fix(sublime): apply default base URL and use server-side time filter

[maximelb]

Summary

The Sublime Security audit-log adapter had two bugs that made it unusable in production. Both were reproduced from a user report and verified against Sublime's official API docs.

1. unsupported protocol scheme "" when no base URL is set

The North America default base URL (https://platform.sublime.security) was only applied in SublimeConfig.Validate(), but the general adapter runner constructs the adapter directly and never calls Validate(). The constructor already backfilled the poll interval for exactly this reason — it just forgot the base URL. So an unset base_url produced a schemeless request URL and every poll failed.

Fix: backfill defaultBaseURL in the constructor next to the poll-interval default.

2. context deadline exceeded on high-volume tenants

Every poll re-paginated the entire audit log from offset=0 (offset 0, 500, 1000, … — hundreds of pages), pulling every page and discarding old events client-side. On a tenant with a large backlog, a single request eventually exceeded the 30s HTTP timeout. The adapter never used the API's time filter.

Fix: send the documented created_at[gte] filter (inclusive, ISO 8601 UTC) so each poll only fetches the recent window. The overlap is still re-fetched and the dedupe map suppresses re-shipping, so shipping semantics are unchanged — the fetched set just shrinks from the whole history to the recent window.

Minor

• Return an explicit error on a non-200 response (previously it returned the nil error from the preceding successful Do() call).
• Cap pagination depth per poll as a backstop against a misbehaving API.

Tests

• Mock API now honours created_at[gte].
• New regression TestBaseURLDefaultBackfilled: constructing with an empty base URL yields the default.
• New regression TestMockHighVolumeUsesTimeFilter: a 100k-event pre-start backlog must not be walked by offset — the adapter stays at offset=0 and sends the time filter.
• Updated TestMakeOneRequestNon200 to expect the explicit error.

All ./sublime/ tests pass; go vet and the containers/general build are clean.

🤖 Generated with Claude Code

https://claude.ai/code/session_01NThfoB4tBLPk7SqABt7GPR