fix: make backend URL validation lazy so generateSbom works without it

ExhortApi constructor no longer validates TRUSTIFY_DA_BACKEND_URL eagerly.
The endpoint is resolved lazily on first use (when an HTTP call is about
to be made). This allows generateSbom() and the CLI 'sbom' command to
operate without a backend URL configured, since they only perform local
SBOM generation.

Implements TC-3991

Assisted-by: Claude Code

Author: soul2zimate

src/main/java/io/github/guacsec/trustifyda/impl/ExhortApi.java

@@ -83,10 +83,10 @@ public final class ExhortApi implements Api {
   public static final String S_API_V5_LICENSES_IDENTIFY = "%s/api/v5/licenses/identify";
   private static final String TRUSTIFY_DA_LICENSE_CHECK = "TRUSTIFY_DA_LICENSE_CHECK";
 
-  private final String endpoint;
+  private String endpoint;
 
   public String getEndpoint() {
-    return endpoint;
+    return getOrResolveEndpoint();
   }
 
   private final HttpClient client;
@@ -117,7 +117,6 @@ static HttpClient.Version getHttpVersion() {
     commonHookBeginning(true);
     this.client = client;
     this.mapper = new ObjectMapper().disable(DeserializationFeature.FAIL_ON_UNKNOWN_PROPERTIES);
-    this.endpoint = getExhortUrl();
   }
 
   public static HttpClient createHttpClient() {
@@ -163,6 +162,13 @@ private static String getClientRequestId() {
     return RequestManager.getInstance().getTraceIdOfRequest();
   }
 
+  private String getOrResolveEndpoint() {
+    if (this.endpoint == null) {
+      this.endpoint = getExhortUrl();
+    }
+    return this.endpoint;
+  }
+
   private String getExhortUrl() {
     String endpoint = Environment.get(TRUSTIFY_DA_BACKEND_URL);
     if (endpoint == null || endpoint.trim().isEmpty()) {
@@ -346,7 +352,7 @@ public CompletableFuture<AnalysisReport> componentAnalysis(
     String exClientTraceId = commonHookBeginning(false);
     var manifestPath = Path.of(manifest);
     var provider = Ecosystem.getProvider(manifestPath);
-    var uri = URI.create(String.format(S_API_V_5_ANALYSIS, this.endpoint));
+    var uri = URI.create(String.format(S_API_V_5_ANALYSIS, getOrResolveEndpoint()));
     var content = provider.provideComponent();
     commonHookAfterProviderCreatedSbomAndBeforeExhort();
     return getAnalysisReportForComponent(uri, content, exClientTraceId);
@@ -390,7 +396,7 @@ public CompletableFuture<AnalysisReport> componentAnalysis(String manifestFile)
     String exClientTraceId = commonHookBeginning(false);
     var manifestPath = Path.of(manifestFile);
     var provider = Ecosystem.getProvider(manifestPath);
-    var uri = URI.create(String.format(S_API_V_5_ANALYSIS, this.endpoint));
+    var uri = URI.create(String.format(S_API_V_5_ANALYSIS, getOrResolveEndpoint()));
     var content = provider.provideComponent();
     commonHookAfterProviderCreatedSbomAndBeforeExhort();
     return getAnalysisReportForComponent(uri, content, exClientTraceId);
@@ -431,7 +437,7 @@ private HttpRequest buildStackRequest(final String manifestFile, final MediaType
       throws IOException {
     var manifestPath = Path.of(manifestFile);
     var provider = Ecosystem.getProvider(manifestPath);
-    var uri = URI.create(String.format(S_API_V_5_ANALYSIS, this.endpoint));
+    var uri = URI.create(String.format(S_API_V_5_ANALYSIS, getOrResolveEndpoint()));
     var content = provider.provideStack();
     commonHookAfterProviderCreatedSbomAndBeforeExhort();
 
@@ -518,7 +524,7 @@ <H, T> CompletableFuture<T> performBatchAnalysis(
       final String analysisName)
       throws IOException {
     String exClientTraceId = commonHookBeginning(false);
-    var uri = URI.create(String.format(S_API_V_5_BATCH_ANALYSIS, this.endpoint));
+    var uri = URI.create(String.format(S_API_V_5_BATCH_ANALYSIS, getOrResolveEndpoint()));
     var sboms = sbomsGenerator.get();
     var content =
         new Provider.Content(
@@ -580,7 +586,7 @@ public CompletableFuture<ComponentAnalysisResult> componentAnalysisWithLicense(
     String exClientTraceId = commonHookBeginning(false);
     var manifestPath = Path.of(manifestFile);
     var provider = Ecosystem.getProvider(manifestPath);
-    var uri = URI.create(String.format(S_API_V_5_ANALYSIS, this.endpoint));
+    var uri = URI.create(String.format(S_API_V_5_ANALYSIS, getOrResolveEndpoint()));
     var content = provider.provideComponent();
     String sbomJson = new String(content.buffer);
     commonHookAfterProviderCreatedSbomAndBeforeExhort();
@@ -611,7 +617,7 @@ public CompletableFuture<ComponentAnalysisResult> componentAnalysisWithLicense(
    */
   public CompletableFuture<JsonNode> getLicenseDetails(String spdxId) {
     String encodedId = URLEncoder.encode(spdxId, StandardCharsets.UTF_8).replace("+", "%20");
-    URI uri = URI.create(String.format(S_API_V5_LICENSES, this.endpoint, encodedId));
+    URI uri = URI.create(String.format(S_API_V5_LICENSES, getOrResolveEndpoint(), encodedId));
     HttpRequest request = buildGetRequest(uri, "License Details");
 
     return this.client
@@ -657,7 +663,7 @@ public CompletableFuture<String> identifyLicense(Path licenseFilePath) {
       LOG.warning(String.format("Failed to read license file: %s", e.getMessage()));
       return CompletableFuture.completedFuture(null);
     }
-    URI uri = URI.create(String.format(S_API_V5_LICENSES_IDENTIFY, this.endpoint));
+    URI uri = URI.create(String.format(S_API_V5_LICENSES_IDENTIFY, getOrResolveEndpoint()));
     HttpRequest request =
         buildPostRequest(
             uri,

src/test/java/io/github/guacsec/trustifyda/impl/Exhort_Api_Test.java

@@ -413,9 +413,11 @@ void componentAnalysis_with_pom_xml_as_path_should_return_json_object_from_the_b
   @Test
   @ClearSystemProperty(key = "TRUSTIFY_DA_BACKEND_URL")
   void check_TRUSTIFY_DA_Url_Throws_Exception_When_Not_Set() {
+    // Backend URL validation is lazy — construction succeeds, but accessing the endpoint throws
+    ExhortApi api = new ExhortApi();
     IllegalStateException exception =
         org.junit.jupiter.api.Assertions.assertThrows(
-            IllegalStateException.class, () -> new ExhortApi());
+            IllegalStateException.class, api::getEndpoint);
     then(exception.getMessage())
         .isEqualTo(
             "Backend URL not configured. Please set the TRUSTIFY_DA_BACKEND_URL environment"