Add required-args pre-flight checks for four create/update commands

Closes the 'empty-body 400' gap audited across the create/update
surface: where the user supplies zero (or trivially insufficient)
flags, the server today returns a 400 with no useful body — the
new Stage A renderer can't help. These commands now fail fast
client-side with a CliError::Arg naming the missing flags.

- endpoint create: require at least --chain or --network
- endpoint update: require --label
- endpoint security set-options: require at least one toggle
- team set-endpoints: require at least one endpoint id

webhook create's required fields are already enforced by clap.
Four integration tests assert exit code 1 and zero HTTP traffic.

Author: johnpmitsch

src/commands/endpoint/mod.rs

@@ -224,6 +224,13 @@ async fn list(a: ListArgs, ctx: Ctx) -> Result<(), CliError> {
 }
 
 async fn create(a: CreateArgs, ctx: Ctx) -> Result<(), CliError> {
+    if a.chain.is_none() && a.network.is_none() {
+        return Err(CliError::Arg(
+            "'endpoint create' requires at least one of --chain or --network. \
+             Run 'qn chain list' to see available chains."
+                .into(),
+        ));
+    }
     let req = CreateEndpointRequest {
         chain: a.chain,
         network: a.network,
@@ -243,6 +250,9 @@ async fn show(id: &str, ctx: Ctx) -> Result<(), CliError> {
 }
 
 async fn update(a: UpdateArgs, ctx: Ctx) -> Result<(), CliError> {
+    if a.label.is_none() {
+        return Err(CliError::Arg("'endpoint update' requires --label.".into()));
+    }
     let req = UpdateEndpointRequest { label: a.label };
     ctx.sdk.admin.update_endpoint(&a.id, &req).await?;
     ctx.out.note(&format!("✓ Updated endpoint {}", a.id));

src/commands/endpoint/security.rs

@@ -216,6 +216,23 @@ async fn options_show(id: &str, ctx: Ctx) -> Result<(), CliError> {
 }
 
 async fn set_options(a: SetOptionsArgs, ctx: Ctx) -> Result<(), CliError> {
+    if a.tokens.is_none()
+        && a.referrers.is_none()
+        && a.jwts.is_none()
+        && a.ips.is_none()
+        && a.domain_masks.is_none()
+        && a.hsts.is_none()
+        && a.cors.is_none()
+        && a.request_filters.is_none()
+        && a.ip_custom_header.is_none()
+    {
+        return Err(CliError::Arg(
+            "'endpoint security set-options' requires at least one of: \
+             --tokens, --referrers, --jwts, --ips, --domain-masks, --hsts, \
+             --cors, --request-filters, --ip-custom-header."
+                .into(),
+        ));
+    }
     let options = SecurityOptionsUpdate {
         tokens: a.tokens.map(|t| t.as_str().to_string()),
         referrers: a.referrers.map(|t| t.as_str().to_string()),

src/commands/team.rs

@@ -165,6 +165,11 @@ async fn endpoints(id: i64, ctx: Ctx) -> Result<(), CliError> {
 }
 
 async fn set_endpoints(a: SetEndpointsArgs, ctx: Ctx) -> Result<(), CliError> {
+    if a.endpoint_ids.is_empty() {
+        return Err(CliError::Arg(
+            "'team set-endpoints' requires at least one endpoint id.".into(),
+        ));
+    }
     let req = UpdateTeamEndpointsRequest {
         endpoint_ids: a.endpoint_ids.clone(),
     };

tests/admin_extra.rs

@@ -237,3 +237,12 @@ async fn bulk_tag_add() {
     .await;
     assert_eq!(out.exit_code, 0, "stderr={}", out.stderr);
 }
+
+#[tokio::test]
+async fn team_set_endpoints_no_ids_fails_before_api_call() {
+    let server = MockServer::start().await;
+    let out = run_qn(&server.uri(), &["team", "set-endpoints", "7"]).await;
+    assert_eq!(out.exit_code, 1, "stderr={}", out.stderr);
+    assert!(out.stderr.contains("endpoint id"), "stderr={}", out.stderr);
+    assert_eq!(server.received_requests().await.unwrap().len(), 0);
+}

tests/endpoint.rs

@@ -491,3 +491,42 @@ async fn endpoint_ratelimit_set_omits_unset_fields() {
     .await;
     assert_eq!(out.exit_code, 0, "stderr={}", out.stderr);
 }
+
+// ---- Stage B: required-args pre-flight checks ---- //
+
+#[tokio::test]
+async fn endpoint_create_no_flags_fails_before_api_call() {
+    // No mocks mounted; if the CLI tries to make a request, wiremock would 404.
+    // We assert that the pre-flight check fires *before* any HTTP call.
+    let server = MockServer::start().await;
+    let out = run_qn(&server.uri(), &["endpoint", "create"]).await;
+    assert_eq!(out.exit_code, 1, "stderr={}", out.stderr);
+    assert!(
+        out.stderr.contains("--chain") && out.stderr.contains("--network"),
+        "stderr={}",
+        out.stderr
+    );
+    assert_eq!(server.received_requests().await.unwrap().len(), 0);
+}
+
+#[tokio::test]
+async fn endpoint_update_no_flags_fails_before_api_call() {
+    let server = MockServer::start().await;
+    let out = run_qn(&server.uri(), &["endpoint", "update", "ep-1"]).await;
+    assert_eq!(out.exit_code, 1, "stderr={}", out.stderr);
+    assert!(out.stderr.contains("--label"), "stderr={}", out.stderr);
+    assert_eq!(server.received_requests().await.unwrap().len(), 0);
+}
+
+#[tokio::test]
+async fn endpoint_security_set_options_no_flags_fails_before_api_call() {
+    let server = MockServer::start().await;
+    let out = run_qn(
+        &server.uri(),
+        &["endpoint", "security", "set-options", "ep-1"],
+    )
+    .await;
+    assert_eq!(out.exit_code, 1, "stderr={}", out.stderr);
+    assert!(out.stderr.contains("--tokens"), "stderr={}", out.stderr);
+    assert_eq!(server.received_requests().await.unwrap().len(), 0);
+}