Bug: bundler adapters accept host-less catalog URLs (https://:8080), unlike catalogs.py

[Quratulain-bilal]

summary

_validate_remote_url in src/specify_cli/bundler/services/adapters.py accepts host-less catalog URLs like https://:8080 and https://user@. its docstring says it "mirrors specify_cli.catalogs URL validation", but that site was fixed to use hostname in #3210/#3227 while this bundler twin still checks netloc.

root cause

if not parsed.netloc:
    raise BundlerError(f"Catalog '{source_id}' URL must be a valid URL with a host: {url}")

urlparse("https://:8080") gives netloc=":8080" (truthy) but hostname=None. so the guard passes even though there is no host. same for https://user@, https://user:pw@.

reproduction

from specify_cli.bundler.services.adapters import _validate_remote_url
_validate_remote_url("team", "https://:8080")     # accepted; should reject
_validate_remote_url("team", "https://user@")     # accepted; should reject

impact

this is a pre-flight validation that runs before any network fetch. a host-less URL slips past the "must be a valid URL with a host" guarantee the error message promises, deferring the failure to a less clear point (or a malformed request). the sibling specify_cli.catalogs validator already rejects these since #3210; the bundler path should match.

proposed fix

check parsed.hostname (None for host-less URLs) instead of parsed.netloc, mirroring the catalogs.py fix.

happy to open a PR (have one ready with regression tests).

note: i used an ai assistant to help investigate and write this up.