Feature/api mode

[fredriknordlander]

Pull Request Description

Please include a summary of the change and which issue is fixed or added.
Please also include relevant motivation and context.
List any dependencies that are required for this change.

Fixes #(issue)

Checklist

• Changes are limited to a single goal (avoid scope creep)
• I confirm that I have read any Contribution and Development guidelines (CONTRIBUTING and DEVELOPMENT) and are following their suggestions.
• I confirm that I wrote and/or have the right to submit the contents of my Pull Request, by agreeing to the Developer Certificate of Origin, (adding a 'sign-off' to my commits).

In general, the fix is to avoid using the raw user-provided URL as the request target, and instead validate and restrict it before calling fetch. Common mitigations include: parsing the URL, checking its protocol (e.g., only http:/https:), enforcing an allow‑list of hostnames or hostname patterns, and optionally blocking requests to private IP ranges or localhost. The validated URL or a derived safe form is then passed to fetch.

For this specific code, the best fix with minimal functional change is:

1. Parse dto.url with the standard URL class to ensure it is a syntactically valid URL.
2. Enforce security constraints on the parsed URL:
   • Require http: or https: scheme.
   • Enforce that url.hostname matches a strict allow‑list derived from config (e.g. config.allowedHosts), or at least a strong regex if that’s all we have.
   • Optionally, reject obviously unsafe hosts like localhost and 127.0.0.1 to avoid trivial internal access.
3. Use the parsed URL’s toString() (or href) as the argument to fetch rather than the raw input.

Because we must not change imports except to add well-known ones, and we cannot assume types on config beyond what’s visible, we can implement this entirely within src/routes/urlValidation.ts using built‑in URL and additional checks. We’ll:

• Wrap the existing regex check in slightly stronger validation:
  • Construct const parsedUrl = new URL(dto.url); inside the try block.
  • Check parsedUrl.protocol is http: or https:.
  • If config?.urlMatchRegex exists, run it against a stable representation such as parsedUrl.href to avoid misleading matches on partial strings.
  • Add a basic block on localhost/loopback to harden SSRF somewhat without needing external configuration.
• Use parsedUrl.toString() as the argument to fetch.

The concrete changes inside src/routes/urlValidation.ts:

• Around the current if (config?.urlMatchRegex && !dto.url.match(config.urlMatchRegex)) { ... }, replace it with logic that:
  • Parses dto.url into parsedUrl.
  • Validates protocol and host.
  • Uses parsedUrl.href for the regex test.
• Replace fetch(dto.url, config?.customFetchConfig); with fetch(parsedUrl.toString(), config?.customFetchConfig);.
• Use RapLPBaseApiError with ERROR_TYPE.BAD_REQUEST for invalid URLs, matching the existing error style.

No new external dependencies are required; we rely on the standard URL class.