specshield 3.4.8 → 3.4.9

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "specshield",
-  "version": "3.4.8",
+  "version": "3.4.9",
   "description": "Contract compatibility testing for APIs — catch breaking OpenAPI changes before they reach your consumers, with can-i-deploy deploy gating and GitHub PR checks. (a.k.a. bidirectional contract testing.)",
   "main": "src/cli.js",
   "homepage": "https://specshield.io",

package/src/commands/compare.js

@@ -12,6 +12,7 @@ const { classifyChanges, filterBySeverity } = require('../core/classifyChanges')
 const { formatHuman, formatJson } = require('../core/outputFormatter');
 const { loadConfig } = require('../core/configLoader');
 const { resolveExitCode } = require('../core/exitCode');
+const { resolveRemoteUrl } = require('../core/remoteUrl');
 const { recordCompareAndMaybeRender } = require('../core/conversionPrompt');
 const logger = require('../utils/logger');
 const exitAfterFlush = require('../utils/exitAfterFlush');
@@ -168,7 +169,7 @@ async function runRemoteComparison(base, target, options, spinner) {
   const baseRaw = await loadSpec(base);
   const targetRaw = await loadSpec(target);
 
-  const url = options.remoteUrl || HOSTED_API_URL + '/compare';
+  const url = resolveRemoteUrl(options.remoteUrl, HOSTED_API_URL);
   const timeout = parseInt(options.timeout, 10) || 10000;
 
   if (spinner) spinner.text = `Sending to hosted API...`;
@@ -186,7 +187,7 @@ async function runRemoteComparison(base, target, options, spinner) {
       { baseSpec: baseRaw, targetSpec: targetRaw },
       { timeout, headers }
     );
-    return response.data;
+    return normalizeRemoteResult(response.data, url);
   } catch (err) {
     const msg = err.response
       ? `Remote API error ${err.response.status}: ${JSON.stringify(err.response.data)}`
@@ -195,6 +196,30 @@ async function runRemoteComparison(base, target, options, spinner) {
   }
 }
 
+/**
+ * A remote response is untrusted input. Without this, a proxy error page or a
+ * redirect to the marketing site arrives as a 200 with an HTML body, and the
+ * first `.filter` downstream throws an unreadable TypeError at the user.
+ */
+function normalizeRemoteResult(data, url) {
+  if (!data || typeof data !== 'object' || !Array.isArray(data.breakingChanges)) {
+    const gotHtml = typeof data === 'string' && /<html|<!doctype/i.test(data);
+    throw new Error(
+      `Unexpected response from ${url}` +
+      (gotHtml
+        ? ' — that URL returned a web page, not the compare API. Pass the server base URL, e.g. --remote-url https://specshield.io'
+        : ' — the response was not a comparison result.')
+    );
+  }
+  // Downstream steps assume all four arrays exist.
+  return {
+    ...data,
+    additions: data.additions || [],
+    modifications: data.modifications || [],
+    warnings: data.warnings || [],
+  };
+}
+
 function applyIgnoreList(result, ignoreList) {
   if (!ignoreList || ignoreList.length === 0) return result;
 

package/src/core/remoteUrl.js

@@ -0,0 +1,20 @@
+'use strict';
+
+/**
+ * Resolve the hosted compare endpoint from a base URL.
+ *
+ * `--remote-url` is documented as "Override the hosted API base URL", but the
+ * value used to be passed to axios verbatim — so `--remote-url https://host`
+ * POSTed to the site root instead of /compare. The root answers with a web page
+ * or a 405, and the CLI then died on `Cannot read properties of undefined
+ * (reading 'filter')` while trying to read breakingChanges off HTML.
+ *
+ * A URL that already ends in /compare is returned unchanged, so anyone who
+ * worked around the old behaviour by passing the full endpoint keeps working.
+ */
+function resolveRemoteUrl(remoteUrl, hostedDefault) {
+  const base = String(remoteUrl || hostedDefault).trim().replace(/\/+$/, '');
+  return /\/compare$/i.test(base) ? base : base + '/compare';
+}
+
+module.exports = { resolveRemoteUrl };