Pre-hash query parameters are ignored, and the https: scheme is stripped

Start at the controller that reads $location.search(), constructs the fetched URL, and accesses sequences[0]; the issue does not name its file or tests. Check how AngularJS 1.4.7 parses hashbang URLs and inspect the handling of responses without sequences. Done means pre-hash query parameters work, HTTPS URLs retain their scheme, and a Canvas or Range produces a visible error instead of a blank page.

Found while designing the resource bag for Oh My RERUM (CenterForDigitalHumanities/oh-my-rerum#10). OMR hands a resource to a tool as a percent-encoded URI in the pre-hash query string, which is the form the IIIF Content State 1.0 spec recommends. This tool cannot see it.

1. Parameters before the hash are ignored

The app reads its input through $location.search() but never enables html5Mode. In Angular 1.4.7, LocationHashbangUrl.$$parse (angular.js around line 11518) treats a URL with no fragment as empty — the comment in the source reads "Otherwise we ignore what is left".

So this works:

/read/index.html#!/read?url=https://example.org/manifest.json&p=3

and this does not:

/read/index.html?url=https://example.org/manifest.json&p=3

The second form is what any spec-conformant caller, including the IIIF Content State recommendation, produces. Enabling html5Mode, or falling back to window.location.search when $location.search() is empty, would both fix it.

2. The https: scheme is stripped from the URL being fetched

The fetched URL is built with a replace(/^https?:/, '') on the url parameter. That turns https://example.org/m.json into a protocol-relative //example.org/m.json, which inherits this page's scheme. Served over plain HTTP, every HTTPS manifest breaks. The comment or commit behind it would help — if it was a workaround for a mixed-content problem, there is a better fix.

3. A Canvas URI in url throws instead of reporting

The response is accepted if it has an @id, and then sequences[0] is read from it. A Canvas has an @id but no sequences, so the controller dies with a TypeError and the page goes blank. A Canvas or Range is a legal Content State target, so callers will send one. A visible "this is not a Manifest" message would be much more useful than a blank page.

Context

IIIF Content State 1.0, section 2.2.4, permits a bare dereferenceable URI as the value of iiif-content, and says a plain URI must not be content-state-encoded. Section 2.2.5 notes that a Canvas URI which is not itself dereferenceable needs one of the JSON forms. OMR will keep sending the plain form and surfacing the failure, rather than special-casing around this tool, so a fix here is what makes the tool reachable.