Add failing tests for #652: purchase CORS violation & mock API in production

[prompt-driven-github]

Summary

Adds failing tests that detect the bug reported in promptdriven/pdd_cloud#678 — purchase in settings dashboard fails with CORS violation and mock API handlers active in production.

Test Files

• Unit tests: tests/server/test_security.py, tests/core/test_cloud.py
• E2E test: tests/test_e2e_issue_652_purchase_cors.py

What This PR Contains

• 5 failing tests that reproduce the reported bug:
  • 2 CORS failures: configure_cors() only allows localhost origins, missing https://promptdriven.ai
  • 3 endpoint registry failures: CLOUD_ENDPOINTS missing processPddcPurchase entry
• 4 passing guardrails: localhost origins preserved, unknown origins rejected, env defaults to prod, existing endpoints registered
• Tests are verified to fail on current code and will pass once the bug is fixed

Root Cause

Two independent bugs in the web application:

1. CORS: configure_cors() in pdd/server/security.py only configures localhost origins, missing production origin https://promptdriven.ai
2. Mock API in production: CLOUD_ENDPOINTS in pdd/core/cloud.py is missing processPddcPurchase, causing fallback to mock handlers

Next Steps

1. Implement the fix at the identified locations
2. Verify the unit tests pass
3. Verify the E2E tests pass
4. Run full test suite
5. Mark PR as ready for review

Fixes promptdriven/pdd_cloud#678

---

Generated by PDD agentic bug workflow

General fix: instead of checking that the production hostname appears as a substring of the full URL, parse the URL and assert on its hostname (and, if desired, scheme/path). This follows the guidance to operate on structured URL components rather than raw substrings.

Best concrete fix here:

• In tests/core/test_cloud.py, import urlparse (from urllib.parse) alongside existing imports.
• In test_purchase_endpoint_url_resolves_to_production, after obtaining url, parse it with urlparse(url) and assert that parsed.hostname equals the expected production hostname.
• Optionally, we can also assert that the scheme is https to preserve the intent that this is a production Cloud Functions URL, but the minimal change needed to address the CodeQL warning is to replace the substring check with a hostname equality check using urlparse.

Specific changes:

1. Add from urllib.parse import urlparse after the other imports at the top of tests/core/test_cloud.py.

2. Replace:

   url = CloudConfig.get_endpoint_url("processPddcPurchase")
   
   assert "us-central1-prompt-driven-development.cloudfunctions.net" in url, (
       f"Purchase endpoint must resolve to production cloud functions URL. Got: {url}"
   )

   with:

   url = CloudConfig.get_endpoint_url("processPddcPurchase")
   parsed = urlparse(url)
   
   assert parsed.hostname == "us-central1-prompt-driven-development.cloudfunctions.net", (
       f"Purchase endpoint must resolve to production cloud functions hostname. Got: {parsed.hostname} (URL: {url})"
   )

   leaving the subsequent checks about processPddcPurchase in the path and absence of “mock/local” substrings unchanged.

No other files or logic need to be modified.

---

In general, to avoid incomplete URL substring sanitization, do not treat the URL as an opaque string when checking for allowed or disallowed hosts. Instead, parse it with a proper URL parser (such as urllib.parse.urlparse in Python) and inspect the hostname (and potentially scheme/port) fields, then compare those fields against an allowlist (or explicit expected values) using exact or well-defined suffix checks.

For this specific test, we should replace the substring assertion:

assert "us-central1-prompt-driven-development.cloudfunctions.net" in url

with a host-based assertion that parses url and verifies that its hostname matches the expected production hostname. This keeps the functional intent (“must point to the Cloud Functions production host”) while avoiding substring-based checks. Concretely:

1. Import urlparse (or urllib.parse) at the top of this test file (we’re allowed to add well-known standard-library imports).
2. Parse url via urlparse(url) and extract hostname.
3. Assert that hostname equals "us-central1-prompt-driven-development.cloudfunctions.net" (or, if you want to be tolerant of schemes/paths but strict about host, assert parsed.hostname == EXPECTED_HOST).

No other tests or logic need to change.