fix(httpapi): percent-decode the registry {id} on search, refresh, edit and remove

A custom registry id is user-chosen (add-source --id) and may contain
characters the CLI (url.PathEscape) and Web UI (encodeURIComponent)
percent-encode, such as ':' or '/'. chi routes on RawPath, so the {id}
param arrived encoded and the exact-match lookup missed: the registry
could be added but not searched, refreshed, edited or removed.
handleAddFromRegistry already decodes; apply the same decodePathParam
in the other four registry handlers.

Co-authored-by: Cursor <cursoragent@cursor.com>

Author: rudycelekli

internal/httpapi/registry_id_decode_test.go

@@ -0,0 +1,67 @@
+package httpapi
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"go.uber.org/zap/zaptest"
+
+	"github.com/smart-mcp-proxy/mcpproxy-go/internal/config"
+	"github.com/smart-mcp-proxy/mcpproxy-go/internal/contracts"
+)
+
+// registryIDRecorder records the registry id each registry handler forwards.
+type registryIDRecorder struct {
+	*MockServerController
+	got string
+}
+
+func (c *registryIDRecorder) SearchRegistryServers(id, _, _ string, _ int) ([]interface{}, *contracts.RegistryCacheInfo, error) {
+	c.got = id
+	return []interface{}{}, nil, nil
+}
+
+func (c *registryIDRecorder) RefreshRegistryCache(id string) (int, error) {
+	c.got = id
+	return 0, nil
+}
+
+func (c *registryIDRecorder) RemoveRegistrySourceRef(id string) (*config.RegistryEntry, *contracts.RegistryAddError, error) {
+	c.got = id
+	return &config.RegistryEntry{ID: id}, nil, nil
+}
+
+func (c *registryIDRecorder) EditRegistrySourceRef(id, _, _, _ string) (*config.RegistryEntry, *contracts.RegistryAddError, error) {
+	c.got = id
+	return &config.RegistryEntry{ID: id}, nil, nil
+}
+
+// A custom registry id is user-chosen (add-source --id) and may contain
+// characters the CLI and Web UI percent-encode. chi routes on RawPath, so the
+// {id} param arrives encoded and must be decoded before the exact-match lookup,
+// as handleAddFromRegistry already does.
+func TestRegistryRoutes_DecodeIDParam(t *testing.T) {
+	routes := []struct{ method, path, body string }{
+		{http.MethodGet, "/api/v1/registries/acme%3Ainternal/servers", ""},
+		{http.MethodPost, "/api/v1/registries/acme%3Ainternal/refresh", ""},
+		{http.MethodDelete, "/api/v1/registries/acme%3Ainternal", ""},
+		{http.MethodPut, "/api/v1/registries/acme%3Ainternal", `{"name":"Acme"}`},
+	}
+	for _, rt := range routes {
+		t.Run(rt.method+" "+rt.path, func(t *testing.T) {
+			ctrl := &registryIDRecorder{MockServerController: &MockServerController{}}
+			srv := NewServer(ctrl, zaptest.NewLogger(t).Sugar(), nil)
+
+			req := httptest.NewRequest(rt.method, rt.path, strings.NewReader(rt.body))
+			req.Header.Set("X-API-Key", mockControllerAPIKey)
+			w := httptest.NewRecorder()
+			srv.ServeHTTP(w, req)
+
+			assert.Equal(t, http.StatusOK, w.Code, "body=%s", w.Body.String())
+			assert.Equal(t, "acme:internal", ctrl.got)
+		})
+	}
+}

internal/httpapi/server.go

@@ -6417,7 +6417,7 @@ func (s *Server) handleListRegistries(w http.ResponseWriter, r *http.Request) {
 // @Security     ApiKeyQuery
 // @Router       /api/v1/registries/{id}/servers [get]
 func (s *Server) handleSearchRegistryServers(w http.ResponseWriter, r *http.Request) {
-	registryID := chi.URLParam(r, "id")
+	registryID := decodePathParam(chi.URLParam(r, "id"))
 	if registryID == "" {
 		s.writeError(w, r, http.StatusBadRequest, "Registry ID is required")
 		return
@@ -6673,7 +6673,7 @@ func (s *Server) handleAddRegistrySource(w http.ResponseWriter, r *http.Request)
 // @Security     ApiKeyQuery
 // @Router       /api/v1/registries/{id} [delete]
 func (s *Server) handleRemoveRegistrySource(w http.ResponseWriter, r *http.Request) {
-	registryID := chi.URLParam(r, "id")
+	registryID := decodePathParam(chi.URLParam(r, "id"))
 	if registryID == "" {
 		s.writeError(w, r, http.StatusBadRequest, "Registry ID is required")
 		return
@@ -6712,7 +6712,7 @@ func (s *Server) handleRemoveRegistrySource(w http.ResponseWriter, r *http.Reque
 // @Security     ApiKeyQuery
 // @Router       /api/v1/registries/{id} [put]
 func (s *Server) handleEditRegistrySource(w http.ResponseWriter, r *http.Request) {
-	registryID := chi.URLParam(r, "id")
+	registryID := decodePathParam(chi.URLParam(r, "id"))
 	if registryID == "" {
 		s.writeError(w, r, http.StatusBadRequest, "Registry ID is required")
 		return
@@ -6751,7 +6751,7 @@ func (s *Server) handleEditRegistrySource(w http.ResponseWriter, r *http.Request
 // @Failure      500  {object}  contracts.ErrorResponse            "Failed to refresh registry cache"
 // @Router       /api/v1/registries/{id}/refresh [post]
 func (s *Server) handleRefreshRegistryCache(w http.ResponseWriter, r *http.Request) {
-	registryID := chi.URLParam(r, "id")
+	registryID := decodePathParam(chi.URLParam(r, "id"))
 	if registryID == "" {
 		s.writeError(w, r, http.StatusBadRequest, "Registry ID is required")
 		return