Validate and copy client header configuration safely

Co-authored-by: Shri Sukhani <shrisukhani@users.noreply.github.com>

Author: cursoragent

hyperbrowser/config.py

@@ -18,6 +18,8 @@ def __post_init__(self) -> None:
             raise HyperbrowserError("api_key must be a string")
         if not isinstance(self.base_url, str):
             raise HyperbrowserError("base_url must be a string")
+        if self.headers is not None and not isinstance(self.headers, dict):
+            raise HyperbrowserError("headers must be a dictionary of string pairs")
         self.api_key = self.api_key.strip()
         self.base_url = self.base_url.strip().rstrip("/")
         if not self.base_url:
@@ -29,6 +31,15 @@ def __post_init__(self) -> None:
             raise HyperbrowserError(
                 "base_url must start with 'https://' or 'http://'"
             )
+        if self.headers is not None:
+            normalized_headers: Dict[str, str] = {}
+            for key, value in self.headers.items():
+                if not isinstance(key, str) or not isinstance(value, str):
+                    raise HyperbrowserError(
+                        "headers must be a dictionary of string pairs"
+                    )
+                normalized_headers[key] = value
+            self.headers = normalized_headers
 
     @classmethod
     def from_env(cls) -> "ClientConfig":

tests/test_config.py

@@ -59,10 +59,27 @@ def test_client_config_rejects_non_string_values():
     with pytest.raises(HyperbrowserError, match="base_url must be a string"):
         ClientConfig(api_key="test-key", base_url=None)  # type: ignore[arg-type]
 
+    with pytest.raises(HyperbrowserError, match="headers must be a dictionary"):
+        ClientConfig(api_key="test-key", headers="x=1")  # type: ignore[arg-type]
+
 
 def test_client_config_rejects_empty_or_invalid_base_url():
     with pytest.raises(HyperbrowserError, match="base_url must not be empty"):
         ClientConfig(api_key="test-key", base_url="   ")
 
     with pytest.raises(HyperbrowserError, match="base_url must start with"):
         ClientConfig(api_key="test-key", base_url="api.hyperbrowser.ai")
+
+
+def test_client_config_normalizes_headers_to_internal_copy():
+    headers = {"X-Correlation-Id": "abc123"}
+    config = ClientConfig(api_key="test-key", headers=headers)
+
+    headers["X-Correlation-Id"] = "changed"
+
+    assert config.headers == {"X-Correlation-Id": "abc123"}
+
+
+def test_client_config_rejects_non_string_header_pairs():
+    with pytest.raises(HyperbrowserError, match="headers must be a dictionary"):
+        ClientConfig(api_key="test-key", headers={"X-Correlation-Id": 123})  # type: ignore[dict-item]