fix: clear error when the PKCE redirect URI has no host:port (FLYTE-SDK-7A) (#1422)

## What

[FLYTE-SDK-7A](https://unionai.sentry.io/issues/?query=FLYTE-SDK-7A) —
`_create_callback_server` parsed the redirect URI and handed the result
straight to `asyncio.start_server`:

```python
server_url = _urlparse.urlparse(typing.cast(str, self._redirect_uri))
server_address = (server_url.hostname, server_url.port)
server = await asyncio.start_server(handler.handle, server_address[0], server_address[1])
```

When the URI is missing, empty, or has no host and port, both components
come back as `None` and asyncio raises:

```
ValueError: Neither host/port nor sock were specified
```

`urlparse` is easy to trip here — `urlparse("localhost:8080/callback")`
reads `localhost` as the *scheme*, so a redirect URI that merely forgot
`http://` also yields `(None, None)`.

The reported event is a good illustration of how badly this reads: a
`flyte run` upload got a non-protobuf response from the endpoint, the
auth interceptor treated it as retriable and kicked off a browser login,
and the login died on this `ValueError` — so the crash the user saw
named neither the redirect URI nor the fact that any of it was
configuration.

## Fix

The redirect URI comes from the deployment's public client config, so an
endpoint that isn't serving the auth metadata service leaves it empty.
Validate before binding and raise
`InitializationError("InvalidRedirectURI", "user")` naming the offending
value.

This mirrors #1235, which gave the sibling case — that same config fetch
returning HTML — exactly this treatment. Being a `user`-kind error it is
also filtered out of Sentry by the existing `_is_user_error` check.

Note this only ever *replaces* a broken outcome: with no port,
`start_server` binds a random one while the browser is redirected to
port 80, so the flow hung forever waiting for a callback that could
never arrive.

## Testing

New `tests/flyte/remote/test_pkce_callback_server.py`, 7 tests. The 5
validation cases (missing / empty / no-scheme / no-port / path-only)
fail on `main` with the original `ValueError`, verified by stashing the
source change. The 2 happy-path tests assert the parsed host and port
are what actually get bound, and that a non-loopback redirect URI is
still accepted — we validate presence, not policy.

fixes FLYTE-SDK-7A

Signed-off-by: Haytham Abuelfutuh <haytham@afutuh.com>

Author: EngHabu

src/flyte/remote/_client/auth/_authenticators/pkce.py

@@ -237,11 +237,30 @@ def __repr__(self):
         )
 
     async def _create_callback_server(self):
-        server_url = _urlparse.urlparse(typing.cast(str, self._redirect_uri))
-        server_address = (server_url.hostname, server_url.port)
+        server_url = _urlparse.urlparse(typing.cast(str, self._redirect_uri) or "")
+        host, port = server_url.hostname, server_url.port
+        if not host or not port:
+            # The redirect URI comes from the deployment's public client config (or local
+            # config). If it is missing or has no host:port -- which is what an endpoint
+            # serving something other than the auth metadata service leaves behind -- then
+            # asyncio.start_server(None, None) raises a bare
+            # "ValueError: Neither host/port nor sock were specified", which reads like an
+            # SDK bug rather than the configuration problem it is.
+            from flyte.errors import InitializationError
+
+            raise InitializationError(
+                "InvalidRedirectURI",
+                "user",
+                "Cannot start the local OAuth2 callback server: the redirect URI "
+                f"{self._redirect_uri!r} is missing a host and port. Browser-based (PKCE) login needs a "
+                "loopback redirect URI such as 'http://localhost:8080/callback'. Check the "
+                "'redirect_uri' your deployment advertises in its public client config, or set one "
+                "explicitly in your Flyte config, and verify the endpoint points at your Flyte/Union "
+                "API endpoint rather than a web console or login page.",
+            )
         queue = Queue()
         handler = OAuthCallbackHandler(queue, self._remote, server_url.path)
-        server = await asyncio.start_server(handler.handle, server_address[0], server_address[1])
+        server = await asyncio.start_server(handler.handle, host, port)
         return server, queue, handler
 
     async def _request_authorization_code(self):

tests/flyte/remote/test_pkce_callback_server.py

@@ -0,0 +1,80 @@
+"""
+Tests for the local OAuth2 callback server used by the PKCE (browser) login flow.
+
+The redirect URI is supplied by the deployment's public client config. When it is
+missing or has no host:port, `asyncio.start_server(None, None)` used to raise a bare
+`ValueError: Neither host/port nor sock were specified`, which reads like an SDK bug
+rather than the configuration problem it is.
+"""
+
+from unittest.mock import AsyncMock, MagicMock, patch
+
+import pytest
+
+from flyte.errors import InitializationError
+from flyte.remote._client.auth._authenticators.pkce import AuthorizationClient
+
+
+def _client(redirect_uri) -> AuthorizationClient:
+    return AuthorizationClient(
+        endpoint="dns:///example.com",
+        auth_endpoint="https://example.com/oauth2/authorize",
+        token_endpoint="https://example.com/oauth2/token",
+        http_session=MagicMock(),
+        client_id="flytectl",
+        redirect_uri=redirect_uri,
+    )
+
+
+class TestCallbackServerRedirectUriValidation:
+    @pytest.mark.parametrize(
+        "redirect_uri",
+        [
+            pytest.param(None, id="missing"),
+            pytest.param("", id="empty"),
+            pytest.param("localhost:8080/callback", id="no-scheme"),  # urlparse reads "localhost" as the scheme
+            pytest.param("http://localhost/callback", id="no-port"),
+            pytest.param("/callback", id="path-only"),
+        ],
+    )
+    @pytest.mark.asyncio
+    async def test_unusable_redirect_uri_raises_initialization_error(self, redirect_uri):
+        client = _client(redirect_uri)
+
+        with patch("asyncio.start_server", new_callable=AsyncMock) as mock_start_server:
+            with pytest.raises(InitializationError) as exc_info:
+                await client._create_callback_server()
+
+        # We fail before touching the event loop, so no half-bound server is left behind.
+        mock_start_server.assert_not_called()
+
+        err = exc_info.value
+        assert err.code == "InvalidRedirectURI"
+        assert err.kind == "user"
+        # The offending value is named so the user knows what to fix.
+        assert repr(redirect_uri) in str(err)
+
+    @pytest.mark.asyncio
+    async def test_valid_redirect_uri_binds_that_host_and_port(self):
+        client = _client("http://localhost:8080/callback")
+
+        with patch("asyncio.start_server", new_callable=AsyncMock) as mock_start_server:
+            server, _queue, handler = await client._create_callback_server()
+
+        assert server is mock_start_server.return_value
+        _handle, host, port = mock_start_server.call_args.args
+        assert (host, port) == ("localhost", 8080)
+        # The callback handler matches incoming requests on the redirect URI's path.
+        assert handler.redirect_path == "/callback"
+        mock_start_server.assert_awaited_once()
+
+    @pytest.mark.asyncio
+    async def test_non_loopback_redirect_uri_is_still_accepted(self):
+        """Only host/port presence is validated -- we do not second-guess the deployment."""
+        client = _client("https://127.0.0.1:53593/oauth2/callback")
+
+        with patch("asyncio.start_server", new_callable=AsyncMock) as mock_start_server:
+            await client._create_callback_server()
+
+        _handle, host, port = mock_start_server.call_args.args
+        assert (host, port) == ("127.0.0.1", 53593)