mirror of
https://github.com/netbirdio/netbird.git
synced 2026-08-24 16:41:30 +02:00
The SSRF guard resolves the host before any request is built, so a name that does not resolve fails there rather than at the transport, and that error reached the caller unclassified — an operator with a typo in the hostname was told the provider could not be checked rather than that the url could not be reached. It is the commonest way for an upstream to be wrong. The live suite is what caught it: the unit tests construct the transport errors directly and so never went through the guard. The management fixture moves to a private upstream in the same change. It wants a provider row to hang a policy off, not a working vendor, and it was pointing a dummy key at the real api.openai.com — which the credential check now correctly refuses. A private address is left unchecked whether or not the run has vendor keys, and covers that path while it is there.