Fix CI and reject Mapping inputs to _format_api_dates

Two issues:

1. CI failure on `test_get_args_basic` / `test_get_args_with_exclude`.
   The pre-existing tests used `monitoring_location_id="123"` purely as a
   placeholder to exercise `_get_args`'s filter/exclude logic. After the
   previous commit centralized the AGENCY-ID format check into `_get_args`,
   the bare "123" now raises ValueError before the dict-shaping assertions
   are reached. Update the placeholder to a well-formed "USGS-123" so the
   test's actual intent — filter + exclude wiring — still runs.

2. Copilot review: `_format_api_dates` silently accepts a Mapping by
   materializing its keys (`time={"2024-01-01": "x"}` → `["2024-01-01"]`),
   the same footgun `_normalize_str_iterable` already rejects elsewhere.
   Raise TypeError before the `list(...)` call. Adds a unit test.

Author: thodson-usgs

dataretrieval/waterdata/utils.py

@@ -241,6 +241,12 @@ def _format_api_dates(
     # Convert single string to list for uniform processing
     if isinstance(datetime_input, str):
         datetime_input = [datetime_input]
+    elif isinstance(datetime_input, Mapping):
+        # `list(mapping)` returns keys, which silently accepts the wrong shape.
+        raise TypeError(
+            f"date input must be a string or sequence of strings, "
+            f"not {type(datetime_input).__name__}."
+        )
     elif not isinstance(datetime_input, (list, tuple)):
         # Materialize any other iterable (pandas.Series, numpy.ndarray,
         # generator, ...) so the len()/subscript operations below work.

tests/waterdata_utils_test.py

@@ -15,26 +15,26 @@
 
 def test_get_args_basic():
     local_vars = {
-        "monitoring_location_id": "123",
+        "monitoring_location_id": "USGS-123",
         "service": "daily",
         "output_id": "daily_id",
         "none_val": None,
         "other": "val",
     }
     result = _get_args(local_vars)
-    assert result == {"monitoring_location_id": "123", "other": "val"}
+    assert result == {"monitoring_location_id": "USGS-123", "other": "val"}
 
 
 def test_get_args_with_exclude():
     local_vars = {
-        "monitoring_location_id": "123",
+        "monitoring_location_id": "USGS-123",
         "service": "daily",
         "output_id": "daily_id",
         "to_exclude": "secret",
         "other": "val",
     }
     result = _get_args(local_vars, exclude={"to_exclude"})
-    assert result == {"monitoring_location_id": "123", "other": "val"}
+    assert result == {"monitoring_location_id": "USGS-123", "other": "val"}
 
 
 def test_get_args_empty():
@@ -224,6 +224,16 @@ def test_format_api_dates_open_ended_range_with_none():
     assert _format_api_dates([None, "2024-01-01"], date=True) == "../2024-01-01"
 
 
+def test_format_api_dates_rejects_mapping():
+    """`time={"2024-01-01": "x"}` would silently materialize as the keys list,
+    accepting input the user clearly didn't intend.
+    """
+    import pytest
+
+    with pytest.raises(TypeError, match="date input must be a string or sequence"):
+        _format_api_dates({"2024-01-01": "ignored"})
+
+
 def _make_response(status, body, reason=None, content_type="text/html"):
     resp = requests.Response()
     resp.status_code = status