fix(server): personal access tokens named login, . or .. can't be deleted over HTTP #4674

Bug description

Some personal access token names can be created but cannot be deleted over HTTP.

• login: POST /personal-access-tokens/login is a separate route (core/server/src/http.rs:409) and looks like it wins over DELETE /personal-access-tokens/{name} (http.rs:547) for this one name, so the delete should answer 405 and the token stays.
• . and ..: the server only checks that a name is 1-255 bytes (WireName::new), so a token with either name can be created over TCP. The Rust HTTP client now rejects both before sending a delete (feat(cpp): expose get and delete personal access tokens #4628), because the URL parser resolves them as dot segments even when percent-encoded. So the token cannot be deleted over HTTP.

Expected: a token the server accepted at create can be deleted over HTTP, or the create refuses the name.

Possible fix: reject these names at create (as hubcio suggested in the review of #4628), or give the delete a route that doesn't depend on the name being a path segment.

The login case comes from reading the routes. I have not reproduced the 405 against a running server.

Affected area / component

Iggy server, Rust SDK

Versions

master at d6e42a7cd

Hardware / environment

macOS, local

Reproduction

1. Create a token named login (or ..) over TCP.
2. Try to delete it over HTTP (DELETE /personal-access-tokens/login).
3. The delete doesn't remove the token. Expected 405 for login, not yet confirmed live.

Contribution

• I'm willing to submit a pull request to fix this bug