BitstreamUrlSerializer: keep the full query string and fragment

[vidiecan]

Problem

After #873, BitstreamUrlSerializer separates the path from the query with const [path, query] = url.split('?'). This has two problems:

• A second raw ? in the query is dropped. For example, with ?isAllowed=y?x&sequenceId=2, everything after the second ? is lost, including sequenceId, which the legacy guard reads.
• A #fragment without a query is encoded into the filename. For example, file.pdf#page=2 becomes the filename file.pdf%23page%3D2, so the lookup fails.

This affects client-side parsing in particular: SSR never receives fragments.

Fix

The URL is now split at the first raw ? or # (url.search(/[?#]/)). Only the path part is encoded, as before. The remainder (query and fragment) is re-attached unchanged. The diff is 4 lines.

The same serializer file is in the companion customer/zcu-pub PR, which backports #873 (zcu-pub never received it) plus this change. Branches that already have #873 (customer/lindat, vsb-tuo, mendelu-v7, palo-docker*) would get this change when synced from dtq-dev.

Search for existing fixes

• No other fork branch changes this logic: all serializer copies are the UFAL/Filename encoding encodes the fileName with the rest of the URL #873 version, or ZCU-PUB/Fixed encoding of the filename from the URL #838 on zcu-pub.
• Upstream DSpace/dspace-angular has no custom UrlSerializer, so there is nothing to backport.

Tests

Two specs in bitstream-url-serializer.spec.ts. Before the fix: 2 failed / 5 passed. After: 7/7 pass. Lint is clean.

• second raw ?: guards that the whole query reaches the router.
• fragment: guards that #... is not encoded into the filename.

Lab

dtq-dev was not run in the lab. The identical serializer was lab-tested on ZCU (customer/zcu-pub, 7.6): 240 bitstreams x 5 legacy URL variants, with and without the DSpace 6 query.

• Every query variant went from 200 login page to 302 to the file.
• Links without a query and normal routes were unchanged.
• ?isAllowed=y?x&sequence=1 returns 302.

Codex gate

PASS (round 2, run jointly with the zcu-pub PR). Codex also noted a pre-existing dtq-dev issue that this PR does not change: legacyBitstreamURLRedirectGuard passes the decoded filename unencoded, and base-data.service does not escape query values. As a result, filenames with &, +, ? or # may not resolve on dtq-dev/lindat. This is unverified in the lab and is a candidate follow-up.

🤖 Generated with Claude Code

[Copilot]

Warning

Copilot couldn't run its full agentic review because it didn't start before the timeout. Make sure your repository has a runner available, or add a copilot-code-review.yml file specifying one with the runs-on attribute. See the docs for more details.

Copilot review overview

4 open issues

• These assertions hardcode the segment index (4), which makes the tests brittle if the route depth… · New
• These assertions hardcode the segment index (4), which makes the tests brittle if the route depth… · New
• This changes behavior for URLs that end with a bare separator, e.g. /bitstream/.../file.pdf? or… · New
• This changes behavior for URLs that end with a bare separator, e.g. /bitstream/.../file.pdf? or… · New

What changed in this PR

This PR fixes BitstreamUrlSerializer so it preserves the full query string (including additional raw ? characters inside values) and correctly handles URL fragments without encoding them into the filename.

Changes:

• Split bitstream URLs at the first raw ? or # and only encode the pathname portion.
• Reattach query string + fragment unchanged after encoding the filename.
• Add specs covering “raw ? inside query values” and “fragment not encoded into filename”.

File	Description
src/​app/​core/​url-serializer/​bitstream-url-serializer.ts	Updates URL splitting/reattachment logic to preserve query+fragment while encoding only the filename segment.
src/​app/​core/​url-serializer/​bitstream-url-serializer.spec.ts	Adds regression tests for raw ? in query values and fragment handling.

_{Review effort: Lite}