fix(webhooks): reject rewrite_to values that normalize to no host

Review follow-up. The guard rejected a structurally unsafe value but still
let three shapes through to an empty host, which then assembled to
`https://:9000/hook` -- an authority with a port and no host, exactly the
shape @target-uri canonicalization rejects, produced by the hook meant to
keep the authority well-formed.

Each reached the empty host past a different check:
- `"[]"` is non-empty until the brackets come off.
- `"."` is non-empty until the trailing root dot comes off.
- `".."` survived a single-dot strip as `"."`, because the strip used
  rstrip('.') and ate every dot rather than the one root dot
  canonicalize_host removes.

Rejection is now stated as 'no empty label', which also covers an interior
empty label (`"a..b"`).

Refs #991.

Author: KonstantinMirin

src/adcp/webhook_transport_hooks.py

@@ -127,6 +127,15 @@ def __post_init__(self) -> None:
         # Accept an already-bracketed IPv6 literal by unwrapping it first;
         # the brackets are re-applied below from the canonical form.
         inner = value[1:-1] if value.startswith("[") and value.endswith("]") else value
+        if not inner:
+            # `"[]"` survives the non-empty check above and empties here. An
+            # empty host is the one outcome this guard exists to prevent: it
+            # assembles to `https://:9000/hook`, an authority with a port and
+            # no host -- exactly the shape @target-uri canonicalization rejects.
+            raise ValueError(
+                f"DockerLocalhostRewrite(rewrite_to=...) must be a hostname or IP "
+                f"literal; got {value!r}, which has no host"
+            )
 
         # Structural rejection comes FIRST and is the actual point of this
         # guard: `rewrite_to` is interpolated straight into the netloc, so any
@@ -171,7 +180,21 @@ def __post_init__(self) -> None:
             # refusing them here would break the case this class exists for.
             # Structural safety is already established above; anything further
             # is the resolver's business, not ours.
-            object.__setattr__(self, "rewrite_to", inner.lower().rstrip("."))
+            # One trailing root dot, matching `canonicalize_host` -- `rstrip`
+            # would eat every dot, so `"."` and `".."` normalized to the empty
+            # host rather than being rejected.
+            ascii_host = inner.lower()
+            if ascii_host.endswith("."):
+                ascii_host = ascii_host[:-1]
+            if not ascii_host or any(label == "" for label in ascii_host.split(".")):
+                # Catches `"."`, `".."` and `"a..b"`. An empty label is not a
+                # host, and `".."` in particular survives a single-dot strip as
+                # `"."` -- non-empty, but still no host.
+                raise ValueError(
+                    f"DockerLocalhostRewrite(rewrite_to=...) must be a hostname or IP "
+                    f"literal; got {value!r}, which normalizes to an empty label"
+                )
+            object.__setattr__(self, "rewrite_to", ascii_host)
             return
 
         # Non-ASCII: convert to A-labels so the netloc is wire-legal. Failure

tests/conformance/signing/test_webhook_transport_hooks.py

@@ -124,6 +124,24 @@ def test_rewrite_to_hostname_and_ipv4_still_accepted() -> None:
     )
 
 
+@pytest.mark.parametrize("bad", ["[]", "[.]", ".", "..", "...", "a..b"])
+def test_rewrite_to_rejects_values_that_normalize_to_no_host(bad: str) -> None:
+    """An empty host is the outcome this guard exists to prevent.
+
+    These reach the empty host by two different routes the earlier checks each
+    miss: ``"[]"`` is non-empty until the brackets come off, and ``"."`` /
+    ``".."`` are non-empty until the trailing root dot is stripped. Both used
+    to assemble to ``https://:9000/hook`` — an authority with a port and no
+    host, which is precisely the shape ``@target-uri`` canonicalization
+    rejects, produced by the hook meant to keep the authority well-formed.
+
+    ``"a..b"`` is here because the fix is stated as "no empty label" rather
+    than "not empty", and an interior empty label is the same defect.
+    """
+    with pytest.raises(ValueError, match="rewrite_to"):
+        DockerLocalhostRewrite(rewrite_to=bad)
+
+
 @pytest.mark.parametrize(
     "name", ["my_service", "host_gateway", "docker_host.local", "_dns-sd._udp.local"]
 )