Create class to handle absolute urls

python_anvil/api.py

@@ -15,7 +15,7 @@
     ForgeSubmitPayload,
     GeneratePDFPayload,
 )
-from .api_resources.requests import PlainRequest, RestRequest
+from .api_resources.requests import FullyQualifiedRequest, PlainRequest, RestRequest
 from .http import GQLClient, HTTPClient
 
 
@@ -117,6 +117,10 @@ def request_rest(self, options: Optional[dict] = None):
         api = RestRequest(self.client, options=options)
         return api
 
+    def request_fully_qualified(self, options: Optional[dict] = None):
+        api = FullyQualifiedRequest(self.client, options=options)
+        return api
+
     def fill_pdf(
         self, template_id: str, payload: Union[dict, AnyStr, FillPDFPayload], **kwargs
     ):

python_anvil/api_resources/requests.py

@@ -161,3 +161,29 @@ class PlainRequest(BaseAnvilHttpRequest):
 
     def get_url(self):
         return f"{self.API_HOST}/{self.API_BASE}"
+
+
+class FullyQualifiedRequest(BaseAnvilHttpRequest):
+    """A request class that validates URLs point to Anvil domains."""
+
+    VALID_HOSTS = [
+        "https://app.useanvil.com",
+        # Future Anvil specific URLs
+    ]
+
+    def get_url(self):
+        return ""  # Not used since we expect full URLs
+
+    def _validate_url(self, url):
+        if not any(url.startswith(host) for host in self.VALID_HOSTS):
+            raise ValueError(
+                f"URL must start with one of: {', '.join(self.VALID_HOSTS)}"
+            )
+
+    def get(self, url, params=None, **kwargs):
+        self._validate_url(url)
+        return super().get(url, params, **kwargs)
+
+    def post(self, url, data=None, **kwargs):
+        self._validate_url(url)
+        return super().post(url, data, **kwargs)

python_anvil/tests/test_api.py

@@ -396,3 +396,61 @@ def test_minimum_valid_data_submission(m_request_post, anvil):
             anvil.forge_submit(payload=payload)
             assert m_request_post.call_count == 1
             assert _expected_data in m_request_post.call_args
+
+    def describe_rest_request_absolute_url_behavior():
+        @pytest.mark.parametrize(
+            "url, should_raise",
+            [
+                ("some/relative/path", True),
+                ("https://external.example.com/full/path/file.pdf", True),
+                ("https://app.useanvil.com/api/v1/some-endpoint", False),
+            ],
+        )
+        @mock.patch("python_anvil.api_resources.requests.AnvilRequest._request")
+        def test_get_behavior(mock_request, anvil, url, should_raise):
+            mock_request.return_value = (b"fake_content", 200, {})
+            rest_client = anvil.request_fully_qualified()
+
+            if should_raise:
+                with pytest.raises(
+                    ValueError,
+                    match="URL must start with one of: https://app.useanvil.com",
+                ):
+                    rest_client.get(url)
+            else:
+                rest_client.get(url)
+                mock_request.assert_called_once_with(
+                    "GET",
+                    url,
+                    params=None,
+                    retry=True,
+                )
+
+        @pytest.mark.parametrize(
+            "url, should_raise",
+            [
+                ("some/relative/path", True),
+                ("https://external.example.com/full/path/file.pdf", True),
+                ("https://app.useanvil.com/api/v1/some-endpoint", False),
+            ],
+        )
+        @mock.patch("python_anvil.api_resources.requests.AnvilRequest._request")
+        def test_post_behavior(mock_request, anvil, url, should_raise):
+            mock_request.return_value = (b"fake_content", 200, {})
+            rest_client = anvil.request_fully_qualified()
+
+            if should_raise:
+                with pytest.raises(
+                    ValueError,
+                    match="URL must start with one of: https://app.useanvil.com",
+                ):
+                    rest_client.post(url, data={})
+            else:
+                rest_client.post(url, data={})
+                mock_request.assert_called_once_with(
+                    "POST",
+                    url,
+                    json={},
+                    retry=True,
+                    params=None,
+                )