Allow query to be executed from stored URI

Author: adamretter

src/main/xar-resources/api.xqm

@@ -584,6 +584,7 @@ function api:restxq() {
     )
 };
 
+
 declare
     %rest:POST("{$body}")
     %rest:path("/pebble/query")
@@ -605,7 +606,7 @@ function api:query($range-header, $body) {
     then
         api:cors-allow(
             map {
-                "code": $hsc:unauthorized,
+                "code": $hsc:forbidden,
                 "reason": "Guest is not allowed to execute arbitary queries"
             },
             ()

src/main/xar-resources/modules/query.xqm

@@ -16,7 +16,16 @@ import module namespace util = "http://exist-db.org/xquery/util";
  :)
 declare function qry:execute($query-data as map(xs:string, xs:string),
         $start as xs:integer?, $length as xs:integer?) as xs:string {
-    let $query := $query-data?query
+
+    let $query :=
+        if ($query-data?query-uri)
+        then
+            let $query-doc := util:binary-doc($query-data?query-uri)
+            return
+                util:base64-decode($query-doc)
+        else
+            $query-data?query
+
     let $serialization := $query-data?defaultSerialization
     let $eval-ser-fn :=
         if (not(empty($start)) and not(empty($length)))