- Shipped
- August 5, 2026 at 8:02 PM UTC
- Author
- kamo
- Commit
- 106f064
forwardToApi appended the browser's query string to whatever it was given, so a caller passing its own query produced a URL with two '?'. Everything after the first is the query string, so the first copy's last param absorbed '?' plus the entire second copy: /doc-types?assocType=13 became assocType=13?assocType=13. DocsService binds that to an Integer, so the HR Resources tab's doc-types call was a visible 400 in the logs. On a String param it just fails quietly — KB search was sending q=onboarding?q=onboarding and searching for garbage. Roughly fifteen routes pass a query this way, imaging folders and assoc-config included. The function's doc comment already warned callers not to do this; merging fixes every one of them at once and cannot regress a path-only caller. A caller's value wins over the browser's for the same key, so a route that deliberately rewrites a param still overrides.