fix: require https for external pricing providers

Require HTTPS-only external pricing-provider URLs and verify the adapter contract with the application suite.
2026-09-09 22:42:35 -04:00
parent 79df9d5c88
commit aaa9e2a370
2 changed files with 32 additions and 1 deletions
@@ -10,10 +10,21 @@ export function createHttpPricingProvider({
    throw new Error('Pricing provider endpoint is required.');
  }

+  let parsedUrl;
+  try {
+    parsedUrl = new URL(endpoint);
+  } catch {
+    throw new Error('Pricing provider endpoint must be a valid HTTPS URL.');
+  }
+
+  if (parsedUrl.protocol !== 'https:') {
+    throw new Error('Pricing provider endpoint must use HTTPS.');
+  }
+
  return createPricingProvider({
    id,
    async observe(input) {
-      const url = new URL(endpoint);
+      const url = new URL(parsedUrl.toString());
      for (const [key, value] of Object.entries(input)) {
        if (value) url.searchParams.set(key, value);
      }