fix(ri-exchange): picker UI + offering-id validation + AWS 4xx mapping (closes #695)

[cristim]

Summary

Fixes three compounding defects that caused RI Exchange to return a generic 500 when a user typed an instance type ("t3.medium") instead of an AWS offering UUID in the "Target Offering ID" field.

CloudWatch log lines from the issue

2026/05/22 22:26:52 [ERROR] exchange quote failed: operation error EC2: GetReservedInstancesExchangeQuote,
    StatusCode: 400, api error InvalidOfferingId: Invalid Offering ID provided
2026/05/22 22:27:04 [ERROR] exchange quote failed: ... InvalidOfferingId: Invalid Offering ID provided
2026/05/22 22:34:59 [ERROR] exchange quote failed: ... InvalidOfferingId: Invalid Offering ID provided

---

Defect 1 -- UI: free-text "Target Offering ID" replaced with picker

Before: internal/api/handler_ri_exchange.go accepted any string in targets[].offering_id and forwarded it directly to AWS. The UI (frontend/src/riexchange.ts:355-360) rendered a <input type="text" placeholder="e.g. t3.medium"> -- actively inviting the wrong input.

After: The <input type="text"> is replaced with a <select class="modal-exchange-target-select"> backed by two sources:

• AWS-driven picker (new GET /api/ri-exchange/target-offerings?source_ri_id=<uuid>) calls ec2svc.Client.ListTargetOfferings which runs DescribeReservedInstancesOfferings with the same typed-field shape from PR fix(purchases): narrow Describe*Offerings + cap pagination (#688) #690, narrowed to convertible + same term/product-desc/scope as the source RI. Options grouped as "AWS Target Offerings".
• CE Recommendations picker sourced from the existing alternativeTargets from reshape recs (exchange_lookup.go path). Options grouped as "CE Recommendations" with per-instance monthly cost.

A hidden <input type="hidden" class="modal-exchange-target"> holds the resolved UUID and is the only field read by collectTargets() at submission time.

New endpoint: GET /api/ri-exchange/target-offerings -- internal/api/handler_ri_exchange.go:listTargetOfferings, routed in internal/api/router.go:261.

Defect 2 -- Backend validation: UUID format check before AWS call

Before (internal/api/handler_ri_exchange.go:374, 412):

if t.OfferingID == "" {
    return nil, NewClientError(400, fmt.Sprintf("targets[%d].offering_id is required", i))
}

After -- new validateTargets() helper at handler_ri_exchange.go checks each offering_id against offeringIDPattern (^[0-9a-f]{8}-...$), returning 400 with a descriptive message that names the instance type and suggests the fix. Used at both the quote handler and validateExecuteExchangeBody.

Defect 3 -- AWS 4xx mapped to client 4xx with message preserved

Before (internal/api/handler_ri_exchange.go:486-488):

logging.Errorf("exchange quote failed: %v", err)
return nil, NewClientError(500, "exchange quote failed")

After -- new mapAWSExchangeError() helper at handler_ri_exchange.go extracts smithy.APIError via errors.As and maps these client-fault codes to 400 with the original AWS message: InvalidOfferingId, InvalidParameter, ValidationError, InvalidReservedInstancesId.NotFound, InvalidInstanceID.NotFound. All other AWS errors remain 500. Applied at both the quote call site and the execute call site.

---

Test counts

Backend: 27 new test cases (handler_ri_exchange_test.go) covering:

• GET /api/ri-exchange/target-offerings: auth gate, missing source_ri_id (400), unknown source RI (404), happy path (2 offerings returned)
• UUID format validation: "t3.medium" -> 400 at quote handler; valid UUID passes; validateExecuteExchangeBody rejects instance types
• AWS error classification: 5 client-fault codes -> 400 + message preserved; unrecognised code -> 500; plain error -> 500

Frontend: 5 new test cases (riexchange.test.ts) covering:

• Picker select exists, no visible text input
• CE recommendation options appear in select synchronously
• AWS offerings appear after async load; listTargetOfferings called with source RI ID
• Picker selection drives hidden input
• Non-UUID value in hidden input is rejected before API call

Total tests now: 1938 backend passing, 1938 frontend passing (1 pre-existing skip).

---

Cross-references

Closes #695
Refs #688 #694 PR #690

[coderabbitai]

Warning

Review limit reached

@cristim, we couldn't start this review because you've used your available PR reviews for now.

Your plan includes 5 reviews of capacity. Refill in 13 minutes and 24 seconds.

Your organization has run out of usage credits. Purchase more in the billing tab.

⌛ How to resolve this issue?

After more review capacity refills, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans have higher rate limits than trial, open-source, and free plans. In all cases, review capacity refills continuously over time.

Please see our FAQ for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: abb22bf2-2eee-41e0-ae70-8287c56f70e4

📥 Commits

Reviewing files that changed from the base of the PR and between 423e87c and f47a77b.

📒 Files selected for processing (11)

• frontend/src/__tests__/riexchange.test.ts
• frontend/src/api/index.ts
• frontend/src/api/riexchange.ts
• frontend/src/api/types.ts
• frontend/src/riexchange.ts
• go.mod
• internal/api/handler.go
• internal/api/handler_ri_exchange.go
• internal/api/handler_ri_exchange_test.go
• internal/api/router.go
• providers/aws/services/ec2/client.go

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/695-ri-exchange-picker

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[cristim]

@coderabbitai review

[coderabbitai]

✅ Actions performed

Review triggered.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.