Fix concept-code lookups containing slashes

[konstjar]

Summary

• percent-encode vocabulary IDs and concept codes as individual URL path segments
• preserve slash-containing ICD-O codes such as 8032/3 as a single route parameter
• add a regression test for the reported SDK request shape

The Node SDK was also rechecked: its production code already uses encodeURIComponent for both segments and its current test suite already covers a slash-containing concept code, so no Node change is needed.

Validation

• full testthat unit suite passed
• 64 live integration tests skipped because no API key was configured
• git diff --check

---

Summary by cubic

Fixes concept-code lookups in the R SDK so codes containing slashes (e.g., ICD-O code 8032/3) resolve correctly. get_by_code now percent-encodes the vocabulary ID and concept code as individual URL path segments, preventing slashes in the code from being treated as route separators. This mirrors the Node SDK, which already encodes both segments. Adds a regression test covering the encoded request path.

^{Written for commit 36d326e. Summary will update on new commits.}

[cubic-dev-ai]

All reported issues were addressed

<sub>Reply with feedback, questions, or to request a fix.

Re-trigger cubic</sub>

[cubic-dev-ai]

1 issue found across 3 reviewed files. 1 file intentionally excluded from review.

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="R/request.R">

<violation number="1" location="R/request.R:55">
P2: When `get_by_code()` is called with a slash-containing code (e.g. `"8032/3"`) plus any query option (`include_hierarchy`, `include_synonyms`, `include_relationships`, `vocab_release`), the `%2F` escape in the path is mangled. The `endpoint_encoded` branch builds the URL once via `url_parse()`/`url_build()` and stores it with `req_url()`, but the trailing query block immediately re-enters the URL into `httr2::req_url_query()`, which round-trips the URL string through `url_parse()` → `url_build()` (httr2's `_query()` parses and rebuilds any string URL). `url_parse()` returns percent-decoded path components and `url_build()` re-escapes them, so the literal `%2F` is either decoded back to `/` (splitting `8032/3` into two path segments and hitting the wrong route) or re-escaped to `%252F` — the exact double-encoding this PR set out to fix. The regression test only covers `query = NULL`, and all query-passing tests mock `perform_get`, so this combination is untested. Merge query parameters into the parsed `url` object inside the `endpoint_encoded` branch so the encoded path passes through `url_parse()`/`url_build()` exactly once, and add a regression test combining a slash code with `include_hierarchy = TRUE`.</violation>
</file>

<sub>Reply with feedback, questions, or to request a fix.

Re-trigger cubic</sub>

[cubic-dev-ai]

P2: When get_by_code() is called with a slash-containing code (e.g. "8032/3") plus any query option (include_hierarchy, include_synonyms, include_relationships, vocab_release), the %2F escape in the path is mangled. The endpoint_encoded branch builds the URL once via url_parse()/url_build() and stores it with req_url(), but the trailing query block immediately re-enters the URL into httr2::req_url_query(), which round-trips the URL string through url_parse() → url_build() (httr2's _query() parses and rebuilds any string URL). url_parse() returns percent-decoded path components and url_build() re-escapes them, so the literal %2F is either decoded back to / (splitting 8032/3 into two path segments and hitting the wrong route) or re-escaped to %252F — the exact double-encoding this PR set out to fix. The regression test only covers query = NULL, and all query-passing tests mock perform_get, so this combination is untested. Merge query parameters into the parsed url object inside the endpoint_encoded branch so the encoded path passes through url_parse()/url_build() exactly once, and add a regression test combining a slash code with include_hierarchy = TRUE.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At R/request.R, line 55:

<comment>When `get_by_code()` is called with a slash-containing code (e.g. `"8032/3"`) plus any query option (`include_hierarchy`, `include_synonyms`, `include_relationships`, `vocab_release`), the `%2F` escape in the path is mangled. The `endpoint_encoded` branch builds the URL once via `url_parse()`/`url_build()` and stores it with `req_url()`, but the trailing query block immediately re-enters the URL into `httr2::req_url_query()`, which round-trips the URL string through `url_parse()` → `url_build()` (httr2's `_query()` parses and rebuilds any string URL). `url_parse()` returns percent-decoded path components and `url_build()` re-escapes them, so the literal `%2F` is either decoded back to `/` (splitting `8032/3` into two path segments and hitting the wrong route) or re-escaped to `%252F` — the exact double-encoding this PR set out to fix. The regression test only covers `query = NULL`, and all query-passing tests mock `perform_get`, so this combination is untested. Merge query parameters into the parsed `url` object inside the `endpoint_encoded` branch so the encoded path passes through `url_parse()`/`url_build()` exactly once, and add a regression test combining a slash code with `include_hierarchy = TRUE`.</comment>

<file context>
@@ -44,14 +44,22 @@ build_request <- function(base_url, api_key, timeout = 30, max_retries = 3,
-    httr2::req_url_path_append(endpoint)
+perform_get <- function(base_req, endpoint, query = NULL,
+                        endpoint_encoded = FALSE) {
+  if (isTRUE(endpoint_encoded)) {
+    url <- httr2::url_parse(base_req$url)
+    url$path <- I(paste0(sub("/$", "", url$path), "/", endpoint))
</file context>