Publish a download_url that actually downloads

XOAI's ItemUtils builds a bitstream URL as baseUrl + "/bitstream/" + handle + "/" + sid + "/" +
name, which is the DSpace 6 UI path. Under DSpace 7 the Angular application answers there, so an
anonymous GET returns the app shell rather than the file - measured on an OPEN record, 446 KB of
text/html instead of the 37-byte file. Every one of the 9125 distributions carried it, so a
harvester following download_url got a web page.

DSpace 7 serves the bytes at {server}/api/core/bitstreams/{uuid}/content, which is what the CMDI
crosswalk already does: it ignores the XOAI field and builds its own URL from dspace.server.url.
fn:getProperty is a Saxon extension the OAI runtime registers, but AbstractXSLTest builds a bare
Saxon factory with no extensions, so calling it here would break every unit test. The same value
is derivable from what XOAI already puts in the document - repository/@url + "/server" - and
every bitstream carries its uuid. A bitstream without one keeps the url XOAI supplied, which is
better than no url.

Verified against the live repository: 15 download_url values taken at random from the output all
return the file with its real content type, none returns HTML.

access_url is unchanged and stays the landing page, which is what its own scope note asks for.

The deeper fix belongs in ItemUtils, where it would correct the URL for every crosswalk at once.

Also in this commit, from checking that the access level is right rather than merely consistent:
121 bitstreams were fetched anonymously from the REST content endpoint, stratified over the cells
where the licence gate and others/access-status disagree. The licence gate matched what an
unauthenticated client actually receives on 121 of 121; access-status matched on 41. Every record
where they differ resolved in the licence gate's favour, so access_rights is left as it is - it
is not a proxy for authorisation, it tracks it exactly, while access-status does not because
DSpace computes it from the primary bitstream alone.

Measured after the change over all 2628 records: 2628 valid, every counter zero, 97 tests and
187 assertions green, 69 of 70 stylesheet mutants killed, 23 portability inputs clean. The
surviving mutant edits a FormatDate branch its callers make unreachable by pre-filtering.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Author: milanmajchrak

dspace-oai/src/test/java/org/dspace/xoai/tests/stylesheets/CcmmXslTest.java

@@ -865,6 +865,29 @@ public void ccmmFordSubjectKeepsTheSchemaElementOrder() throws Exception {
             equalTo("0"))));
     }
 
+    @Test
+    public void ccmmDownloadUrlIsTheEndpointThatServesTheBytes() throws Exception {
+        // XOAI builds the bitstream url as the DSpace 6 UI path; under DSpace 7 that path is
+        // answered by the Angular application and returns HTML, so it is not a download link
+        String result = apply("ccmm.xsl").to(resource(MAIN));
+        assertThat(result, is(ccmm().withXPath(
+            "//ccmm:distribution_downloadable_file/ccmm:download_url/ccmm:iri",
+            equalTo("https://lindat.mff.cuni.cz/repository/server/api/core/bitstreams/"
+                + "18341be0-03ad-4a22-a1c8-4cd293c3f5da/content"))));
+        assertThat(result, is(ccmm().withXPath(
+            "count(//ccmm:download_url/ccmm:iri[contains(., '/bitstream/')])", equalTo("0"))));
+    }
+
+    @Test
+    public void ccmmBitstreamWithoutAUuidKeepsTheUrlXoaiSupplied() throws Exception {
+        // nothing to build a REST URL from, so the source url is better than no url
+        String result = apply("ccmm.xsl").to(resource(TOOL));
+        assertThat(result, is(ccmm().withXPath(
+            "//ccmm:distribution_downloadable_file[ccmm:title='morphodita.zip']"
+                + "/ccmm:download_url/ccmm:iri",
+            equalTo("https://lindat.mff.cuni.cz/repository/bitstream/1/10/morphodita.zip"))));
+    }
+
     @Test
     public void ccmmDatasetCarriesItsOwnResolvableIri() throws Exception {
         // dataset/iri is optional in the XSD but it is the only resolvable identity the
@@ -1044,11 +1067,10 @@ public void ccmmAccessUrlIsTheLandingPageAndDownloadUrlIsTheFile() throws Except
         assertThat(result, is(ccmm().withXPath(
             "//ccmm:distribution_downloadable_file/ccmm:access_url/ccmm:iri",
             equalTo("http://hdl.handle.net/11234/1-5678"))));
-        assertThat(result, is(ccmm().withXPath(
-            "//ccmm:distribution_downloadable_file/ccmm:download_url/ccmm:iri",
-            equalTo("https://lindat.mff.cuni.cz/repository/bitstream/11234/1-5678/1/corpus.txt"))));
         assertThat(result, is(ccmm().withXPath(
             "count(//ccmm:access_url/ccmm:iri[contains(., '/bitstream/')])", equalTo("0"))));
+        assertThat(result, is(ccmm().withXPath(
+            "count(//ccmm:access_url/ccmm:iri[. = //ccmm:download_url/ccmm:iri])", equalTo("0"))));
     }
 
     @Test

dspace-oai/src/test/resources/xoai-ccmm-test.xml

@@ -204,6 +204,8 @@
                     <field name="url">https://lindat.mff.cuni.cz/repository/bitstream/11234/1-5678/1/corpus.txt</field>
                     <field name="checksum">ee1c4e448a8f9f838df348dfee1fc11f</field>
                     <field name="checksumAlgorithm">MD5</field>
+                    <field name="sid">1</field>
+                    <field name="id">18341be0-03ad-4a22-a1c8-4cd293c3f5da</field>
                 </element>
             </element>
         </element>

dspace/config/crosswalks/oai/metadataFormats/ccmm.xsl

@@ -240,6 +240,18 @@
                      then concat('http://hdl.handle.net/', normalize-space(string($handleField)))
                      else ''"/>
 
+    <!--
+        Where DSpace 7 actually serves bitstream bytes.  The url XOAI puts on a bitstream is the
+        DSpace 6 UI path (/bitstream/handle/sid/name); under DSpace 7 the Angular application
+        answers there and returns HTML, so it is not a download link.  The REST content endpoint
+        is, and its base sits under the repository URL that XOAI already supplies.
+    -->
+    <xsl:variable name="repoUrlRaw"
+        select="normalize-space((/doc:metadata/doc:element[@name='repository']/doc:field[@name='url'])[1])"/>
+    <xsl:variable name="restBase"
+        select="if ($repoUrlRaw = '') then ''
+                else concat(replace($repoUrlRaw, '/+$', ''), '/server/api/core/bitstreams/')"/>
+
     <xsl:variable name="accessionedAll"
         select="/doc:metadata/doc:element[@name='dc']/doc:element[@name='date']/doc:element[@name='accessioned']/doc:element/doc:field[@name='value']"/>
     <xsl:variable name="availableAll"
@@ -1775,6 +1787,11 @@
             <xsl:variable name="size" select="normalize-space((doc:field[@name='size'])[1])"/>
             <xsl:variable name="fmt" select="normalize-space(tokenize(normalize-space((doc:field[@name='format'])[1]), ';')[1])"/>
             <xsl:variable name="nm" select="normalize-space((doc:field[@name='name'], doc:field[@name='originalName'])[normalize-space(.) != ''][1])"/>
+            <xsl:variable name="uuid" select="normalize-space((doc:field[@name='id'])[1])"/>
+            <!-- the endpoint that serves the bytes; the XOAI url is a UI path, not a download -->
+            <xsl:variable name="downloadUrl"
+                select="if ($restBase != '' and matches($uuid, '^[0-9a-fA-F-]{36}$'))
+                        then concat($restBase, $uuid, '/content') else $url"/>
             <xsl:variable name="sum" select="normalize-space((doc:field[@name='checksum'])[1])"/>
             <xsl:variable name="alg" select="normalize-space((doc:field[@name='checksumAlgorithm'])[1])"/>
             <xsl:if test="matches($url, '^https?://\S+$') and matches($size, '^[0-9]+$') and matches($fmt, '^[A-Za-z0-9!#$&amp;^_.+-]+/[A-Za-z0-9!#$&amp;^_.+-]+$')">
@@ -1789,7 +1806,7 @@
                         <ccmm:access_url>
                             <ccmm:iri><xsl:value-of select="if ($landingPage != '') then $landingPage else $url"/></ccmm:iri>
                         </ccmm:access_url>
-                        <ccmm:download_url><ccmm:iri><xsl:value-of select="$url"/></ccmm:iri></ccmm:download_url>
+                        <ccmm:download_url><ccmm:iri><xsl:value-of select="$downloadUrl"/></ccmm:iri></ccmm:download_url>
                         <xsl:variable name="eu" select="$euFileTypes/t[@m = $fmt]"/>
                         <ccmm:format>
                             <xsl:choose>