the current-state graph), so a higher-tier claim made against an alias IRI of the space is detected. v4: the invalidation filter honours an npx:invalidates edge only when the invalidating nanopub shares a signing pubkey (npa:hasValidSignatureForPublicKeyHash) with the grant it targets, so a foreign-key retraction can no longer suppress another agent's claim (issue #487 / same gate as the materializer's #112). v5: BUGFIX — the v3/v4 space-alias resolution used a BIND-in-UNION pattern that RDF4J leaves unbound, so the query returned ZERO rows for every space; replaced with a non-union filter/exists that restores detection while keeping alias resolution. v6: adds an approve_np column holding the granting nanopublication for each pending row. v7 (nanodash issue #603): replaces th…
license: LICENSE-2.0
type: grlc-query
endpoint: spaces
sparql: prefix rdfs: <http://www.w3.org/2000/01/rdf-schema#> prefix dct: <http://purl.org/dc/terms/> prefix np: <http://www.nanopub.org/nschema#> prefix npa: <http://purl.org/nanopub/admin/> prefix npx: <http://purl.org/nanopub/x/> prefix nt: <https://w3id.org/np/o/ntemplate/> prefix gen: <https://w3id.org/kpxl/gen/terms/> prefix schema: <http://schema.org/> select ?member (strafter(min(?tierKey), " ") as ?tier) (group_concat(distinct ?latestNp; separator=" ") as ?role_assignments_multi_iri) (group_concat(distinct ?roleLabel; separator="\n") as ?role_assignments_label_multi) (strbefore(strafter(min(?pair), " "), " ") as ?approve_np) (strafter(strafter(min(?pair), " "), " ") as ?grant_template) where { { select ?member ?roleProp (max(?val0) as ?val) (strafter(max(concat(coalesce(str(?dateNp),""), " ", str(?grantNp))), " ") as ?latestNp) (sample(?tier0) as ?tierX) (sample(?rl) as ?rlRaw) where { values ?_root_np_multi_iri {} graph npa:spacesGraph { ?ref npa:rootNanopub ?_root_np_multi_iri ; npa:spaceIri ?spaceIri . } graph npa:graph { npa:thisRepo npa:hasCurrentSpaceState ?g . } graph npa:spacesGraph { ?ri a gen:RoleInstantiation ; npa:forSpace ?inSpace ; npa:forAgent ?member ; npa:viaNanopub ?grantNp ; (npa:regularProperty|npa:inverseProperty) ?roleProp . } filter( ?inSpace = ?spaceIri || exists { graph ?g { ?inSpace npa:sameAsSpace ?ref } } ) bind(?roleProp = gen:hasAdmin as ?isAdminProp) bind(exists { graph npa:spacesGraph { ?rdA a npa:RoleDeclaration ; npa:hasRoleType gen:AdminRole ; (gen:hasRegularProperty|gen:hasInverseProperty) ?roleProp } } as ?isAdminDecl) bind(exists { graph npa:spacesGraph { ?rdM a npa:RoleDeclaration ; npa:hasRoleType gen:MaintainerRole ; (gen:hasRegularProperty|gen:hasInverseProperty) ?roleProp } } as ?isMaint) bind(exists { graph npa:spacesGraph { ?rdMe a npa:RoleDeclaration ; npa:hasRoleType gen:MemberRole ; (gen:hasRegularProperty|gen:hasInverseProperty) ?roleProp } } as ?isMemb) filter(?isAdminProp || ?isAdminDecl || ?isMaint || ?isMemb) filt…

sig
has algorithm: RSA
signed by: Tobias Kuhn