fix(httpapi): percent-decode the registry {id} on search, refresh, edit and remove (#1774)

## Problem

Custom registry ids are user-chosen (`registry add-source --id ...`) and
aren't restricted to a slug, so they can contain characters such as `:`
or `/`. The CLI builds these URLs with `url.PathEscape` and the Web UI
with `encodeURIComponent`, so those characters reach the server
percent-encoded. chi routes on `RawPath`, which means `chi.URLParam(r,
"id")` returns the encoded form (`acme%3Ainternal`) and the exact-match
registry lookup misses.

As a result, a registry added as `acme:internal` can't be searched,
refreshed, edited or removed. `handleAddFromRegistry` already decodes
the same param (MCP-1056); the other four handlers don't.

## Fix

Wrap `{id}` in the existing `decodePathParam` in
`handleSearchRegistryServers`, `handleRefreshRegistryCache`,
`handleEditRegistrySource` and `handleRemoveRegistrySource`.

## Test

`TestRegistryRoutes_DecodeIDParam` sends `acme%3Ainternal` to all four
routes and checks the id passed to the controller. On main all four
subtests receive `acme%3Ainternal`; with this change they receive
`acme:internal`. `go test -count=1 ./internal/httpapi/` passes.

Made with [Cursor](https://cursor.com)

Author: rudycelekli

internal/httpapi/registry_id_decode_test.go

@@ -0,0 +1,67 @@
+package httpapi
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"go.uber.org/zap/zaptest"
+
+	"github.com/smart-mcp-proxy/mcpproxy-go/internal/config"
+	"github.com/smart-mcp-proxy/mcpproxy-go/internal/contracts"
+)
+
+// registryIDRecorder records the registry id each registry handler forwards.
+type registryIDRecorder struct {
+	*MockServerController
+	got string
+}
+
+func (c *registryIDRecorder) SearchRegistryServers(id, _, _ string, _ int) ([]interface{}, *contracts.RegistryCacheInfo, error) {
+	c.got = id
+	return []interface{}{}, nil, nil
+}
+
+func (c *registryIDRecorder) RefreshRegistryCache(id string) (int, error) {
+	c.got = id
+	return 0, nil
+}
+
+func (c *registryIDRecorder) RemoveRegistrySourceRef(id string) (*config.RegistryEntry, *contracts.RegistryAddError, error) {
+	c.got = id
+	return &config.RegistryEntry{ID: id}, nil, nil
+}
+
+func (c *registryIDRecorder) EditRegistrySourceRef(id, _, _, _ string) (*config.RegistryEntry, *contracts.RegistryAddError, error) {
+	c.got = id
+	return &config.RegistryEntry{ID: id}, nil, nil
+}
+
+// A custom registry id is user-chosen (add-source --id) and may contain
+// characters the CLI and Web UI percent-encode. chi routes on RawPath, so the
+// {id} param arrives encoded and must be decoded before the exact-match lookup,
+// as handleAddFromRegistry already does.
+func TestRegistryRoutes_DecodeIDParam(t *testing.T) {
+	routes := []struct{ method, path, body string }{
+		{http.MethodGet, "/api/v1/registries/acme%3Ainternal/servers", ""},
+		{http.MethodPost, "/api/v1/registries/acme%3Ainternal/refresh", ""},
+		{http.MethodDelete, "/api/v1/registries/acme%3Ainternal", ""},
+		{http.MethodPut, "/api/v1/registries/acme%3Ainternal", `{"name":"Acme"}`},
+	}
+	for _, rt := range routes {
+		t.Run(rt.method+" "+rt.path, func(t *testing.T) {
+			ctrl := &registryIDRecorder{MockServerController: &MockServerController{}}
+			srv := NewServer(ctrl, zaptest.NewLogger(t).Sugar(), nil)
+
+			req := httptest.NewRequest(rt.method, rt.path, strings.NewReader(rt.body))
+			req.Header.Set("X-API-Key", mockControllerAPIKey)
+			w := httptest.NewRecorder()
+			srv.ServeHTTP(w, req)
+
+			assert.Equal(t, http.StatusOK, w.Code, "body=%s", w.Body.String())
+			assert.Equal(t, "acme:internal", ctrl.got)
+		})
+	}
+}

internal/httpapi/server.go

@@ -6419,7 +6419,7 @@ func (s *Server) handleListRegistries(w http.ResponseWriter, r *http.Request) {
 // @Security     ApiKeyQuery
 // @Router       /api/v1/registries/{id}/servers [get]
 func (s *Server) handleSearchRegistryServers(w http.ResponseWriter, r *http.Request) {
-	registryID := chi.URLParam(r, "id")
+	registryID := decodePathParam(chi.URLParam(r, "id"))
 	if registryID == "" {
 		s.writeError(w, r, http.StatusBadRequest, "Registry ID is required")
 		return
@@ -6675,7 +6675,7 @@ func (s *Server) handleAddRegistrySource(w http.ResponseWriter, r *http.Request)
 // @Security     ApiKeyQuery
 // @Router       /api/v1/registries/{id} [delete]
 func (s *Server) handleRemoveRegistrySource(w http.ResponseWriter, r *http.Request) {
-	registryID := chi.URLParam(r, "id")
+	registryID := decodePathParam(chi.URLParam(r, "id"))
 	if registryID == "" {
 		s.writeError(w, r, http.StatusBadRequest, "Registry ID is required")
 		return
@@ -6714,7 +6714,7 @@ func (s *Server) handleRemoveRegistrySource(w http.ResponseWriter, r *http.Reque
 // @Security     ApiKeyQuery
 // @Router       /api/v1/registries/{id} [put]
 func (s *Server) handleEditRegistrySource(w http.ResponseWriter, r *http.Request) {
-	registryID := chi.URLParam(r, "id")
+	registryID := decodePathParam(chi.URLParam(r, "id"))
 	if registryID == "" {
 		s.writeError(w, r, http.StatusBadRequest, "Registry ID is required")
 		return
@@ -6753,7 +6753,7 @@ func (s *Server) handleEditRegistrySource(w http.ResponseWriter, r *http.Request
 // @Failure      500  {object}  contracts.ErrorResponse            "Failed to refresh registry cache"
 // @Router       /api/v1/registries/{id}/refresh [post]
 func (s *Server) handleRefreshRegistryCache(w http.ResponseWriter, r *http.Request) {
-	registryID := chi.URLParam(r, "id")
+	registryID := decodePathParam(chi.URLParam(r, "id"))
 	if registryID == "" {
 		s.writeError(w, r, http.StatusBadRequest, "Registry ID is required")
 		return