INTER-2499 fix: url encode path parameters (api-v3)

[JuroUhlar]

Fixes INTER-2499 on the api-v3 line. Backport of #282. Path params were interpolated raw, so getEvent('../events/search') requested /events/search.

• Encode path params with encodeURIComponent in getRequestPath, the choke point for getEvent, updateEvent, getVisits (and the deprecated getVisitorHistory) and deleteVisitorData.
• Reject . and .. with a TypeError.
• Unit tests for the encoding table; wire-level tests per operation asserting the exact fetch URL and host.

Real IDs are encodeURIComponent no-ops, so nothing changes on the wire for legitimate traffic.

Differences from #282

• getRequestPath on this branch keeps its generic signature and has no apiVersion prefix, so the normalization guard compares url.pathname against the path as-is.
• Tests are Jest, so the three cases carrying an error cause assert the type and the message separately — toThrow(new TypeError(...)) compares cause too.
• The wire-level table also covers getVisits, which does not exist on v4.

Discussion point: why . and .. throw instead of being encoded

The URL Standard treats %2e as a dot when matching dot-path segments, so new URL() drops the segment for .. and %2E%2E alike. A literal dot segment is unrepresentable, so throwing is the only option.

[changeset-bot]

🦋 Changeset detected

Latest commit: bbed302

The changes in this PR will be included in the next version bump.

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[github-actions]

Coverage report

St.❔	Category	Percentage	Covered / Total
🟢	Statements	97.53% (+1.8% 🔼)	237/243
🟢	Branches	95.24% (+5.49% 🔼)	80/84
🟢	Functions	97.78%	44/45
🟢	Lines	97.52% (+1.83% 🔼)	236/242

Test suite run success

137 tests passing in 12 suites.

Report generated by 🧪jest coverage report action from bbed302

Show full coverage report

St	File	% Stmts	% Branch	% Funcs	% Lines	Uncovered Line #s
🟢	All files	97.53	95.23	97.77	97.52
🟢	src	96.89	93.75	96.55	96.89
🟢	index.ts	100	100	100	100
🟢	responseUtils.ts	100	100	100	100
🟢	sealedResults.ts	100	100	100	100
🟢	serverApiClient.ts	95.52	90.9	90	95.52	37,140,234
🟢	types.ts	100	100	100	100
🟢	urlUtils.ts	96.07	90.9	100	96.07	37,47
🟡	utils.ts	75	100	100	75	6
🟢	webhook.ts	100	100	100	100
🟢	src/errors	100	100	100	100
🟢	apiErrors.ts	100	100	100	100
🟢	getRetryAfter.ts	100	100	100	100
🟢	handleErrorResponse.ts	100	100	100	100
🟢	unsealError.ts	100	100	100	100

[Copilot]

🟢 Approval recommended

No unresolved review issues were identified.

Pull request overview

Fixes API v3 path parameter handling by encoding values and rejecting dot segments that could normalize to unintended endpoints.

Changes:

• Encodes path parameters safely.
• Rejects . and .. values.
• Adds unit and wire-level tests.
• Documents the patch release.

File summaries

File	Description
tests/unit-tests/urlUtilsTests.spec.ts	Tests encoding and invalid inputs.
tests/mocked-responses-tests/pathParamEncodingTests.spec.ts	Verifies exact request URLs and hosts.
src/urlUtils.ts	Implements path encoding and validation.
.changeset/encode-path-parameters.md	Records the patch release.

Review details

• Files reviewed: 4/4 changed files
• Comments generated: 0
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[mcnulty-fp]

Just one minor thing but other than that, looks good!

[github-actions]

🚀 Following releases will be created using changesets from this PR:

@fingerprintjs/fingerprintjs-pro-server-api@6.13.1

Patch Changes

• URL-encode path parameters; reject "." and ".." path parameters with a TypeError. (e015be1)

[Copilot]

🟢 Approval recommended

The reviewed changes have no unresolved blocking issues.

Review details

• Files reviewed: 4/4 changed files
• Comments generated: 0 new
• Review effort level: Lite