From b309b2f3b8c9de9fb8601bbbe5701e67d2cc4719 Mon Sep 17 00:00:00 2001
From: Max Freedom Pollard
 <272618364+MaxFreedomPollard@users.noreply.github.com>
Date: Sat, 12 Sep 2026 10:52:50 -0400
Subject: [PATCH] fix(sign): Defaulted amoBaseUrl when signing from the Node
 API

The documented default for amoBaseUrl only existed as a yargs default in
the CLI option table, so it was applied on the command line and nowhere
else. Calling webExt.cmd.sign() from Node without that option passed
undefined down to signAddon(), which rejected it with "Invalid AMO API
base URL: undefined". The constant now lives in src/util/constants.js,
program.js imports and re-exports it so existing imports keep working,
and src/cmd/sign.js uses it as the parameter default. The README example
for webExt.cmd.sign() no longer passes amoBaseUrl, because it is no
longer needed there.

Fixes #3164
---
 README.md                        |  1 -
 src/cmd/sign.js                  |  3 ++-
 src/program.js                   |  3 ++-
 src/util/constants.js            |  5 +++++
 tests/unit/test-cmd/test.sign.js | 11 +++++++++++
 5 files changed, 20 insertions(+), 3 deletions(-)
 create mode 100644 src/util/constants.js

diff --git a/README.md b/README.md
index 28ea3a3d13..be9f5202cf 100644
--- a/README.md
+++ b/README.md
@@ -224,7 +224,6 @@ webExt.cmd.sign({
   userAgentString: 'YOUR-CUSTOM-USERAGENT',
   apiKey,
   apiSecret,
-  amoBaseUrl: 'https://addons.mozilla.org/api/v5/',
   sourceDir: ...,
   channel: 'unlisted',
   ...
diff --git a/src/cmd/sign.js b/src/cmd/sign.js
index 1effd157aa..10c4296a84 100644
--- a/src/cmd/sign.js
+++ b/src/cmd/sign.js
@@ -3,6 +3,7 @@ import path from 'path';
 import defaultBuilder from './build.js';
 import { isErrorWithCode, UsageError, WebExtError } from '../errors.js';
 import { prepareArtifactsDir } from '../util/artifacts.js';
+import { AMO_BASE_URL } from '../util/constants.js';
 import { createLogger } from '../util/logger.js';
 import getValidatedManifest, { getManifestId } from '../util/manifest.js';
 import {
@@ -20,7 +21,7 @@ export const uploadUuidFile = '.amo-upload-uuid';
 
 export default function sign(
   {
-    amoBaseUrl,
+    amoBaseUrl = AMO_BASE_URL,
     apiKey,
     apiProxy,
     apiSecret,
diff --git a/src/program.js b/src/program.js
index d76263a3c4..d401d51549 100644
--- a/src/program.js
+++ b/src/program.js
@@ -20,6 +20,7 @@ import {
   loadJSConfigFile as defaultLoadJSConfigFile,
   applyConfigToArgv as defaultApplyConfigToArgv,
 } from './config.js';
+import { AMO_BASE_URL } from './util/constants.js';
 
 const log = createLogger(import.meta.url);
 const envPrefix = 'WEB_EXT';
@@ -27,7 +28,7 @@ const envPrefix = 'WEB_EXT';
 // at build time by scripts/babel-plugin-inline-environment-variables.cjs).
 const defaultGlobalEnv = process.env.WEBEXT_BUILD_ENV || 'development';
 
-export const AMO_BASE_URL = 'https://addons.mozilla.org/api/v5/';
+export { AMO_BASE_URL };
 
 /*
  * The command line program.
diff --git a/src/util/constants.js b/src/util/constants.js
new file mode 100644
index 0000000000..fbcacaaa3b
--- /dev/null
+++ b/src/util/constants.js
@@ -0,0 +1,5 @@
+// Shared constants that both the command line interface and the commands
+// themselves need. Keeping them here avoids importing the CLI program (and
+// its dependencies) from a command module.
+
+export const AMO_BASE_URL = 'https://addons.mozilla.org/api/v5/';
diff --git a/tests/unit/test-cmd/test.sign.js b/tests/unit/test-cmd/test.sign.js
index 21b6d4deae..900c93693f 100644
--- a/tests/unit/test-cmd/test.sign.js
+++ b/tests/unit/test-cmd/test.sign.js
@@ -115,6 +115,17 @@ describe('sign', () => {
       },
     ));
 
+  it('defaults the AMO base URL when it is not passed in', () =>
+    withTempDir(async (tmpDir) => {
+      const stubs = getStubs();
+      const signingConfig = { ...stubs.signingConfig };
+      delete signingConfig.amoBaseUrl;
+      await sign(tmpDir, { ...stubs, signingConfig });
+      sinon.assert.calledWithMatch(stubs.signingOptions.submitAddon, {
+        amoBaseUrl: AMO_BASE_URL,
+      });
+    }));
+
   it('requires a channel for submission API', () =>
     withTempDir(async (tmpDir) => {
       const stubs = getStubs();