Modernization of the Deep-link resolver entry point (linkto.php) for requirements — GitHub issue #1532.

Legacy direct links (linkto.php?item=req&id=<doc_id>) used to land in a frameset shell pointing at the legacy requirement viewer. After the ASIDE menu was fully modernized the other remaining legacy surface was the linkto.php deep-link gateway: bookmarks, e-mail links and "copy link" URLs emitted by the modern requirement screens still pointed at it. This milestone repointed the requirement deep-link family onto a modern, self-contained resolver page (gui/templates/links/directLink.html) backed by a plain-PHP REST BFF (api/directlink/index.php), without touching the other item types.

URL: gui/templates/links/directLink.html?tprojectPrefix=<prefix>&item=req&id=<doc_id>[&version=<n>] BFF API: api/directlink/index.php (GET ?action=resolve) Rights: authenticated session required; mgt_view_req on the owning project (403 otherwise) Compatible alias: tproject_id=<numeric> may be used instead of tprojectPrefix=<prefix>

1. What the screen does
2. REST API Reference
3. Legacy parity notes
4. i18n Keys
5. Security
6. Testing

Only one route is needed. Requires a session (401 anonymous). item=req is the only supported item type; anything else is a 400 (unknown item family kept on the legacy linkto.php shell for backwards compatibility).

Request may use tproject_id=<numeric> instead of tprojectPrefix (only one of the two must be present — both resolve the same project).

200 payload shape:

{
  "status": "ok",
  "tproject_id": 4, "tproject_name": "DL1532", "tproject_prefix": "DLS2",
  "req_id": "7", "req_doc_id": "DLREQ-001", "req_title": "…",
  "version": "1", "version_id": 8, "revision": "1",
  "href": "/gui/templates/requirements/reqView.html?id=7&tproject_id=4",
  "grant": { "req_mgmt": "yes" }
}

When version is requested it is validated (requirement_mgr::get_by_id, human version number), the card metadata comes from THAT version, and href gains &req_version_id=<version_id> so the modern viewer opens the pinned version (request params version_id/req_version_id are honored by reqView.html; its own "This version" direct link then round-trips back via &version=N).

• linkto.php?item=req&id=<doc_id> (no load) — outer frame — now 302s to the resolver. linkto.php?load&item=req&… (inner-facing bookmark) does the same.
• Emitting new legacy linkto URLs has stopped: api/requirements direct_link and reqRevisionView.html copy-link now produce gui/templates/links/directLink.html?… URLs.
• The other item= families (reqspec, testcase, testsuite) stay behind linkto.php and open the legacy frame shell. Issue #1533 fixed the HTTP 500 that broke them (the removed testproject::setSessionProject() call on the inner-frame path is replaced by direct session assignment), so those legacy deep links work again — they are not redirected to the resolver, only req is (the resolver BFF supports requirements only for now).
• Fixture used during testing (created by tmp/fixtures_1532.php): test project DL1532 (prefix DLS2, id 4), requirement spec RS-DL (id 5), requirements DLREQ-001 (id 7) and DLREQ-002 (id 9).

Client-side keys live in the dl.* namespace plus footers.directLink, added to all 10 bundles (en, ro, de, es, fr, it, ja, pt, ru, zh), validated with python3 -m json.tool:

• dl.resolve (headline), dl.resolveTitle (doc title / page <title>)
• dl.resolveAgain, dl.resolvedItem, dl.fieldProject, dl.fieldRequirement, dl.fieldTitle, dl.fieldVersion, dl.fieldRevision
• dl.openViewer, dl.copyLink, dl.copySuccess, dl.copyError
• dl.errTitle, dl.errBoxTitle, dl.errViewer, dl.loading (fallback text)
• footers.directLink

• Session-only auth (401 anonymous); the resolver page never leaves the app origin.
• Per-project right check mgt_view_req inside the BFF (403 for the <no rights> role, verified both via curl and in-browser).
• Same-origin CSRF guard on every BFF action (shared bffSameOriginGuard() helper); non-GET returns 405 past the guard, 403 without the X-Requested-With proof.
• Every legacy-class touch is wrapped in guarded try/catch → 500 JSON, no leaked stack traces. No raw $_GET interpolation anywhere; all ids / prefixes are validated before use.
• No secrets in this milestone; no new writes to the DB.

GitHub issue #1542 completed the gateway: the deep-link items test case, test suite and requirement spec (still routed into the legacy inner-frame shell — reqSpecListTree.php / listTestCases.php / reqSpecView.php / archiveData.php) now also resolve through the same modern resolver page and BFF instead of the legacy frames.

URL: gui/templates/links/directLink.html?tprojectPrefix=<prefix>&item=req|reqspec|testcase|testsuite&id=<id> BFF API: api/directlink/index.php (GET ?action=resolve, item dispatch below)

Rights gates mirror legacy linkto.php checkTestProject(): req/reqspec → mgt_view_req, testcase/testsuite → mgt_view_tc, checked against the owning project (403 otherwise). The short link form ?testcase=DLS4-1 is normalized by linkto.php init_args() and resolves identically.

The resolver card is now generic: an Item type chip (localized), type-specific identifier, title, and version/revision rows shown only when the resolved item carries them (requirement/pinned versions only).

linkto.php outer frame and inner (load) frame both 302 every supported item type onto the resolver (anchor preserved); the legacy inner-frame setSessionProject workaround for non-req items was removed with the legacy shell. $actions->directLink remains the common.php wiring.

Screenshots (docs/screenshots/issue-1542-*.png): testcase card + tcView viewer, reqSpecView viewer, suiteView viewer, not-found error card.

Testing: Suite 1542 in tmp/TLU_Test_Cases.md (13/13 PASS) — all item types + errors (browser + curl), anonymous 401 bounce, guest 403 split (dlguest role 5: mgt_view_tc yes / mgt_view_req no), tproject_id alias, copy/resolve-again, locale switch, Event Viewer clean. Fixture tmp/fixtures_1542.php (project DL1542/DLS4, spec RS-DL2, req DLREQ-101, suites 16/17, testcase DLS4-1 id 18, guest user). Commits 46b205338 → 04b483068 → de48a7ff1.