[security] fix(providers): reject sibling HTTP endpoint overrides - #1256

Summary

This PR hardens sibling provider API endpoint overrides for credentialed usage calls.

• Rejects explicit non-HTTPS endpoint overrides for OpenRouter, Codebuff, Groq, and ElevenLabs.
• Preserves the existing convenience behavior where bare host/path override values are normalized to HTTPS.
• Adds provider-level validation before credentialed usage fetches construct requests.
• Adds regression coverage for HTTPS acceptance, bare-host normalization, and explicit HTTP rejection.

Security issues covered

Before this PR

• OPENROUTER_API_URL, CODEBUFF_API_URL, GROQ_API_URL, and ELEVENLABS_API_URL could be set to explicit http://... URLs.
• The corresponding usage fetchers built credentialed requests using the configured base URL.
• The sibling provider paths did not have regression coverage matching the endpoint hardening already added for Alibaba/MiniMax.

After this PR

• Explicit non-HTTPS endpoint overrides are rejected during provider settings validation.
• Usage fetchers call the validation path before constructing credentialed requests.
• Bare host/path overrides still infer HTTPS for compatibility.
• A shared regression test locks the behavior for OpenRouter, Codebuff, Groq, and ElevenLabs.

Why this matters

These API URL settings are provider-owned credentialed endpoints. Once a token/API key is present, allowing an explicit HTTP override creates an unnecessary downgrade path for authenticated traffic. Rejecting non-HTTPS overrides keeps the secure default while preserving a safe HTTPS override mechanism for trusted local testing or alternate provider-compatible endpoints.

How this differs from related issue/PR

This is a sibling-provider follow-up to #1236. That PR covers Alibaba and MiniMax endpoint overrides. This PR applies the same boundary to OpenRouter, Codebuff, Groq, and ElevenLabs, whose settings readers and usage fetchers are separate code paths.

Attack flow

local configuration/environment sets provider API URL to http://...
    -> provider settings reader accepts the override
        -> usage fetcher builds a credentialed request from that base URL
            -> bearer/API-key authenticated provider traffic can be sent over plaintext HTTP

Root cause

• API URL override readers normalized or accepted caller-controlled base URLs without rejecting explicit non-HTTPS schemes.
• Credentialed usage fetchers trusted those base URLs before sending provider authentication headers.
• Endpoint override validation was inconsistent across providers.

Changes in this PR

• Adds explicit endpoint override validation to OpenRouter and Codebuff settings errors/descriptors.
• Adds validateEndpointOverrides(environment:) guards to OpenRouter, Codebuff, Groq, and ElevenLabs credentialed usage fetchers.
• Keeps HTTPS inference for bare host/path override values.
• Adds ProviderEndpointOverrideSecurityTests covering accepted HTTPS, bare-host normalization, rejected HTTP fallback, and thrown validation errors.

Maintainer impact

• Narrow provider settings/fetcher hardening only.
• No real provider calls or production credentials are required by the new tests.
• Existing HTTPS endpoint overrides and bare-host override values remain supported.
• Explicit plaintext HTTP endpoint overrides are now rejected for credentialed provider-owned API calls.

Type of change

• Security fix
• Tests
• Documentation update
• Refactor with no behavior change

Test plan

• swift build --target CodexBarCore
• Focused standalone Swift smoke for OpenRouter/Codebuff/Groq/ElevenLabs endpoint override behavior with fake test values, including host:port bare overrides
• swiftformat lint mode via make check reported 0/998 files require formatting
• Direct SwiftLint on the touched files with the local CommandLineTools SourceKit path reported 0 violations
• swift test --filter ProviderEndpointOverrideSecurityTests — blocked locally by existing KeyboardShortcuts #Preview macro/plugin build failure before these tests run:
  • external macro implementation type 'PreviewsMacros.SwiftUIView' could not be found for macro 'Preview(_:body:)'
• Full make check — blocked locally after SwiftFormat passes because the wrapper SwiftLint invocation traps while loading SourceKit:
  • Fatal error: Loading sourcekitdInProc.framework/Versions/A/sourcekitdInProc failed

Executed with redacted/fake endpoint values only; no provider services or real credentials were used.

$ swift build --target CodexBarCore
Build of target: 'CodexBarCore' complete! (5.46s)

$ swiftc /tmp/codexbar_endpoint_override_smoke.swift \
  Sources/CodexBarCore/Providers/OpenRouter/OpenRouterSettingsReader.swift \
  Sources/CodexBarCore/Providers/Codebuff/CodebuffSettingsReader.swift \
  Sources/CodexBarCore/Providers/Groq/GroqSettingsReader.swift \
  Sources/CodexBarCore/Providers/ElevenLabs/ElevenLabsSettingsReader.swift \
  -o /tmp/codexbar_endpoint_override_smoke
$ /tmp/codexbar_endpoint_override_smoke
endpoint override smoke passed: host:port bare overrides normalize to HTTPS; explicit HTTP rejects

$ python3 - <<'PY'
from pathlib import Path
files = [
    'Sources/CodexBarCore/Providers/OpenRouter/OpenRouterSettingsReader.swift',
    'Sources/CodexBarCore/Providers/Codebuff/CodebuffSettingsReader.swift',
    'Sources/CodexBarCore/Providers/Groq/GroqSettingsReader.swift',
    'Sources/CodexBarCore/Providers/ElevenLabs/ElevenLabsSettingsReader.swift',
    'Tests/CodexBarTests/ProviderEndpointOverrideSecurityTests.swift',
]
for f in files:
    for i, line in enumerate(Path(f).read_text().splitlines(), 1):
        if len(line) > 120:
            raise SystemExit(f'{f}:{i}: line length {len(line)}')
print('line length <= 120 for endpoint override files')
PY
line length <= 120 for endpoint override files

$ DYLD_FRAMEWORK_PATH=/Library/Developer/CommandLineTools/usr/lib \
  .build/lint-tools/bin/swiftlint --strict --config .swiftlint.yml \
  Tests/CodexBarTests/ProviderEndpointOverrideSecurityTests.swift \
  Sources/CodexBarCore/Providers/OpenRouter/OpenRouterSettingsReader.swift \
  Sources/CodexBarCore/Providers/Codebuff/CodebuffSettingsReader.swift \
  Sources/CodexBarCore/Providers/Groq/GroqSettingsReader.swift \
  Sources/CodexBarCore/Providers/ElevenLabs/ElevenLabsSettingsReader.swift
Done linting! Found 0 violations, 0 serious in 5 files.

$ swift test --filter ProviderEndpointOverrideSecurityTests
/private/tmp/codexbar-main-security-audit/.build/checkouts/KeyboardShortcuts/Sources/KeyboardShortcuts/Recorder.swift:172:1: error: external macro implementation type 'PreviewsMacros.SwiftUIView' could not be found for macro 'Preview(_:body:)'; plugin for module 'PreviewsMacros' not found

$ make check
SwiftFormat completed in 0.16s.
0/998 files require formatting.
SourceKittenFramework/library_wrapper.swift:58: Fatal error: Loading sourcekitdInProc.framework/Versions/A/sourcekitdInProc failed

The smoke script asserts:

• localhost:8080 and localhost:8080/v1 are treated as bare host/path overrides and normalize to HTTPS.
• http://attacker.test... remains rejected by the validation path for OpenRouter, Codebuff, Groq, and ElevenLabs.

Disclosure notes

• No real credentials were used or included.
• This PR does not claim unauthenticated remote exploitability; the issue is a local/provider endpoint configuration downgrade boundary for credentialed requests.
• Duplicate check found the related open [security] fix(providers): reject insecure credentialed endpoint overrides #1236 for Alibaba/MiniMax and historical Alibaba-only hardening (fix: Reject non-HTTPS Alibaba Token Plan overrides #1104), but no existing OpenRouter/Codebuff/Groq/ElevenLabs endpoint override hardening PR or advisory.