fix(storage/http): return 400 for unparseable ids instead of 500

Malformed percent-encoding in ids no longer throws an uncaught
URIError (falls back to the raw id, matching the URL parser) and
unparseable ids throw a 400 IPX_INVALID_URL instead of leaking a
TypeError as a 500.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: pi0

src/storage/http.ts

@@ -36,6 +36,15 @@ export type HTTPStorageOptions = {
 
 const HTTP_RE = /^https?:\/\//;
 
+function decode(input: string) {
+  try {
+    return decodeURIComponent(input);
+  } catch {
+    // Keep malformed percent-encoding as-is (e.g. `100%.jpg`)
+    return input;
+  }
+}
+
 /**
  * Creates an HTTP storage handler for IPX that fetches image data from external URLs.
  * This handler allows configuration to specify allowed domains, caching behaviour and custom fetch options.
@@ -70,7 +79,18 @@ export function ipxHttpStorage(_options: HTTPStorageOptions = {}): IPXStorage {
   );
 
   function validateId(id: string) {
-    const url = new URL(decodeURIComponent(id));
+    let url: URL;
+    try {
+      // Ids are usually already decoded by the URL parser but the storage API
+      // can also be used directly with still encoded ids.
+      url = new URL(decode(id));
+    } catch {
+      throw new HTTPError({
+        statusCode: 400,
+        statusText: `IPX_INVALID_URL`,
+        message: `Invalid URL: ${id}`,
+      });
+    }
     if (!url.hostname) {
       throw new HTTPError({
         statusCode: 403,

test/storage/http.test.ts

@@ -1,8 +1,12 @@
-import { describe, expect, it } from "vitest";
+import { afterEach, describe, expect, it, vi } from "vitest";
 
 import { ipxHttpStorage } from "../../src/storage/http.ts";
 
 describe("http", () => {
+  afterEach(() => {
+    vi.unstubAllGlobals();
+  });
+
   describe("getMeta", () => {
     const storage = ipxHttpStorage({});
     const sut = storage.getMeta;
@@ -17,4 +21,77 @@ describe("http", () => {
       );
     });
   });
+
+  describe("validateId", () => {
+    const storage = ipxHttpStorage({ domains: ["example.com"] });
+
+    it("unparseable id throws a 400 HTTPError", async () => {
+      await expect(storage.getData("not-a-url")).rejects.toMatchObject({
+        statusCode: 400,
+        statusText: "IPX_INVALID_URL",
+        message: expect.stringContaining("not-a-url"),
+      });
+    });
+
+    it("missing hostname throws a 403 HTTPError", async () => {
+      await expect(storage.getData("file://")).rejects.toMatchObject({
+        statusCode: 403,
+        statusText: "IPX_MISSING_HOSTNAME",
+      });
+    });
+
+    it("forbidden host throws a 403 HTTPError", async () => {
+      await expect(
+        storage.getData("https://not-example.com/image.png"),
+      ).rejects.toMatchObject({
+        statusCode: 403,
+        statusText: "IPX_FORBIDDEN_HOST",
+      });
+    });
+
+    it("malformed percent-encoding is not a URIError (forbidden host)", async () => {
+      await expect(
+        storage.getData("https://not-example.com/100%.jpg"),
+      ).rejects.toMatchObject({
+        statusCode: 403,
+        statusText: "IPX_FORBIDDEN_HOST",
+      });
+    });
+
+    it("malformed percent-encoding is fetched as-is for allowed hosts", async () => {
+      const fetch = vi
+        .fn()
+        .mockResolvedValue(new Response(new Uint8Array([1, 2, 3])));
+      vi.stubGlobal("fetch", fetch);
+
+      await expect(
+        storage.getData("https://example.com/100%.jpg"),
+      ).resolves.toBeInstanceOf(ArrayBuffer);
+
+      expect(fetch).toHaveBeenCalledWith(
+        "https://example.com/100%.jpg",
+        expect.anything(),
+      );
+    });
+
+    it("encoded ids are decoded (direct storage usage)", async () => {
+      const fetch = vi
+        .fn()
+        .mockResolvedValue(new Response(new Uint8Array([1, 2, 3])));
+      vi.stubGlobal("fetch", fetch);
+
+      await storage.getData("https%3A%2F%2Fexample.com%2Fimage.png");
+      expect(fetch).toHaveBeenCalledWith(
+        "https://example.com/image.png",
+        expect.anything(),
+      );
+    });
+
+    it("getMeta propagates HTTPError for invalid ids", async () => {
+      await expect(storage.getMeta("not-a-url")).rejects.toMatchObject({
+        statusCode: 400,
+        statusText: "IPX_INVALID_URL",
+      });
+    });
+  });
 });