fix: allow user-token deletion of encoded item keys

[nobodyiam]

User-token requests to delete keys containing / or \ fail during Spring parameter binding because the encoded-items DELETE contract requires operator. Ordinary-key deletion already allows the server to resolve the operator from the token owner.

Make the encoded DELETE query parameter optional, document the user-token and consumer-token behavior, and add a contract regression test for both deletion routes. Bump the document version to 0.3.12 and record the fix in the changelog. Consumer tokens still require an explicit operator in Apollo's existing validation logic.

Validation:

• All 14 Python contract tests passed.
• ./generate.sh --verify passed.
• Apollo built successfully using this local contract; 70 related server tests passed.
• Three real-service E2E cases passed for plain, slash, and backslash keys, including read-after-delete and preservation of the other keys.

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Advanced

Run ID: fe7052d9-23ec-4571-8d91-a8935e481ed1

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-20T10:17:39.047542Z	8a5af73	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[Copilot]

Copilot review overview

🟢 Approval recommended

All reviewed changes are covered by passing contract validation and regression tests.

Review effort: Lite
Findings: None

What changed in this PR

Updates the OpenAPI contract to support user-token deletion of encoded keys while preserving consumer-token validation.

Changes:

• Makes operator optional for applicable deletion routes.
• Adds regression coverage and documentation.
• Bumps the contract version to 0.3.12 and updates the changelog.

File	Description
tests/​test_user_token_contract.py	Verifies optional operator handling for both deletion routes.
CHANGELOG.md	Records the fix in version 0.3.12.
apollo-openapi.yaml	Updates the contract version and encoded deletion parameter documentation.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.