Skip to content

Fix concept-code lookups containing slashes #13

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
konstjar wants to merge 2 commits into
base: main
Choose a base branch
from
Open

Fix concept-code lookups containing slashes #13

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
a38f82d
fix: encode concept lookup path segments
alex-omophub Sep 21, 2026
36d326e
test: verify encoded concept path on request
alex-omophub Sep 21, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 8 additions & 2 deletions R/concepts.R
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -88,8 +88,14 @@ ConceptsResource <- R6::R6Class(

perform_get(
private$.base_req,
paste0("concepts/by-code/", vocabulary_id, "/", concept_code),
query = if (length(query) > 0) query else NULL
paste0(
"concepts/by-code/",
utils::URLencode(vocabulary_id, reserved = TRUE),
"/",
utils::URLencode(concept_code, reserved = TRUE)
),
query = if (length(query) > 0) query else NULL,
endpoint_encoded = TRUE
)
},

Expand Down
14 changes: 11 additions & 3 deletions R/request.R
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -44,14 +44,22 @@ build_request <- function(base_url, api_key, timeout = 30, max_retries = 3,
#' @param base_req Base request object.
#' @param endpoint API endpoint path.
#' @param query Named list of query parameters.
#' @param endpoint_encoded Whether `endpoint` is already percent-encoded.
#'
#' @returns Parsed JSON response. For paginated endpoints, returns a list with
#' `data` (the results) and `meta` (pagination info). For single-item endpoints,
#' returns the unwrapped data directly.
#' @keywords internal
perform_get <- function(base_req, endpoint, query = NULL) {
req <- base_req |>
httr2::req_url_path_append(endpoint)
perform_get <- function(base_req, endpoint, query = NULL,
endpoint_encoded = FALSE) {
if (isTRUE(endpoint_encoded)) {

@cubic-dev-ai cubic-dev-ai Bot Sep 21, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2: When get_by_code() is called with a slash-containing code (e.g. "8032/3") plus any query option (include_hierarchy, include_synonyms, include_relationships, vocab_release), the %2F escape in the path is mangled. The endpoint_encoded branch builds the URL once via url_parse()/url_build() and stores it with req_url(), but the trailing query block immediately re-enters the URL into httr2::req_url_query(), which round-trips the URL string through url_parse() → url_build() (httr2's _query() parses and rebuilds any string URL). url_parse() returns percent-decoded path components and url_build() re-escapes them, so the literal %2F is either decoded back to / (splitting 8032/3 into two path segments and hitting the wrong route) or re-escaped to %252F — the exact double-encoding this PR set out to fix. The regression test only covers query = NULL, and all query-passing tests mock perform_get, so this combination is untested. Merge query parameters into the parsed url object inside the endpoint_encoded branch so the encoded path passes through url_parse()/url_build() exactly once, and add a regression test combining a slash code with include_hierarchy = TRUE.

Prompt for AI agents 
Check if this issue is valid — if so, understand the root cause and fix it. At R/request.R, line 55:

<comment>When `get_by_code()` is called with a slash-containing code (e.g. `"8032/3"`) plus any query option (`include_hierarchy`, `include_synonyms`, `include_relationships`, `vocab_release`), the `%2F` escape in the path is mangled. The `endpoint_encoded` branch builds the URL once via `url_parse()`/`url_build()` and stores it with `req_url()`, but the trailing query block immediately re-enters the URL into `httr2::req_url_query()`, which round-trips the URL string through `url_parse()` → `url_build()` (httr2's `_query()` parses and rebuilds any string URL). `url_parse()` returns percent-decoded path components and `url_build()` re-escapes them, so the literal `%2F` is either decoded back to `/` (splitting `8032/3` into two path segments and hitting the wrong route) or re-escaped to `%252F` — the exact double-encoding this PR set out to fix. The regression test only covers `query = NULL`, and all query-passing tests mock `perform_get`, so this combination is untested. Merge query parameters into the parsed `url` object inside the `endpoint_encoded` branch so the encoded path passes through `url_parse()`/`url_build()` exactly once, and add a regression test combining a slash code with `include_hierarchy = TRUE`.</comment>

<file context>
@@ -44,14 +44,22 @@ build_request <- function(base_url, api_key, timeout = 30, max_retries = 3,
-    httr2::req_url_path_append(endpoint)
+perform_get <- function(base_req, endpoint, query = NULL,
+                        endpoint_encoded = FALSE) {
+  if (isTRUE(endpoint_encoded)) {
+    url <- httr2::url_parse(base_req$url)
+    url$path <- I(paste0(sub("/$", "", url$path), "/", endpoint))
</file context>

url <- httr2::url_parse(base_req$url)
url$path <- I(paste0(sub("/$", "", url$path), "/", endpoint))
req <- httr2::req_url(base_req, httr2::url_build(url))
} else {
req <- base_req |>
httr2::req_url_path_append(endpoint)
}

# Add query parameters, removing NULLs
if (!is.null(query)) {
Expand Down
4 changes: 3 additions & 1 deletion man/perform_get.Rd
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

26 changes: 24 additions & 2 deletions tests/testthat/test-concepts.R
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -108,7 +108,7 @@ test_that("concepts$get_by_code calls correct endpoint", {

called_with <- NULL
local_mocked_bindings(
perform_get = function(req, path, query = NULL) {
perform_get = function(req, path, query = NULL, endpoint_encoded = FALSE) {
called_with <<- list(path = path)
mock_concept()
}
Expand All @@ -119,13 +119,35 @@ test_that("concepts$get_by_code calls correct endpoint", {
expect_equal(called_with$path, "concepts/by-code/SNOMED/44054006")
})

test_that("concepts$get_by_code URL-encodes path segments", {
base_req <- httr2::request("https://api.omophub.com/v1")
resource <- ConceptsResource$new(base_req)

request_url <- NULL
httr2::local_mocked_responses(function(req) {
request_url <<- req$url
httr2::response(
status_code = 200,
headers = list(`content-type` = "application/json"),
body = charToRaw(jsonlite::toJSON(mock_concept(), auto_unbox = TRUE))
)
})

resource$get_by_code("ICDO3", "8032/3")

expect_equal(
request_url,
"https://api.omophub.com/v1/concepts/by-code/ICDO3/8032%2F3"
)
})

test_that("concepts$get_by_code passes include_hierarchy and vocab_release", {
base_req <- httr2::request("https://api.omophub.com/v1")
resource <- ConceptsResource$new(base_req)

called_with <- NULL
local_mocked_bindings(
perform_get = function(req, path, query = NULL) {
perform_get = function(req, path, query = NULL, endpoint_encoded = FALSE) {
called_with <<- list(query = query)
mock_concept()
}
Expand Down
Loading