Patched code sample

import requests
from urllib.parse import urljoin, urlparse

def get_first_member_details(base_url, auth, collection_path):
    """
    Fetches details for the first member of a Redfish collection.
    The base_url is operator-supplied (e.g., https://bmc.example.com).
    """
    collection_endpoint = urljoin(base_url, collection_path)
    
    # Get the list of members in the collection
    collection_resp = requests.get(collection_endpoint, auth=auth, verify=False)
    collection_resp.raise_for_status()
    members = collection_resp.json().get('Members', [])
    
    if not members:
        return None

    # Get the @odata.id link, which is supplied by the remote service (BMC)
    member_link = members[0].get('@odata.id')
    if not member_link:
        return None

    # FIX: Ensure the '@odata.id' link is a relative path, not an absolute URL.
    parsed_link = urlparse(member_link)
    if parsed_link.scheme or parsed_link.netloc:
        raise ValueError(f"Disallowed absolute URL in @odata.id: {member_link}")
    
    details_url = urljoin(base_url, member_link)

    # This request is now guaranteed to target the original base_url host
    details_resp = requests.get(details_url, auth=auth, verify=False)
    details_resp.raise_for_status()
    
    return details_resp.json()