Validate redirects with security registry

[zhelezkov]

Summary

• add secureFetch helper that validates redirect targets with BlinksRegistry
• restore original fetchBlink logic in useBlink
• mock fetch in tests instead of spinning up HTTP servers

Testing

• bun test

---

https://chatgpt.com/codex/tasks/task_e_684200a9b074832094a98d66894bade1

[Copilot]

Pull Request Overview

This PR adds a security validation layer for redirects by implementing a secureFetch helper that checks redirect targets against a security registry and integrates it with the BlinkInstance API. Key changes include:

• Introducing secureFetch in packages/blinks-core/src/utils/secure-fetch.ts.
• Adding tests in packages/blinks-core/test/api/secure-fetch.spec.ts that validate trusted and malicious redirect scenarios.
• Updating the API usage in packages/blinks-core/src/api/BlinkInstance/BlinkInstance.ts to utilize secureFetch.

Reviewed Changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 1 comment.

File	Description
packages/blinks-core/test/api/secure-fetch.spec.ts	New tests added to validate secureFetch for both trusted and malicious redirects.
packages/blinks-core/src/utils/secure-fetch.ts	Implements secureFetch with redirects validation using BlinksRegistry.
packages/blinks-core/src/utils/index.ts	Exports secureFetch.
packages/blinks-core/src/api/BlinkInstance/BlinkInstance.ts	Replaces standard fetch with secureFetch to restore original fetchBlink logic.

[Copilot]

Consider enhancing the error message by including the number of redirects attempted and the final URL, which would aid in debugging redirect loops.

Suggested change

	throw new Error('Too many redirects');
	throw new Error(`Too many redirects: attempted ${redirectCount} redirects, final URL was ${currentUrl}`);