Bug: GraphController has no class-level @RequestMapping and bypasses service layer

[Brad-Edwards]

Description

GraphController is structurally inconsistent with all other controllers:

1. No class-level @RequestMapping — paths are inlined on each method, mixing /api/v1/admin/graph/ and /api/v1/graph/ with no organizational structure. Every other controller uses @RequestMapping at the class level.

2. No service layer — directly injects GraphClient (a domain port interface) instead of going through a domain service. This bypasses any future validation, authorization, or auditing at the service layer. All other controllers delegate to services.

3. Raw return types — getAncestors and getDescendants return List<String> (raw UIDs). findPaths returns List<List<String>>. Every other endpoint returns structured DTOs. This makes these endpoints impossible to extend without breaking clients.

4. TODO left to rot — // TODO: split admin/read endpoints into separate controllers has not been addressed.

Location: GraphController.java

Traced Requirements

• GC-G001: Ancestor-Descendant Traversal
• GC-G004: Apache AGE Materialization
• GC-A012: Dual API Exposure

Impact

Maintainability, API consistency, and future auth/auditing integration.