fix(endpoints): normalize URL handling (#4338)

tests/test_integrations_store_shape.py

@@ -83,6 +83,27 @@ def test_create_integration_rejects_blank_base_url_without_persisting(integratio
     assert integrations.load_integrations() == []
 
 
+@pytest.mark.parametrize(("base_url", "message"), [
+    ("ftp://example.test", "Integration base URL must be an HTTP(S) URL"),
+    ("https://example.test/api?token=abc", "Integration base URL must not include query or fragment"),
+    ("https://example.test/api#fragment", "Integration base URL must not include query or fragment"),
+])
+def test_create_integration_rejects_invalid_base_url_without_persisting(
+    integrations_routes, base_url, message
+):
+    endpoint, session_cookie, http_exception = integrations_routes
+    create_integration = endpoint("/api/auth/integrations", "POST")
+
+    with pytest.raises(http_exception) as exc:
+        asyncio.run(create_integration(
+            _JsonRequest({"name": "Example", "base_url": base_url}, session_cookie)
+        ))
+
+    assert exc.value.status_code == 400
+    assert exc.value.detail == message
+    assert integrations.load_integrations() == []
+
+
 @pytest.mark.parametrize("blank_name", ["", "   "])
 def test_update_integration_rejects_blank_name_without_changing_existing(integrations_routes, blank_name):
     endpoint, session_cookie, http_exception = integrations_routes
@@ -127,3 +148,32 @@ def test_update_integration_rejects_blank_base_url_without_changing_existing(int
     assert exc.value.status_code == 400
     assert exc.value.detail == "Integration base URL is required"
     assert integrations.load_integrations()[0]["base_url"] == "https://example.test"
+
+
+@pytest.mark.parametrize(("base_url", "message"), [
+    ("ftp://example.test", "Integration base URL must be an HTTP(S) URL"),
+    ("https://example.test/api?token=abc", "Integration base URL must not include query or fragment"),
+    ("https://example.test/api#fragment", "Integration base URL must not include query or fragment"),
+])
+def test_update_integration_rejects_invalid_base_url_without_changing_existing(
+    integrations_routes, base_url, message
+):
+    endpoint, session_cookie, http_exception = integrations_routes
+    update_integration = endpoint("/api/auth/integrations/{integration_id}", "PUT")
+    integrations.save_integrations([
+        {
+            "id": "existing",
+            "name": "Original",
+            "base_url": "https://example.test",
+        }
+    ])
+
+    with pytest.raises(http_exception) as exc:
+        asyncio.run(update_integration(
+            integration_id="existing",
+            request=_JsonRequest({"base_url": base_url}, session_cookie),
+        ))
+
+    assert exc.value.status_code == 400
+    assert exc.value.detail == message
+    assert integrations.load_integrations()[0]["base_url"] == "https://example.test"