Encode IDs in Legacy client request paths

src/Legacy/IntercomAdmins.php

@@ -43,6 +43,6 @@ public function getAdmin($id, $options = [])
      */
     public function adminPath($id)
     {
-        return 'admins/' . $id;
+        return 'admins/' . self::pathSegment($id);
     }
 }

src/Legacy/IntercomCompanies.php

@@ -116,7 +116,7 @@ public function getCompanyUsers($id, $options = [])
      */
     public function companyPath($id)
     {
-        return 'companies/' . $id;
+        return 'companies/' . self::pathSegment($id);
     }
 
     /**
@@ -125,7 +125,7 @@ public function companyPath($id)
      */
     public function companyUsersPath($id)
     {
-        return 'companies/' . $id . '/users';
+        return 'companies/' . self::pathSegment($id) . '/users';
     }
 
     /**
@@ -134,7 +134,7 @@ public function companyUsersPath($id)
      */
     public function companyAttachPath(string $contactId)
     {
-        return 'contacts/' . $contactId . '/companies';
+        return 'contacts/' . self::pathSegment($contactId) . '/companies';
     }
 
     /**
@@ -144,6 +144,6 @@ public function companyAttachPath(string $contactId)
      */
     public function companyDetachPath(string $contactId, string $companyId)
     {
-        return 'contacts/' . $contactId . '/companies/' . $companyId;
+        return 'contacts/' . self::pathSegment($contactId) . '/companies/' . self::pathSegment($companyId);
     }
 }

src/Legacy/IntercomContacts.php

@@ -128,6 +128,6 @@ public function nextCursor($pages)
      */
     public function contactPath(string $id)
     {
-        return 'contacts/' . $id;
+        return 'contacts/' . self::pathSegment($id);
     }
 }

src/Legacy/IntercomConversations.php

@@ -129,7 +129,7 @@ public function markConversationAsRead($id)
      */
     public function conversationPath($id)
     {
-        return 'conversations/' . $id;
+        return 'conversations/' . self::pathSegment($id);
     }
 
     /**
@@ -140,6 +140,6 @@ public function conversationPath($id)
      */
     public function conversationReplyPath($id)
     {
-        return 'conversations/' . $id . '/reply';
+        return 'conversations/' . self::pathSegment($id) . '/reply';
     }
 }

src/Legacy/IntercomLeads.php

@@ -97,7 +97,7 @@ public function convertLead($options)
      */
     public function leadPath($id)
     {
-        return "contacts/" . $id;
+        return "contacts/" . self::pathSegment($id);
     }
 
     /**

src/Legacy/IntercomNotes.php

@@ -43,6 +43,6 @@ public function getNotes($options)
      */
     public function getNote($id)
     {
-        return $this->client->get("notes/" . $id, []);
+        return $this->client->get("notes/" . self::pathSegment($id), []);
     }
 }

src/Legacy/IntercomResource.php

@@ -18,4 +18,20 @@ public function __construct(IntercomClient $client)
     {
         $this->client = $client;
     }
+
+    /**
+     * Returns $id as a single URL path segment.
+     *
+     * @param  string|int $id
+     * @return string
+     * @throws \InvalidArgumentException if the value is empty, "." or ".."
+     */
+    protected static function pathSegment($id)
+    {
+        $id = (string) $id;
+        if ($id === "" || $id === "." || $id === "..") {
+            throw new \InvalidArgumentException("Invalid ID for request path.");
+        }
+        return rawurlencode($id);
+    }
 }

src/Legacy/IntercomSegments.php

@@ -18,7 +18,7 @@ class IntercomSegments extends IntercomResource
      */
     public function getSegment($id, array $options = [])
     {
-        return $this->client->get('segments/' . $id, $options);
+        return $this->client->get('segments/' . self::pathSegment($id), $options);
     }
 
     /**

src/Legacy/IntercomTeams.php

@@ -43,6 +43,6 @@ public function getTeam($id, $options = [])
      */
     public function teamPath($id)
     {
-        return 'teams/' . $id;
+        return 'teams/' . self::pathSegment($id);
     }
 }

src/Legacy/IntercomUsers.php

@@ -124,6 +124,6 @@ public function permanentlyDeleteUser(string $id)
      */
     public function userPath(string $id)
     {
-        return 'users/' . $id;
+        return 'users/' . self::pathSegment($id);
     }
 }

src/Legacy/IntercomVisitors.php

@@ -72,6 +72,6 @@ public function convertVisitor($options)
      */
     public function visitorPath($id)
     {
-        return "visitors/" . $id;
+        return "visitors/" . self::pathSegment($id);
     }
 }

tests/Legacy/IntercomResourcePathTest.php

@@ -0,0 +1,65 @@
+<?php
+
+namespace Intercom\Tests\Legacy;
+
+use GuzzleHttp\Client;
+use GuzzleHttp\Handler\MockHandler;
+use GuzzleHttp\HandlerStack;
+use GuzzleHttp\Psr7\Response;
+use Intercom\Legacy\IntercomClient;
+use InvalidArgumentException;
+use PHPUnit\Framework\TestCase;
+
+class IntercomResourcePathTest extends TestCase
+{
+    private IntercomClient $client;
+    private MockHandler $mockHandler;
+
+    protected function setUp(): void
+    {
+        $this->mockHandler = new MockHandler();
+        $httpClient = new Client(['handler' => HandlerStack::create($this->mockHandler)]);
+
+        $this->client = new IntercomClient('test_token');
+        $this->client->setHttpClient($httpClient);
+    }
+
+    public function testEncodesIdInPath(): void
+    {
+        $this->mockHandler->append(new Response(200, [], json_encode([])));
+
+        $this->client->contacts->getContact('a/b?c#d');
+
+        $uri = $this->mockHandler->getLastRequest()->getUri();
+        $this->assertSame('/contacts/a%2Fb%3Fc%23d', $uri->getPath());
+        $this->assertSame('', $uri->getQuery());
+        $this->assertSame('', $uri->getFragment());
+    }
+
+    public function testEncodesEveryIdInCompanyDetachPath(): void
+    {
+        $this->assertSame(
+            'contacts/a%2Fb/companies/c%3Fd',
+            $this->client->companies->companyDetachPath('a/b', 'c?d')
+        );
+    }
+
+    public function testKeepsPlainIdUnchanged(): void
+    {
+        $this->assertSame('users/abc123', $this->client->users->userPath('abc123'));
+    }
+
+    /**
+     * @dataProvider invalidIdProvider
+     */
+    public function testRejectsDotSegmentId(string $id): void
+    {
+        $this->expectException(InvalidArgumentException::class);
+        $this->client->contacts->getContact($id);
+    }
+
+    public function invalidIdProvider(): array
+    {
+        return [[''], ['.'], ['..']];
+    }
+}