fix: require https for external pricing providers

Require HTTPS-only external pricing-provider URLs and verify the adapter contract with the application suite.
2026-09-09 22:42:35 -04:00
parent 79df9d5c88
commit aaa9e2a370
2 changed files with 32 additions and 1 deletions
@@ -58,6 +58,26 @@ test("fixture provider returns deterministic normalized observations", async ()
  });
 });

+test("http provider rejects insecure or malformed external provider URLs", () => {
+  assert.throws(
+    () =>
+      createHttpPricingProvider({
+        id: "http-provider",
+        endpoint: "http://provider.example/prices",
+      }),
+    /HTTPS/i,
+  );
+
+  assert.throws(
+    () =>
+      createHttpPricingProvider({
+        id: "http-provider",
+        endpoint: "not-a-url",
+      }),
+    /valid https URL/i,
+  );
+});
+
 test("http provider sends mapping context and normalizes its response", async () => {
  let request;
  const provider = createHttpPricingProvider({