fix: validate repository URL paths

Author: hiSandog

packages/billing/src/__tests__/org-billing.test.ts

@@ -190,6 +190,15 @@ describe('Organization Billing', () => {
       expect(result.error).toBeUndefined()
     })
 
+    it('should validate and normalize SSH URLs', () => {
+      const result = validateAndNormalizeRepositoryUrl(
+        'git@github.com:user/repo.git',
+      )
+      expect(result.isValid).toBe(true)
+      expect(result.normalizedUrl).toBe('https://github.com/user/repo')
+      expect(result.error).toBeUndefined()
+    })
+
     it('should reject invalid domains', () => {
       const result = validateAndNormalizeRepositoryUrl(
         'https://example.com/user/repo',
@@ -204,6 +213,12 @@ describe('Organization Billing', () => {
       expect(result.error).toBe('Repository domain not allowed')
     })
 
+    it('should reject URLs without owner and repo path segments', () => {
+      const result = validateAndNormalizeRepositoryUrl('https://github.com')
+      expect(result.isValid).toBe(false)
+      expect(result.error).toBe('Repository path must include owner and repo')
+    })
+
     it('should accept allowed domains', () => {
       const domains = ['github.com', 'gitlab.com', 'bitbucket.org']
 

packages/billing/src/org-billing.ts

@@ -498,17 +498,25 @@ export function validateAndNormalizeRepositoryUrl(url: string): {
   error?: string
 } {
   try {
-    // Basic URL validation
-    const urlObj = new URL(url.startsWith('http') ? url : `https://${url}`)
+    const normalized = normalizeRepositoryUrl(url)
+    const urlObj = new URL(normalized)
 
     // Whitelist allowed domains
     const allowedDomains = ['github.com', 'gitlab.com', 'bitbucket.org']
     if (!allowedDomains.includes(urlObj.hostname)) {
       return { isValid: false, error: 'Repository domain not allowed' }
     }
 
-    // Normalize URL format
-    const normalized = normalizeRepositoryUrl(url)
+    const pathSegments = urlObj.pathname
+      .split('/')
+      .filter((segment) => segment.length > 0)
+
+    if (pathSegments.length < 2) {
+      return {
+        isValid: false,
+        error: 'Repository path must include owner and repo',
+      }
+    }
 
     return { isValid: true, normalizedUrl: normalized }
   } catch (error) {