Use declared WMTS TileMatrix identifiers in tile URLs (fixes BlueTopo 400s)

[rolker]

Closes #178

Summary

GeoServer GWC (BlueTopo / nowCOAST) names WMTS tile matrices with gridset-prefixed
identifiers (EPSG:3857:<z>), but TileLayout::getUrl() substituted {TileMatrix}
with the bare numeric zoom index — so the BlueTopo presets got HTTP 400
(Unknown TILEMATRIX) on every tile.

• Fix: {TileMatrix} now emits zoom_levels[z].id — the identifier already
  parsed from the WMTS capabilities <ows:Identifier> — falling back to the bare
  numeric index when id is empty, so bare-numeric servers (OSM/XYZ, NOAA ArcGIS)
  keep working byte-for-byte.
• Hardening (review findings, operator-approved): the server-controlled
  substitution values (TileMatrix id in getUrl(); Style / TileMatrixSet in
  wmts::Capabilities::getLayout()) are percent-encoded colon-aware
  (QUrl::toPercentEncoding(value, ":") — : preserved as load-bearing for GWC
  ids), closing a URL-delimiter injection surface from hostile capabilities
  documents. The layer identifier has no discrete seam (fused into the
  server-provided resource URL template) and is unchanged.
• Tests: five new cases in test/test_wms_url_generation.cpp — bare-numeric
  backward compat, gridset-prefixed id, empty-id fallback, mismatched
  id-over-index, and percent-encoding with colon survival.

Lifecycle (run-issue): issue review → plan → plan review (approve-with-suggestions,
folded in) → implementation → 3 pre-push review rounds (final: approved, 0 must-fix,
Ship: recommended). Full timeline in .agent/work-plans/issue-178/progress.md.

Test plan

• ./ui_ws/build.sh camp && ./ui_ws/test.sh camp on a fully-sourced host env:
  193 tests, 0 errors, 0 failures, 1 skipped (ADR-0018).
• Field verification: BlueTopo bathymetry/hillshade presets should now load tiles
  (prefixed URL previously verified to return 200 image/png).

---

Authored-By: Claude Code Agent
Model: Claude Fable 5

[Copilot]

Pull request overview

Fixes WMTS tile URL generation for GeoServer GWC-based sources (e.g., NOAA nowCOAST / BlueTopo) by ensuring {TileMatrix} uses the declared WMTS TileMatrix identifier rather than the numeric zoom index, and hardens WMTS template substitutions against URL-delimiter injection via percent-encoding.

Changes:

• Update {TileMatrix} substitution to emit zoom_levels[z].id with a numeric fallback, preserving bare-numeric server behavior.
• Percent-encode server-controlled WMTS substitution values (TileMatrix id in TileLayout::getUrl(), plus Style and TileMatrixSet in wmts::Capabilities::getLayout()), preserving : for GWC compatibility.
• Add focused gtest coverage for TileMatrix id selection, fallback, and encoding behavior.

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
test/test_wms_url_generation.cpp	Adds regression tests covering TileMatrix id-over-index behavior, empty-id fallback, and percent-encoding (with : preserved).
src/camp_map/wmts/capabilities.cpp	Percent-encodes server-controlled Style and TileMatrixSet substitutions when assembling WMTS resource URL templates.
src/camp_map/map_tiles/tile_layout.cpp	Fixes {TileMatrix} URL substitution to use declared per-zoom identifiers, with fallback and delimiter-safe encoding.
.agent/work-plans/issue-178/progress.md	Adds the issue work-plan progress log capturing rationale, verification notes, and review iterations.
.agent/work-plans/issue-178/plan.md	Adds the implementation plan documenting scope, approach, and affected files for issue #178.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 5 out of 5 changed files in this pull request and generated 1 comment.

Suppressed comments (2)

src/camp_map/wmts/capabilities.cpp:82

• layer.styles.front() is called when default_style is empty, but Layer parsing can yield an empty styles vector if the capabilities document has no <Style> elements. That would be undefined behavior. Please guard the front() access so a malformed/partial capabilities document can’t crash the client during URL template assembly.

            auto style = layer.default_style;
            if(style.isEmpty())
              style = layer.styles.front();
            // [camp#178 review R2] style is a raw server-controlled value (the

src/camp_map/wmts/capabilities.cpp:95

• layer.tile_matrix_set_links.front() is accessed when tile_matrix_set is null, but Layer parsing can yield an empty tile_matrix_set_links vector if the capabilities document has no <TileMatrixSetLink>. That would be undefined behavior. Please guard the front() access so a malformed/partial capabilities document can’t crash the client.

            // \todo check that passed in tile_matrix_set exists.
            if(tile_matrix_set.isNull())
              tile_matrix_set = layer.tile_matrix_set_links.front();
            // [camp#178 review R2] tile_matrix_set is likewise server-controlled