fix: guard nil spec fetch responses

Author: danielgtaylor

internal/spec/discover.go

@@ -502,6 +502,9 @@ func fetchWithLinks(ctx context.Context, rawURL string, tr http.RoundTripper, fe
 	if err != nil {
 		return "", nil, 0, displayURL, nil, fmt.Errorf("GET %s: %w", displayURL, cleanErrorForDisplay(err, rawURL, displayURL))
 	}
+	if resp == nil {
+		return "", nil, 0, displayURL, nil, fmt.Errorf("GET %s: no response", displayURL)
+	}
 	if resp.Body != nil {
 		defer resp.Body.Close()
 	}

internal/spec/discover_test.go

@@ -1029,6 +1029,24 @@ func TestDiscoverRedactsCredentialQueryInInvalidSpecURL(t *testing.T) {
 	}
 }
 
+func TestDiscoverNilFetchResponseReturnsError(t *testing.T) {
+	cfg := DiscoverConfig{
+		APIName: "nil-response",
+		BaseURL: "https://api.example.com",
+		SpecURL: "https://api.example.com/openapi.json",
+		Fetch: func(context.Context, string, http.RoundTripper) (*http.Response, error) {
+			return nil, nil
+		},
+	}
+	_, err := Discover(context.Background(), cfg, DefaultLoaders())
+	if err == nil {
+		t.Fatal("expected nil fetch response failure")
+	}
+	if got := err.Error(); !strings.Contains(got, "GET https://api.example.com/openapi.json: no response") {
+		t.Fatalf("expected no response error, got: %v", err)
+	}
+}
+
 func TestDiscoverResolvesSameOriginRemoteExternalRefs(t *testing.T) {
 	root := `openapi: "3.1.0"
 info:
@@ -1525,10 +1543,12 @@ func TestDiscoverRedactsCredentialQueryInExternalRefFailures(t *testing.T) {
 		ref     string
 		want    string
 		itemErr bool
+		itemNil bool
 		status  int
 	}{
 		{name: "status", ref: "./item.yaml?api_key=ref-secret&version=1", want: "https://specs.example.com/item.yaml?version=1", status: http.StatusInternalServerError},
 		{name: "transport", ref: "./item.yaml?api_key=ref-secret&version=1", want: "https://specs.example.com/item.yaml?version=1", itemErr: true},
+		{name: "nil response", ref: "./item.yaml?api_key=ref-secret&version=1", want: "https://specs.example.com/item.yaml?version=1", itemNil: true},
 		{name: "unsupported scheme", ref: "ftp://files.example.com/item.yaml?api_key=ref-secret&version=1", want: "ftp://files.example.com/item.yaml?version=1"},
 		{name: "malformed", ref: "./item.yaml?api_key=ref-secret%zz&version=1", want: "https://specs.example.com/item.yaml?version=1"},
 	}
@@ -1548,6 +1568,9 @@ paths:
 					if tt.itemErr {
 						return nil, fmt.Errorf("dial failed for %s", r.URL.String())
 					}
+					if tt.itemNil {
+						return nil, nil
+					}
 					return httpResponse(tt.status, "text/plain", "server error", nil), nil
 				default:
 					return httpResponse(404, "text/plain", "not found", nil), nil
@@ -1578,6 +1601,14 @@ paths:
 	}
 }
 
+func TestOpenAPIRefDisplayURLPreservesAbsoluteFragmentAndRedactsQuery(t *testing.T) {
+	got := openAPIRefDisplayURL("https://user:pass@example.com/schema.yaml?api_key=secret&version=1#/components/schemas/Foo")
+	want := "https://example.com/schema.yaml?version=1#/components/schemas/Foo"
+	if got != want {
+		t.Fatalf("display URL = %q, want %q", got, want)
+	}
+}
+
 func TestDiscover_ExternalRefDeadlineNamesRef(t *testing.T) {
 	tr := roundTripperFunc(func(r *http.Request) (*http.Response, error) {
 		switch r.URL.Path {

internal/spec/openapi.go

@@ -247,6 +247,9 @@ func openAPIRemoteURLHandler(opts LoadOptions) func(string) (*http.Response, err
 		if err != nil {
 			return nil, cleanErrorForDisplay(err, rawURL, displayURL)
 		}
+		if resp == nil {
+			return nil, fmt.Errorf("OpenAPI external ref %q: no response", displayURL)
+		}
 		if resp.Body == nil {
 			return resp, nil
 		}
@@ -744,9 +747,6 @@ func openAPIRefDisplayURL(raw string) string {
 	if err != nil {
 		return cleanPossiblyInvalidURL(raw)
 	}
-	if u.IsAbs() {
-		return cleanSourceURL(raw)
-	}
 	u.User = nil
 	u.RawQuery = cleanSourceURLQuery(u.Query()).Encode()
 	return u.String()