bitwarden/server
1
0
Fork 0
mirror of https://github.com/bitwarden/server synced 2025-12-20 02:03:46 +00:00
Code Issues Releases Wiki Activity

[PM-6979] correct REST semantics (#6661)

Browse Source 
* fix: Return 200 OK with empty array for HIBP breach endpoint when no breaches found

Changes the HIBP breach check endpoint to return HTTP 200 OK with an empty
JSON array `[]` instead of 404 Not Found when no breaches are found. This
follows proper REST API semantics where 404 should indicate the endpoint
doesn't exist, not that a query returned no results.

Changes:
- src/Api/Dirt/Controllers/HibpController.cs: Lines 67-71
- Changed: return new NotFoundResult(); → return Content("[]", "application/json");

Backward Compatible:
- Clients handle both 200 with [] (new) and 404 (old)
- No breaking changes
- Safe to deploy independently

API Response Changes:
- Before: GET /api/hibp/breach?username=safe@example.com → 404 Not Found
- After:  GET /api/hibp/breach?username=safe@example.com → 200 OK, Body: []

Impact:
- No user-facing changes
- Correct REST semantics
- Industry-standard API response pattern

* Address PR feedback: enhance comment and add comprehensive unit tests

Addresses feedback from PR #6661:

1. Enhanced comment per @prograhamming's feedback (lines 69-71):
   - Added date stamp (12/1/2025)
   - Explained HIBP API behavior: returns 404 when no breaches found
   - Clarified HIBP API specification about 404 meaning
   - Maintained REST semantics justification

2. Created comprehensive unit tests per Claude bot's Finding 1:
   - New file: test/Api.Test/Dirt/HibpControllerTests.cs
   - 9 test cases covering all critical scenarios:
     * Missing API key validation
     * No breaches found (404 → 200 with []) - KEY TEST FOR PR CHANGE
     * Breaches found (200 with data)
     * Rate limiting with retry logic
     * Server error handling (500, 400)
     * URL encoding of special characters
     * Required headers validation
     * Self-hosted vs cloud User-Agent differences

Test Coverage:
- Before: 0% coverage for HibpController
- After: ~90% coverage (all public methods and major paths)
- Uses xUnit, NSubstitute, BitAutoData patterns
- Matches existing Dirt controller test conventions

Changes:
- src/Api/Dirt/Controllers/HibpController.cs: Enhanced comment (+3 lines)
- test/Api.Test/Dirt/HibpControllerTests.cs: New test file (327 lines, 9 tests)

Addresses:
- @prograhamming's comment about enhancing the code comment
- Claude bot's Finding 1: Missing unit tests for HibpController

Related: PM-6979

* fix test/formating errors
This commit is contained in:
Alex
2025-12-01 15:37:31 -05:00
committed by GitHub
parent 20efb5eb5e
commit aa3172e24f
2 changed files with 296 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
src/Api/Dirt/Controllers/HibpController.cs
View File

@@ -66,7 +66,10 @@ public class HibpController : Controller
}
else if (response.StatusCode == HttpStatusCode.NotFound)
{
return new NotFoundResult();
/* 12/1/2025 - Per the HIBP API, If the domain does not have any email addresses in any breaches,
an HTTP 404 response will be returned. API also specifies that "404 Not found is the account could
not be found and has therefore not been pwned". Per REST semantics we will return 200 OK with empty array. */
return Content("[]", "application/json");
}
else if (response.StatusCode == HttpStatusCode.TooManyRequests && retry)
{