From 2598c89abf3d4ff13d8faf17e8db5b905e705505 Mon Sep 17 00:00:00 2001
From: amoussa1229 <166072409+amoussa1229@users.noreply.github.com>
Date: Fri, 24 Jul 2026 22:35:17 +0000
Subject: [PATCH] fix(api): use .endswith('.amazonaws.com') instead of
 substring check for execute-api detection

The prior '.execute-api.' in domain substring check is fragile and
triggers CodeQL incomplete-sanitization warnings. All API Gateway default
domains end with .amazonaws.com, so a suffix check is more precise and
also silences the false-positive alert.

Refs: https://github.com/Sea-Haven-Industries/procurement-ingest/security/code-scanning/6
---
 lambdas/api/handler.py | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/lambdas/api/handler.py b/lambdas/api/handler.py
index 56b4ca0..a467f62 100644
--- a/lambdas/api/handler.py
+++ b/lambdas/api/handler.py
@@ -87,8 +87,9 @@ def _base_url(event: dict) -> str | None:
     # A custom domain (base-path mapping) serves the stage at the root, so the
     # public URL has NO /{stage} segment; only the raw execute-api host carries
     # it. Emitting /{stage} for a custom-domain request would advertise a
-    # broken server URL in the docs.
-    if ".execute-api." in domain:
+    # broken server URL in the docs. All API Gateway default domains end with
+    # .amazonaws.com, so check the suffix rather than a substring.
+    if domain.endswith(".amazonaws.com"):
         return f"https://{domain}/{stage}" if stage else None
     return f"https://{domain}"