SSR/legacy-URL follow-ups: fixes still needed on other customer branches #1598

These are follow-ups from the TUL/ZCU SSR investigation: what still needs fixing on the other customer branches. Branch facts were checked against origin/* on 2026-10-13 with git show/git grep. Items marked unverified come from reading the code only and were not reproduced.

PRs already opened from this investigation: #1587 (merged), #1592 (merged), #1593, #1594, #1595, #1596, and the TUL /handle PR (in progress).

1. SSR runs Critters after every 302 (slow download redirects)

server.ts does not pass inlineCriticalCss: false to ngExpressEngine, so Critters runs on every render. That includes /bitstreams/:id/download, where the HTML is thrown away after the 302 has been sent. On TUL this cost about 1.1–1.5 s of CPU per download, and with #1592 it dropped to about 25 ms. Fix: upstream DSpace#2067 + DSpace#3051 (cherry-picked in #1592).

2. Double-encoded CLARIN license names with + (submission license step)

Branches that have upstream DSpace#3032 (RequestParam encodes values) still call encodeURIComponent(licenseName) by hand. A license such as GNU GPL 2.0+ ends up encoded twice, so the byName lookup finds nothing. Fix: #1596 (dtq-dev).

3. RequestParam values are not encoded (upstream DSpace#3032 + DSpace#3055 missing)

Without upstream DSpace#3032 + DSpace#3055, values are joined into REST URLs raw. On TUL this caused legacy bitstream URLs with &/+ to return a 200 login page. Non-ASCII filenames failed with ERR_UNESCAPED_CHARACTERS and the SSR render hung, giving a 504 and about 4.5 MiB of memory held per request. Fix on TUL: #1593.

On ZCU (zcu-pub/zcu-data), the legacy resolver encodes the filename itself (encodeRFC3986URIComponent), so it does not hit the TUL symptoms. Other RequestParam callers are still unencoded. When backporting, drop the manual license workaround (2) and check the ZCU resolver for double encoding.

4. Legacy ?sequence= links (BitstreamUrlSerializer)

• customer/zcu-pub is the only branch still on the broken ZCU-PUB/Fixed encoding of the filename from the URL #838 serializer, so ?sequence=N&isAllowed=y links get a 200 login page. Fixed by ZCU-PUB: keep the query string in legacy /bitstream/handle URLs (backport #873) #1594.
• The follow-up fix (a second raw ? and #fragment were mishandled) is BitstreamUrlSerializer: keep the full query string and fragment #1595 on dtq-dev. customer/lindat, customer/vsb-tuo, customer/mendelu-v7 (and palo-docker*) have the UFAL/Filename encoding encodes the fileName with the rest of the URL #873 version and need BitstreamUrlSerializer: keep the full query string and fragment #1595 after it is merged.
• No serializer: zcu, zcu-data, TUL, uk, sav, jcu, mendelu, dtq-dev-9.

5. SSR cache stores any status matching /^20+/, not only 200

Every branch except customer/TUL (#1587) still uses upstream's hasNotSucceeded() with /^20+/. The cache does not store the status code: cacheCheck() replays every hit with res.send(), which Express sends as 200. So the only correct rule is statusCode === 200. Today SSR only sets 200, 301/302 and 401/403/404/500, so there is no live bug yet. The change is a one-line hardening. Branches: dtq-dev, dtq-dev-9, lindat, vsb-tuo, sav, uk, zcu, zcu-pub, zcu-data, jcu, mendelu, mendelu-v7.

6. Production images discard container stdout/stderr

The Dockerfile CMD is pm2-runtime start … > /dev/null 2> /dev/null. The V8 FATAL ERROR … heap out of memory line and pm2's exited with code … SIGABRT go to container stdout, so the reason a worker restarted is lost (seen on TUL). Affected: dtq-dev, TUL, lindat, vsb-tuo, sav, uk, zcu, zcu-pub, zcu-data, mendelu-v7. Not affected: jcu, mendelu, dtq-dev-9. Suggested fix: drop the redirect, and use Docker log rotation (max-size) if log volume is the concern.

7. Legacy bitstream sequence is ignored (all branches, upstream too)

The frontend sends the REST parameter sequenceId, the backend reads sequence, and the legacy resolver ignores ?sequence= anyway. Items with two files of the same name always resolve to the first one (2 of 240 test links on ZCU).

8. Smaller items (not yet triaged per branch)

• zcu-pub: the legacy resolver throws on a literal % in a filename (decodeURIComponent). Unverified in the lab.
• dtq-dev / lindat: Codex flagged that the legacy guard/REST lookup may not encode filenames with &, +, ?, #. Unverified. These branches have [Port dspace-7_x] Encode all RequestParam values DSpace/dspace-angular#3032 (RequestParam encodes), so this may be a false positive. Needs a lab check before any PR.
• Restricted items (TUL, ZCU): anonymous users get a not-found page instead of a redirect to login. On ZCU that page comes back as 200 and is stored in the SSR cache. Other 7.6 branches have not been checked.
• /handle on 7.6+ (Angular 15+): no leak. The app is still fully rendered after the 301 and then discarded (cumulative p50 about 164 ms on ZCU). This is wasted CPU, not a bug; low priority.
• TUL/dtq-dev is on Angular 13 too and has the same /handle leak as customer/TUL.

Checklist

• uk: backport inlineCriticalCss (1)
• lindat, vsb-tuo, mendelu-v7: take Fix double encoding of CLARIN license names containing '+' in submission license lookup #1596 (2) and BitstreamUrlSerializer: keep the full query string and fragment #1595 (4) after merge to dtq-dev
• sav, uk, zcu-pub, zcu-data: backport upstream [Port dspace-7_x] Encode all RequestParam values DSpace/dspace-angular#3032 + [Port dspace-7_x] Fix self link don't match warnings for authorization endpoint DSpace/dspace-angular#3055 together with the license workaround removal (3)
• all branches: SSR cache statusCode === 200 (5)
• all affected Dockerfiles: stop discarding stdout/stderr (6)
• decide on the legacy sequence handling (7)
• verify the items in (8)