404 on actor/group gates whose names contain URL-reserved characters (e.g. /)

[redac]

Summary

Actor and group gates whose for value contains URL-reserved characters — most commonly / — can be created through the admin form but cannot be toggled or cleared afterwards: every action on them returns 404.

Flag names themselves are already well-guarded (Utils.validate_flag_name/2 enforces ^\w+$ on the /flags form), but actor ids and group names go through Utils.validate/1 which only rejects blank and ?. So any actor id or group name containing / slips through creation and then becomes unmanageable.

Repro

1. Open any flag in the admin UI.
2. Add an actor with an id containing a slash, e.g. w:foo/bar.
3. The actor row renders with an Enable/Disable and Clear button.
4. Click either button → 404 instead of the expected 302.

scr-2026-04-10-15.34.15.mp4

(Same happens for group gates whose name contains a /.)

What I think is going on

The form action rendered by _actor.html.eex / _group.html.eex ends up with a literal / inside the gate segment — e.g. /flags/test_flag_one/actors/w:foo/bar. The adapter splits on /, path_info becomes ["flags", "test_flag_one", "actors", "w:foo", "bar"], the /flags/:name/actors/:actor_id route can't match a 5-segment path, and it falls through to the 404 catch-all.

From a quick read, it looks like both Templates.url_safe/1 (used by the EEx templates when interpolating actor/group for values) and the redirect_to interpolations in Router pass the gate value through without percent-encoding reserved characters.

[redac]

Opened a fix in #54. Happy to adjust the approach if needed.

[redac]

Hello @tompave, any chances of this being merged soon? Thanks!