fix(http-client): default PostBuilder to not follow redirects (#1141)

fix(http-client): disable POST redirect following by default

Default PostBuilder.followRedirects to false across JDK, Vert.x, and Android
clients to prevent credential leakage on cross-origin redirects. Vert.x gains
manual RFC 7231/7538 redirect handling; adds shared abstract redirect test suite
and OkHttp-backed test client for Android semantics.

Signed-off-by: Emmanuel Hugonnet <ehugonne@redhat.com>

Author: ehsavoie

extras/http-client-android/pom.xml

@@ -37,12 +37,22 @@
             <artifactId>junit-jupiter-api</artifactId>
             <scope>test</scope>
         </dependency>
+        <dependency>
+            <groupId>org.junit.jupiter</groupId>
+            <artifactId>junit-jupiter-params</artifactId>
+            <scope>test</scope>
+        </dependency>
 
         <dependency>
             <groupId>org.mock-server</groupId>
             <artifactId>mockserver-netty</artifactId>
             <scope>test</scope>
         </dependency>
+        <dependency>
+            <groupId>com.squareup.okhttp3</groupId>
+            <artifactId>okhttp</artifactId>
+            <scope>test</scope>
+        </dependency>
     </dependencies>
     <build>
         <plugins>

extras/http-client-android/src/main/java/org/a2aproject/sdk/client/http/android/AndroidA2AHttpClient.java

@@ -269,7 +269,7 @@ public CompletableFuture<Void> getAsyncSSE(
   private static class AndroidPostBuilder extends AndroidBuilder<PostBuilder>
       implements PostBuilder {
     private String body = "";
-    private boolean followRedirects = true;
+    private boolean followRedirects = false;
 
     @Override
     public PostBuilder body(String body) {

extras/http-client-android/src/test/java/org/a2aproject/sdk/client/http/android/AndroidA2AHttpClientRedirectTest.java

@@ -0,0 +1,34 @@
+package org.a2aproject.sdk.client.http.android;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.mockserver.model.HttpRequest.request;
+import static org.mockserver.verify.VerificationTimes.exactly;
+
+import org.a2aproject.sdk.client.http.A2AHttpClient;
+import org.a2aproject.sdk.client.http.A2AHttpResponse;
+import org.a2aproject.sdk.client.http.AbstractA2AHttpClientRedirectTest;
+import org.junit.jupiter.api.Test;
+
+public class AndroidA2AHttpClientRedirectTest extends AbstractA2AHttpClientRedirectTest {
+
+    @Override
+    protected A2AHttpClient createClient() {
+        return new AndroidA2AHttpClient();
+    }
+
+    @Test
+    public void synchronousPostFollowsRedirectWhenExplicitlyEnabled() throws Exception {
+        startRedirectPair();
+
+        A2AHttpResponse result = createClient().createPost()
+                .url("http://127.0.0.1:" + getRedirector().getLocalPort() + "/agent")
+                .addHeader("X-API-Key", "FULCRUM-SYNTHETIC-EXPLICIT")
+                .body("{}")
+                .followRedirects(true)
+                .post();
+
+        assertEquals(200, result.status(),
+                "Android client must follow redirect when explicitly enabled");
+        getCollector().verify(request().withPath("/collect"), exactly(1));
+    }
+}

extras/http-client-android/src/test/java/org/a2aproject/sdk/client/http/android/AndroidA2AHttpClientTest.java

@@ -1,61 +1,12 @@
 package org.a2aproject.sdk.client.http.android;
 
-import static org.junit.jupiter.api.Assertions.assertNotNull;
-import static org.junit.jupiter.api.Assertions.assertSame;
-
 import org.a2aproject.sdk.client.http.A2AHttpClient;
-import org.junit.jupiter.api.Test;
-
-public class AndroidA2AHttpClientTest {
-
-    @Test
-    public void testNoArgsConstructor() {
-        AndroidA2AHttpClient client = new AndroidA2AHttpClient();
-        assertNotNull(client);
-    }
+import org.a2aproject.sdk.client.http.AbstractA2AHttpClientBasicTest;
 
-    @Test
-    public void testCreateGet() {
-        AndroidA2AHttpClient client = new AndroidA2AHttpClient();
-        A2AHttpClient.GetBuilder builder = client.createGet();
-        assertNotNull(builder);
-    }
-
-    @Test
-    public void testCreatePost() {
-        AndroidA2AHttpClient client = new AndroidA2AHttpClient();
-        A2AHttpClient.PostBuilder builder = client.createPost();
-        assertNotNull(builder);
-    }
-
-    @Test
-    public void testCreateDelete() {
-        AndroidA2AHttpClient client = new AndroidA2AHttpClient();
-        A2AHttpClient.DeleteBuilder builder = client.createDelete();
-        assertNotNull(builder);
-    }
-
-    @Test
-    public void testBuilderUrlSetting() {
-        AndroidA2AHttpClient client = new AndroidA2AHttpClient();
-        A2AHttpClient.GetBuilder builder = client.createGet();
-        A2AHttpClient.GetBuilder result = builder.url("https://example.com");
-        assertSame(builder, result, "Builder should return itself for method chaining");
-    }
-
-    @Test
-    public void testBuilderHeaderSetting() {
-        AndroidA2AHttpClient client = new AndroidA2AHttpClient();
-        A2AHttpClient.GetBuilder builder = client.createGet();
-        A2AHttpClient.GetBuilder result = builder.addHeader("Accept", "application/json");
-        assertSame(builder, result, "Builder should return itself for method chaining");
-    }
+public class AndroidA2AHttpClientTest extends AbstractA2AHttpClientBasicTest {
 
-    @Test
-    public void testPostBuilderBody() {
-        AndroidA2AHttpClient client = new AndroidA2AHttpClient();
-        A2AHttpClient.PostBuilder builder = client.createPost();
-        A2AHttpClient.PostBuilder result = builder.body("{\"key\":\"value\"}");
-        assertSame(builder, result, "Builder should return itself for method chaining");
+    @Override
+    protected A2AHttpClient createClient() {
+        return new AndroidA2AHttpClient();
     }
 }