fix: reject an --api-url that is not an http(s) URL, with exit 2

[eastagiletracker]

This PR proposes rejecting an --api-url / DATABOX_API_URL that is not an http(s) URL with exit 2, instead of failing later with a raw TypeError or a misleading connection error. We include this PR work along with a full history of your repo at https://eastagiletracker.com/projects/1047. You can sign in with your GitHub ID to claim ownership of the project.

What was wrong

The API base URL was never checked, so a mistake only showed up once a request was built. If the URL has no scheme (api.databox.com), every command fails with a bare TypeError: Invalid URL and exits 1, which the README's exit-code table reserves for errors from the API. localhost:8080 is worse: new URL() reads it as a URL whose scheme is localhost:, so it gets as far as fetch() and is reported as Could not connect to API. Check your internet connection.. That message also tells the user to quote a request ID to support, but the request never left the machine. And auth login --api-url api.databox.com saves the bad URL, prints only Warning: API key could not be validated. and exits 0, so every command after it fails the same way.

Reproduced on main at be7d72d:

$ DATABOX_API_URL=api.databox.com databox data-source list
    TypeError: Invalid URL
    Code: ERR_INVALID_URL
exit=1
$ DATABOX_API_URL=localhost:8080 databox data-source list
 ›   Error: Could not connect to API. Check your internet connection.
 ›     Request ID: 2217c03c-... (sent by the CLI; the request may still have reached the API, so quote this ID to support)
exit=2
$ databox auth login --api-key pak_x --api-url api.databox.com
 ›   Warning: API key could not be validated.
exit=0
$ cat ~/.config/databox-cli/config.json
{ "apiKey": "pak_x", "apiUrl": "api.databox.com" }
$ databox data-source list
    TypeError: Invalid URL
exit=1

The change

• isApiUrl() in src/lib/api-client.ts accepts only an absolute http: or https: URL.
• BaseCommand.init checks --api-url / DATABOX_API_URL next to the --account-id check. A bad value exits 2 before any prompt or request, and the message names the value: --api-url must be an http:// or https:// URL, e.g. https://api.databox.com. Got "api.databox.com" (from --api-url or DATABOX_API_URL).
• A bad URL that is already stored in the config exits 1, the same as an unreadable config. The message gives the file path and the command that replaces the URL (databox auth login --api-url https://api.databox.com). Passing --api-url still overrides the stored value.
• auth login checks --api-url before it prompts, reads stdin or saves anything, so a bad URL can no longer be stored.
• The README exit-code table now lists both cases.

Verification

npm test (lint plus unit suite) passes: 628 tests after the change. Before it, the baseline had 612 passing and 1 failure, a 10s cold-start timeout in base-command.test.ts that does not happen on a re-run, so the change adds no new failures. There are 16 new tests: isApiUrl cases (no scheme, host:port, ftp:/file:), plus command-level tests for the flag, the env var, a stored URL, override by flag, a good stored URL still being used, a destructive command failing before its prompt, and auth login saving nothing. If I keep the helper but revert the checks in base-command.ts and login.ts, 6 of the new tests fail. tsc -b and tsc -p tsconfig.test.json --noEmit both pass. With the built CLI, the four commands above now each exit 2 with the message shown, auth login writes no config file, and a stored bad URL gives the exit-1 message with the replacement command.

How this was managed

This work was tracked as https://eastagiletracker.com/projects/1047/stories/1334302 on https://eastagiletracker.com/projects/1047, a board we imported from this repository's pull requests (8 stories) and used to manage this work.

If you'd rather not receive contributions like this, reply no-more-prs on this pull request and we won't open any further ones on your repositories.

---

Lawrence W. Sinclair
CEO / East Agile
linkedin.com/in/lwsinclair/
eastagile.com