Validate Distributor endpoints before publication

internal/config/config_test.go

@@ -1311,9 +1311,10 @@ func TestDisabledDistributorNotifyAcceptsMalformedBatchTemplates(t *testing.T) {
 
 func TestEnabledDistributorNotifyValidation(t *testing.T) {
 	tests := []struct {
-		name    string
-		mutate  func(*Config)
-		wantErr string
+		name       string
+		mutate     func(*Config)
+		wantErr    string
+		wantAbsent string
 	}{
 		{
 			name: "Endpoint",
@@ -1322,6 +1323,35 @@ func TestEnabledDistributorNotifyValidation(t *testing.T) {
 			},
 			wantErr: "notify.distributor.endpoint",
 		},
+		{
+			name: "UnsupportedEndpointScheme",
+			mutate: func(cfg *Config) {
+				cfg.Notify.Distributor.Endpoint = "ftp://distributor.example.test"
+			},
+			wantErr: "notify.distributor.endpoint",
+		},
+		{
+			name: "EndpointUserinfo",
+			mutate: func(cfg *Config) {
+				cfg.Notify.Distributor.Endpoint = "https://userinfo-secret@distributor.example.test"
+			},
+			wantErr:    "notify.distributor.endpoint",
+			wantAbsent: "userinfo-secret",
+		},
+		{
+			name: "EndpointQuery",
+			mutate: func(cfg *Config) {
+				cfg.Notify.Distributor.Endpoint = "https://distributor.example.test?preview=1"
+			},
+			wantErr: "notify.distributor.endpoint",
+		},
+		{
+			name: "EndpointFragment",
+			mutate: func(cfg *Config) {
+				cfg.Notify.Distributor.Endpoint = "https://distributor.example.test#status"
+			},
+			wantErr: "notify.distributor.endpoint",
+		},
 		{
 			name: "TokenEnvEmpty",
 			mutate: func(cfg *Config) {
@@ -1422,6 +1452,27 @@ func TestEnabledDistributorNotifyValidation(t *testing.T) {
 			if !strings.Contains(err.Error(), tt.wantErr) {
 				t.Fatalf("error = %q, want %q", err.Error(), tt.wantErr)
 			}
+			if tt.wantAbsent != "" && strings.Contains(err.Error(), tt.wantAbsent) {
+				t.Fatalf("error = %q, must not contain endpoint userinfo", err.Error())
+			}
+		})
+	}
+}
+
+func TestEnabledDistributorNotifyAcceptsHTTPBasePaths(t *testing.T) {
+	for _, endpoint := range []string{
+		"http://distributor.example.test/archive",
+		"https://distributor.example.test/archive/",
+	} {
+		t.Run(endpoint, func(t *testing.T) {
+			cfg := Defaults()
+			cfg.Notify.Distributor.Enabled = true
+			cfg.Notify.Distributor.Endpoint = endpoint
+			cfg.Notify.Distributor.PipelineIDTemplate = "weatherreporter.{artifact_group}"
+
+			if err := Validate(cfg); err != nil {
+				t.Fatalf("Validate() error = %v", err)
+			}
 		})
 	}
 }

internal/config/validate.go

@@ -119,9 +119,8 @@ func validateDistributorNotify(cfg DistributorNotifyConfig) error {
 		return nil
 	}
 
-	parsed, err := url.Parse(cfg.Endpoint)
-	if err != nil || parsed.Scheme == "" || parsed.Host == "" {
-		return fmt.Errorf("notify.distributor.endpoint must be an absolute URL when enabled")
+	if err := ValidateDistributorEndpoint(cfg.Endpoint); err != nil {
+		return fmt.Errorf("notify.distributor.endpoint %w", err)
 	}
 	if cfg.TokenEnv == "" {
 		return fmt.Errorf("notify.distributor.token_env is required when enabled")
@@ -172,6 +171,25 @@ func validateDistributorNotify(cfg DistributorNotifyConfig) error {
 	return nil
 }
 
+// ValidateDistributorEndpoint verifies the endpoint grammar accepted by the
+// pinned Distributor upload client.
+func ValidateDistributorEndpoint(endpoint string) error {
+	parsed, err := url.Parse(endpoint)
+	if err != nil || parsed.Scheme == "" || parsed.Host == "" {
+		return fmt.Errorf("must be an absolute URL")
+	}
+	if parsed.Scheme != "http" && parsed.Scheme != "https" {
+		return fmt.Errorf("must use http or https")
+	}
+	if parsed.User != nil {
+		return fmt.Errorf("must not include userinfo")
+	}
+	if parsed.RawQuery != "" || parsed.Fragment != "" {
+		return fmt.Errorf("must not include query or fragment")
+	}
+	return nil
+}
+
 func validateDistributorBatchNotify(cfg DistributorBatchNotifyConfig) error {
 	if !cfg.Enabled {
 		return nil