From a6d8749d4b97cde6d435d68b6ee5e904ce6baf48 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Sat, 25 Jul 2026 19:08:25 +0000
Subject: [PATCH 1/2] Initial plan


From d6d3f4f2ecbd3c283bab580c52f8e2e571a4bf61 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Sat, 25 Jul 2026 19:15:23 +0000
Subject: [PATCH 2/2] Fix reporting endpoint URL validation to unblock CI tests

---
 .../NetSecureHeadersOptionsValidator.cs       |  6 +++++-
 .../NetSecureHeadersOptionsValidationTests.cs | 20 +++++++++++++++++++
 2 files changed, 25 insertions(+), 1 deletion(-)

diff --git a/src/SafeWebCore/Infrastructure/NetSecureHeadersOptionsValidator.cs b/src/SafeWebCore/Infrastructure/NetSecureHeadersOptionsValidator.cs
index 7342f6d..999046f 100644
--- a/src/SafeWebCore/Infrastructure/NetSecureHeadersOptionsValidator.cs
+++ b/src/SafeWebCore/Infrastructure/NetSecureHeadersOptionsValidator.cs
@@ -112,7 +112,11 @@ private static void ValidateReportingEndpoints(NetSecureHeadersOptions options,
             {
                 failures.Add($"{scope}: Reporting endpoint '{endpoint.Group}' URL must not be null, empty, or whitespace. Fix: provide an absolute HTTPS URL such as 'https://reports.example.com/csp'.");
             }
-            else if (!Uri.TryCreate(endpoint.Url, UriKind.Absolute, out _))
+            else if (!Uri.TryCreate(endpoint.Url, UriKind.Absolute, out var uri))
+            {
+                failures.Add($"{scope}: Reporting endpoint '{endpoint.Group}' URL must be absolute. Fix: use a full URL such as 'https://reports.example.com/csp'.");
+            }
+            else if (uri.Scheme != Uri.UriSchemeHttp && uri.Scheme != Uri.UriSchemeHttps)
             {
                 failures.Add($"{scope}: Reporting endpoint '{endpoint.Group}' URL must be absolute. Fix: use a full URL such as 'https://reports.example.com/csp'.");
             }
diff --git a/tests/SafeWebCore.Tests/NetSecureHeadersOptionsValidationTests.cs b/tests/SafeWebCore.Tests/NetSecureHeadersOptionsValidationTests.cs
index c2901b0..9496b5f 100644
--- a/tests/SafeWebCore.Tests/NetSecureHeadersOptionsValidationTests.cs
+++ b/tests/SafeWebCore.Tests/NetSecureHeadersOptionsValidationTests.cs
@@ -103,6 +103,26 @@ public void StartWithRelativeReportingEndpointUrlThrowsOptionsValidationExceptio
         Assert.Contains("Fix: use a full URL such as 'https://reports.example.com/csp'", exception.Message);
     }
 
+    [Fact]
+    public void NonHttpSchemeReportingEndpointUrlThrowsOptionsValidationException()
+    {
+        // Arrange
+        var hostBuilder = CreateHostBuilder(opts =>
+        {
+            opts.ReportingEndpoints.Add(new()
+            {
+                Group = "default",
+                Url = "file:///reports"
+            });
+        });
+
+        // Act
+        var exception = Assert.Throws<OptionsValidationException>(() => hostBuilder.Start());
+
+        // Assert
+        Assert.Contains("Reporting endpoint 'default' URL must be absolute", exception.Message);
+    }
+
     [Fact]
     public void StartWithNelEnabledButEmptyNelValueThrowsOptionsValidationException()
     {