fix(sources): probe the health-check path under the base URL, not relative to it (#255)

HttpHealthProbe.CombineUrl resolved the configured health-check path as a
relative URI. That replaces the base's last path segment whenever the base has no
trailing slash (https://api.example.com/v1/orders + "ping" ->
https://api.example.com/v1/ping) and discards the base path entirely when the
path starts with "/" (-> /ping at the host root). The HTTP and OData health
checks therefore probed a URL the author never configured: a reachable source can
be reported unhealthy, or an unreachable one healthy if the wrong URL answers.

The documented contract is "relative to the source's base URL", i.e. appended
under it. Concatenate instead — the same move the Elasticsearch (D64), HubSpot,
Airtable and Salesforce packages each made after hitting this independently, each
with a comment naming it. This shared helper was the last place still resolving
relatively, and the two remaining callers of it are the HTTP and OData health
checks.

An absolute http(s) health-check path is still honoured as given, and a query on
the configured path stays a query rather than being escaped into the path.

Covered by HttpHealthProbeUrlTests; 4 of its 8 cases fail against the old
implementation.

Author: thiagoluga

CHANGELOG.md

@@ -58,6 +58,13 @@ The `NeoReports.Abstractions` contract follows SemVer strictly.
   the host — D20 — this is a nudge, not a behaviour change).
 
 ### Fixed
+- **A configured health-check path is now probed under the source's base URL.** `HttpHealthProbe`
+  resolved it as a relative URI, which replaces the base's last path segment when the base has no
+  trailing slash (`.../v1/orders` + `ping` → `.../v1/ping`) and discards the base path entirely for a
+  leading `/`. The HTTP and OData health checks therefore probed a URL the author never configured —
+  reporting a reachable source unhealthy, or an unreachable one healthy when the wrong URL answered.
+  It now concatenates, matching what the Elasticsearch, HubSpot, Airtable and Salesforce packages
+  already did. An absolute `http(s)` health-check path is still used as given.
 - **Run-time parameters now work on every job backend.** The run request types its parameter values
   as `object?`, so `System.Text.Json` handed each one to the pipeline as a `JsonElement` — which no
   ADO provider can bind (*"No mapping exists from object type System.Text.Json.JsonElement"*). Every

docs/STATUS-AND-BACKLOG.md

@@ -221,7 +221,10 @@ rather than decided:
   `new Uri(nextUrl)` (absolute-only) on a server-supplied link; RFC 8288 and OData both permit a
   relative one. Fails loudly (`UriFormatException`, opaque message) rather than silently. Salesforce
   is the only package that resolves this correctly.
-- **`HttpHealthProbe.CombineUrl` still has the relative-`Uri` bug — the 5th sighting of this class.**
+- ~~**`HttpHealthProbe.CombineUrl` still has the relative-`Uri` bug — the 5th sighting of this class.**~~
+  **FIXED** — the shared helper now concatenates under the base path (absolute `http(s)` paths still
+  used as given), matching the four leaf packages; covered by `HttpHealthProbeUrlTests`, verified to
+  fail against the old implementation. Original description:
   `new Uri(baseUri, path)` drops the base's last path segment when it has no trailing slash, and a
   leading `/` resets to the host root. Elasticsearch (D64), HubSpot, Airtable and Salesforce each
   independently rewrote away from it — with comments naming it — but the shared helper still does it,

src/Sources/NeoReports.Sources.Http.Common/HttpHealthProbe.cs

@@ -38,14 +38,46 @@ public static async Task<HttpResponseMessage> SendAsync(HttpClient client, HttpM
         return await client.SendAsync(request, HttpCompletionOption.ResponseHeadersRead, cancellationToken).ConfigureAwait(false);
     }
 
-    /// <summary>Resolves the URL to probe: <paramref name="healthCheckPath"/> relative to <paramref name="baseUrl"/>, or <paramref name="baseUrl"/> itself when unset.</summary>
+    /// <summary>
+    /// Resolves the URL to probe: <paramref name="healthCheckPath"/> appended <b>under</b>
+    /// <paramref name="baseUrl"/>, or <paramref name="baseUrl"/> itself when unset. An absolute
+    /// http(s) <paramref name="healthCheckPath"/> is used as given.
+    /// </summary>
+    /// <remarks>
+    /// Deliberately concatenates instead of using <c>new Uri(baseUri, relative)</c>: relative-URI
+    /// resolution replaces the base's last path segment whenever the base has no trailing slash
+    /// (<c>.../v1/orders</c> + <c>ping</c> → <c>.../v1/ping</c>), and a leading <c>/</c> on the
+    /// relative part discards the base path entirely (→ <c>/ping</c> at the host root). Either way the
+    /// probe hits a URL the author never configured, so a reachable source can report unhealthy — or
+    /// an unreachable one report healthy if the wrong URL happens to answer. The Elasticsearch (D64),
+    /// HubSpot, Airtable and Salesforce packages each hit this and moved to concatenation; this shared
+    /// helper is the last place that resolved relatively.
+    /// </remarks>
     public static string CombineUrl(string baseUrl, string? healthCheckPath)
     {
         if (healthCheckPath is null)
             return baseUrl;
 
         var baseUri = new Uri(baseUrl, UriKind.Absolute);
-        return new Uri(baseUri, healthCheckPath).ToString();
+
+        // An absolute probe URL is a deliberate override, not something to append.
+        if (Uri.TryCreate(healthCheckPath, UriKind.Absolute, out Uri? absolute)
+            && (absolute.Scheme == Uri.UriSchemeHttp || absolute.Scheme == Uri.UriSchemeHttps))
+        {
+            return absolute.ToString();
+        }
+
+        // A query on the configured path belongs in the query component, not escaped into the path.
+        var split = healthCheckPath.IndexOf('?', StringComparison.Ordinal);
+        string relativePath = split < 0 ? healthCheckPath : healthCheckPath[..split];
+        string relativeQuery = split < 0 ? string.Empty : healthCheckPath[(split + 1)..];
+
+        var builder = new UriBuilder(baseUri)
+        {
+            Path = baseUri.AbsolutePath.TrimEnd('/') + "/" + relativePath.TrimStart('/'),
+            Query = relativeQuery,
+        };
+        return builder.Uri.ToString();
     }
 
     /// <summary>

tests/NeoReports.Sources.Http.UnitTests/HttpHealthProbeUrlTests.cs

@@ -0,0 +1,43 @@
+using NeoReports.Sources.Http.Common;
+using Shouldly;
+using Xunit;
+
+namespace NeoReports.Sources.Http.UnitTests;
+
+/// <summary>
+/// The health-check path is documented as being probed <b>relative to the source's base URL</b>, so it
+/// must land under the whole base path. Relative-<c>Uri</c> resolution does not do that — it replaces
+/// the base's last segment, and drops the base path entirely for a leading <c>/</c> — the bug the
+/// Elasticsearch (D64), HubSpot, Airtable and Salesforce packages each hit separately.
+/// </summary>
+public class HttpHealthProbeUrlTests
+{
+    [Theory]
+    // Base with a path and no trailing slash: the last segment must survive.
+    [InlineData("https://api.example.com/v1/orders", "ping", "https://api.example.com/v1/orders/ping")]
+    // A leading slash on the configured path must not reset to the host root.
+    [InlineData("https://api.example.com/v1/orders", "/ping", "https://api.example.com/v1/orders/ping")]
+    // Trailing slash on the base is equivalent.
+    [InlineData("https://api.example.com/v1/orders/", "ping", "https://api.example.com/v1/orders/ping")]
+    // Base at the host root still works.
+    [InlineData("https://api.example.com", "ping", "https://api.example.com/ping")]
+    // Multi-segment probe paths.
+    [InlineData("https://api.example.com/v1", "health/live", "https://api.example.com/v1/health/live")]
+    public void Health_path_is_appended_under_the_whole_base_path(string baseUrl, string path, string expected) =>
+        HttpHealthProbe.CombineUrl(baseUrl, path).ShouldBe(expected);
+
+    [Fact]
+    public void No_path_probes_the_base_url_itself() =>
+        HttpHealthProbe.CombineUrl("https://api.example.com/v1/orders", null)
+            .ShouldBe("https://api.example.com/v1/orders");
+
+    [Fact]
+    public void A_query_on_the_configured_path_stays_a_query() =>
+        HttpHealthProbe.CombineUrl("https://api.example.com/v1", "health?deep=1")
+            .ShouldBe("https://api.example.com/v1/health?deep=1");
+
+    [Fact]
+    public void An_absolute_probe_url_is_used_as_given() =>
+        HttpHealthProbe.CombineUrl("https://api.example.com/v1", "https://status.example.com/health")
+            .ShouldBe("https://status.example.com/health");
+}