fix: use Uri.encodeComponent for URL path parameters to ensure safe URL encoding

CHANGELOG.md

@@ -1,3 +1,10 @@
+## 1.2.11
+
+* Fix URL encoding for path parameters
+* Fix query parameters handling for optional values
+* Change offset parameter type from `String?` to `int?` in all APIs
+* Mark `deactive` and `deactiveVerification` as deprecated in favor of `deactivate` and `deactivateVerification`
+
 ## 1.2.10
 
 * add `kernel_asset_id` field to `SafeSnapshot`

lib/src/api/account_api.dart

@@ -54,19 +54,19 @@ class AccountApi {
 
   Future<MixinResponse<StickerAlbum>> getStickerAlbum(String id) =>
       MixinResponse.request(
-        dio.get('/albums/$id'),
+        dio.get('/albums/${Uri.encodeComponent(id)}'),
         StickerAlbum.fromJson,
       );
 
   Future<MixinResponse<List<Sticker>>> getStickersByAlbumId(String id) =>
       MixinResponse.requestList(
-        dio.get('/stickers/albums/$id'),
+        dio.get('/stickers/albums/${Uri.encodeComponent(id)}'),
         Sticker.fromJson,
       );
 
   Future<MixinResponse<Sticker>> getStickerById(String id) =>
       MixinResponse.request<Sticker>(
-        dio.get('/stickers/$id'),
+        dio.get('/stickers/${Uri.encodeComponent(id)}'),
         Sticker.fromJson,
       );
 
@@ -88,7 +88,7 @@ class AccountApi {
 
   Future<MixinResponse<CodeTypeInterface?>> code(String id) =>
       MixinResponse.request<CodeTypeInterface?>(
-        dio.get('/codes/$id'),
+        dio.get('/codes/${Uri.encodeComponent(id)}'),
         (json) {
           try {
             final jsonObject = json;
@@ -123,7 +123,7 @@ class AccountApi {
 
   Future<MixinResponse<Account>> create(String id, AccountRequest request) =>
       MixinResponse.request<Account>(
-        dio.post('/verifications/$id', data: request),
+        dio.post('/verifications/${Uri.encodeComponent(id)}', data: request),
         Account.fromJson,
       );
 
@@ -161,31 +161,42 @@ class AccountApi {
         User.fromJson,
       );
 
+  @Deprecated('Use deactivateVerification instead')
   Future<MixinResponse<VerificationResponse>> deactiveVerification(
     String id,
     String code,
+  ) =>
+      deactivateVerification(id, code);
+
+  Future<MixinResponse<VerificationResponse>> deactivateVerification(
+    String id,
+    String code,
   ) =>
       MixinResponse.request<VerificationResponse>(
-        dio.post('/verifications/$id', data: {
+        dio.post('/verifications/${Uri.encodeComponent(id)}', data: {
           'code': code,
           'purpose': VerificationPurpose.deactivated.name.toUpperCase(),
         }),
         VerificationResponse.fromJson,
       );
 
+  @Deprecated('Use deactivate instead')
   Future<MixinResponse<void>> deactive(DeactivateRequest request) =>
+      deactivate(request);
+
+  Future<MixinResponse<void>> deactivate(DeactivateRequest request) =>
       MixinResponse.requestVoid(dio.post('/me/deactivate', data: request));
 
   Future<MixinResponse<List<LogResponse>>> pinLogs({
     String? category,
-    String? offset,
+    int? offset,
     int? limit,
   }) =>
       MixinResponse.requestList<LogResponse>(
         dio.get('/logs', queryParameters: {
-          'category': category,
-          'offset': offset,
-          'limit': limit,
+          if (category != null && category.isNotEmpty) 'category': category,
+          if (offset != null) 'offset': offset.toString(),
+          if (limit != null) 'limit': limit,
         }),
         LogResponse.fromJson,
       );

lib/src/api/address_api.dart

@@ -9,7 +9,7 @@ class AddressApi {
 
   Future<MixinResponse<List<Address>>> getAddressesByAssetId(String assetId) =>
       MixinResponse.requestList(
-        dio.get('/assets/$assetId/addresses'),
+        dio.get('/assets/${Uri.encodeComponent(assetId)}/addresses'),
         Address.fromJson,
       );
 
@@ -21,13 +21,13 @@ class AddressApi {
 
   Future<MixinResponse<Address>> getAddressById(String id) =>
       MixinResponse.request<Address>(
-        dio.get('/addresses/$id'),
+        dio.get('/addresses/${Uri.encodeComponent(id)}'),
         Address.fromJson,
       );
 
   Future<MixinResponse<void>> deleteAddressById(String id, String pin) =>
       MixinResponse.requestVoid(dio.post(
-        '/addresses/$id/delete',
+        '/addresses/${Uri.encodeComponent(id)}/delete',
         data: {'pin': pin},
       ));
 }

lib/src/api/asset_api.dart

@@ -14,29 +14,33 @@ class AssetApi {
 
   Future<MixinResponse<Asset>> getAssetById(String id) =>
       MixinResponse.request<Asset>(
-        dio.get('/assets/$id'),
+        dio.get('/assets/${Uri.encodeComponent(id)}'),
         Asset.fromJson,
       );
 
   Future<MixinResponse<AssetFee>> getAssetFee(String id) =>
       MixinResponse.request<AssetFee>(
-        dio.get('/assets/$id/fee'),
+        dio.get('/assets/${Uri.encodeComponent(id)}/fee'),
         AssetFee.fromJson,
       );
 
   Future<MixinResponse<List<Token>>> queryAsset(String query) =>
       MixinResponse.requestList(
-        dio.get('/network/assets/search/$query'),
+        dio.get('/network/assets/search/${Uri.encodeComponent(query)}'),
         Token.fromJson,
       );
 
-  Future<MixinResponse<List<PendingDeposit>>> pendingDeposits(String assetId,
-          {String? destination, String? tag}) =>
+  Future<MixinResponse<List<PendingDeposit>>> pendingDeposits(
+    String? assetId, {
+    String? destination,
+    String? tag,
+  }) =>
       MixinResponse.requestList(
         dio.get('/external/transactions', queryParameters: <String, dynamic>{
-          'asset': assetId,
-          'destination': destination,
-          'tag': tag,
+          if (assetId != null && assetId.isNotEmpty) 'asset': assetId,
+          if (destination != null && destination.isNotEmpty)
+            'destination': destination,
+          if (tag != null && tag.isNotEmpty) 'tag': tag,
         }),
         PendingDeposit.fromJson,
       );
@@ -54,7 +58,7 @@ class AssetApi {
 
   Future<MixinResponse<Chain>> getChain(String chainId) =>
       MixinResponse.request<Chain>(
-        dio.get('/network/chains/$chainId'),
+        dio.get('/network/chains/${Uri.encodeComponent(chainId)}'),
         Chain.fromJson,
       );
 }

lib/src/api/attachment_api.dart

@@ -10,7 +10,7 @@ class AttachmentApi {
 
   Future<MixinResponse<Attachment>> getAttachment(String id) =>
       MixinResponse.request<Attachment>(
-        dio.get('/attachments/$id'),
+        dio.get('/attachments/${Uri.encodeComponent(id)}'),
         Attachment.fromJson,
       );
 

lib/src/api/circle_api.dart

@@ -19,7 +19,7 @@ class CircleApi {
 
   Future<MixinResponse<CircleResponse>> getCircle(String id) =>
       MixinResponse.request<CircleResponse>(
-        dio.get('/circles/$id'),
+        dio.get('/circles/${Uri.encodeComponent(id)}'),
         CircleResponse.fromJson,
       );
 
@@ -32,28 +32,33 @@ class CircleApi {
   Future<MixinResponse<CircleResponse>> updateCircle(
           String id, CircleName circleName) =>
       MixinResponse.request<CircleResponse>(
-        dio.post('/circles/$id', data: circleName),
+        dio.post('/circles/${Uri.encodeComponent(id)}', data: circleName),
         CircleResponse.fromJson,
       );
 
   Future<MixinResponse<void>> deleteCircle(String id) =>
-      MixinResponse.requestVoid(dio.post('/circles/$id/delete'));
+      MixinResponse.requestVoid(
+          dio.post('/circles/${Uri.encodeComponent(id)}/delete'));
 
   Future<MixinResponse<List<CircleConversation>>> updateCircleConversations(
           String id,
           List<CircleConversationRequest> conversationCircleRequests) =>
       MixinResponse.requestList(
-        dio.post('/circles/$id/conversations',
+        dio.post('/circles/${Uri.encodeComponent(id)}/conversations',
             data: conversationCircleRequests),
         CircleConversation.fromJson,
       );
 
   Future<MixinResponse<List<CircleConversation>>> getCircleConversations(
           String id,
-          {String? offset,
+          {int? offset,
           int limit = 500}) =>
       MixinResponse.requestList(
-        dio.get('/circles/$id/conversations?offset=$offset&limit=$limit'),
+        dio.get('/circles/${Uri.encodeComponent(id)}/conversations',
+            queryParameters: {
+              if (offset != null) 'offset': offset.toString(),
+              'limit': limit,
+            }),
         CircleConversation.fromJson,
       );
 }

lib/src/api/conversation_api.dart

@@ -17,56 +17,61 @@ class ConversationApi {
   Future<MixinResponse<ConversationResponse>> update(
           String conversationId, ConversationRequest request) =>
       MixinResponse.request<ConversationResponse>(
-        dio.post('/conversations/$conversationId', data: request),
+        dio.post('/conversations/${Uri.encodeComponent(conversationId)}',
+            data: request),
         ConversationResponse.fromJson,
       );
 
   Future<MixinResponse<void>> exit(String conversationId) =>
-      MixinResponse.requestVoid(
-          dio.post('/conversations/$conversationId/exit'));
+      MixinResponse.requestVoid(dio
+          .post('/conversations/${Uri.encodeComponent(conversationId)}/exit'));
 
   Future<MixinResponse<ConversationResponse>> getConversation(String id) =>
       MixinResponse.request<ConversationResponse>(
-        dio.get('/conversations/$id'),
+        dio.get('/conversations/${Uri.encodeComponent(id)}'),
         ConversationResponse.fromJson,
       );
 
   Future<MixinResponse<ConversationResponse>> updateConversation(String id) =>
       MixinResponse.request<ConversationResponse>(
-        dio.get('/conversations/$id'),
+        dio.get('/conversations/${Uri.encodeComponent(id)}'),
         ConversationResponse.fromJson,
       );
 
   Future<MixinResponse<ConversationResponse>> participants(
           String id, String action, List<ParticipantRequest> requests) =>
       MixinResponse.request<ConversationResponse>(
-        dio.post('/conversations/$id/participants/$action', data: requests),
+        dio.post(
+            '/conversations/${Uri.encodeComponent(id)}/participants/${Uri.encodeComponent(action)}',
+            data: requests),
         ConversationResponse.fromJson,
       );
 
   Future<MixinResponse<ConversationResponse>> mute(
           String id, ConversationRequest request) =>
       MixinResponse.request<ConversationResponse>(
-        dio.post('/conversations/$id/mute', data: request),
+        dio.post('/conversations/${Uri.encodeComponent(id)}/mute',
+            data: request),
         ConversationResponse.fromJson,
       );
 
   Future<MixinResponse<ConversationResponse>> rotate(String id) =>
       MixinResponse.request<ConversationResponse>(
-        dio.post('/conversations/$id/rotate'),
+        dio.post('/conversations/${Uri.encodeComponent(id)}/rotate'),
         ConversationResponse.fromJson,
       );
 
   Future<MixinResponse<ConversationResponse>> join(String id) =>
       MixinResponse.request(
-        dio.post('/conversations/$id/join'),
+        dio.post('/conversations/${Uri.encodeComponent(id)}/join'),
         ConversationResponse.fromJson,
       );
 
   Future<MixinResponse<ConversationResponse>> disappear(
           String id, DisappearRequest request) =>
       MixinResponse.request<ConversationResponse>(
-        dio.post('/conversations/$id/disappear', data: request),
+        dio.post('/conversations/${Uri.encodeComponent(id)}/disappear',
+            data: request),
         ConversationResponse.fromJson,
       );
 }

lib/src/api/message_api.dart

@@ -11,9 +11,12 @@ class MessageApi {
       MixinResponse.requestVoid(dio.post('/acknowledgements', data: ack));
 
   Future<MixinResponse<List<BlazeMessageData>>> messageStatusOffset(
-          int offset) =>
+    int? offset,
+  ) =>
       MixinResponse.requestList<BlazeMessageData>(
-        dio.get('/messages/status/$offset'),
+        dio.get('/messages/status', queryParameters: <String, dynamic>{
+          if (offset != null) 'offset': offset.toString(),
+        }),
         BlazeMessageData.fromJson,
       );
 }

lib/src/api/provisioning_api.dart

@@ -19,7 +19,7 @@ class ProvisioningApi {
 
   Future<MixinResponse<Provisioning>> getProvisioning(String deviceId) =>
       MixinResponse.request<Provisioning>(
-        dio.get('/provisionings/$deviceId'),
+        dio.get('/provisionings/${Uri.encodeComponent(deviceId)}'),
         Provisioning.fromJson,
       );