Quill: student work resolver untested for malformed URL input — add error case tests

[adhamhaithameid]

🪶 Quill — Extension Unit Tests

Agent: Quill | Day: Saturday | Date: 2025-12-14

---

🪶 Gap Found

The resolveStudentWorkUrl function in extension/src/student_work/resolver.ts checks for empty strings, malformed URLs (unparseable), and non-HTTPS protocols. However, these error branches were entirely missing from the unit test suite (extension/tests/student-work-resolver.test.ts).

🎯 Why It Matters

URL parsing and validation is critical for the resolver. Without these tests, a refactor might accidentally remove the scheme check or the malformed URL catch block, allowing bad inputs (like javascript: URLs) to proceed further down the resolution chain where they might cause errors or be passed to iframe resolution. These tests document and enforce the expected security and error-handling behavior for URL inputs.

✅ Tests Added

• rejects empty URL input: verifies that "" returns { ok: false, reason: 'empty_url' }.
• rejects malformed URL input: verifies that an unparseable URL returns { ok: false, reason: 'malformed_url' }.
• rejects URLs with non-HTTPS scheme: verifies that http: protocols return { ok: false, reason: 'invalid_scheme' }.
• rejects javascript: URLs: verifies that javascript: protocols return { ok: false, reason: 'invalid_scheme' }.

🔬 How to Verify

cd extension
pnpm run test tests/student-work-resolver.test.ts

Expected output: All 22 tests in the file pass.

📋 Notes

The URL constructor's behavior in JSDOM means that standard string inputs (e.g., 'not a url at all') are often treated as valid relative paths appended to localhost:3000. To properly test the try/catch block for malformed URLs, an input explicitly rejected by the WHATWG URL parser (like 'http://:::') is required. This has been logged for future reference.

---

PR created automatically by Jules for task 3229568906331491748 started by @adhamhaithameid

[google-labs-jules]

👋 Jules, reporting for duty! I'm here to lend a hand with this pull request.

When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down.

I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job!

For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with @jules. You can find this option in the Pull Request section of your global Jules UI settings. You can always switch back!

New to Jules? Learn more at jules.google/docs.

---

For security, I will only act on instructions from the user who triggered this task.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!