HibpProvider.cpp

Go to the documentation of this file.

/*
 * BastionGuard™
 * Copyright (C) 2025–2026 Calogero Scarnà
 *
 * This program is free software: you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
 * the Free Software Foundation, version 3.
 *
 * This program is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License
 * along with this program.  If not, see <https://www.gnu.org/licenses/>.
 *
 * BastionGuard™ is a trademark of Calogero Scarnà.
 * The BastionGuard™ name and branding are not licensed under the GPL.
 */
 
#include "HibpProvider.hpp"
 
#include "../net/HttpClient.hpp"
#include <nlohmann/json.hpp>
#include <glib/gi18n.h>
#include <map>
#include <stdexcept>
 
using json = nlohmann::json;
 
HibpProvider::HibpProvider(const std::string& key)
: apiKey(key)
{
}
 
std::vector<LeakRecord>
HibpProvider::checkEmail(const std::string& email)
{
    std::vector<LeakRecord> results;
 
    if (email.empty() || apiKey.empty())
        return results;
 
    const std::string encodedEmail =
        HttpClient::urlEncode(email);
 
    const std::string url =
        "https://haveibeenpwned.com/api/v3/breachedaccount/" +
        encodedEmail +
        "?truncateResponse=false";
 
    std::map<std::string, std::string> headers;
    headers["hibp-api-key"] = apiKey;
    headers["User-Agent"]  = "BastionGuard/IdentityLeak";
    headers["Accept"]      = "application/json";
 
    HttpResponse resp = HttpClient::get(url, headers, 20);
 
    if (resp.status == 404) {
        return results;
    }
 
    if (resp.status == 401) {
        throw std::runtime_error(_("HIBP: API key non valida (401)"));
    }
 
    if (resp.status == 429) {
        throw std::runtime_error(_("HIBP: rate limit superato (429)"));
    }
 
    if (resp.status != 200) {
        throw std::runtime_error(
            "HIBP: errore HTTP " + std::to_string(resp.status));
    }
 
 
    json root;
    try {
        root = json::parse(resp.body);
    } catch (...) {
        throw std::runtime_error(_("HIBP: JSON non valido"));
    }
 
    if (!root.is_array())
        return results;
 
    for (const auto& item : root) {
 
        LeakRecord rec;
        rec.provider    = "HIBP";
        rec.breachName  = item.value("Name", "Unknown");
        rec.breachDate  = item.value("BreachDate", "");
        rec.description = item.value("Description", "");
 
        // DataClasses
        std::vector<std::string> dataClasses;
        if (item.contains("DataClasses") &&
            item["DataClasses"].is_array())
        {
            for (const auto& dc : item["DataClasses"]) {
                dataClasses.push_back(dc.get<std::string>());
            }
        }
 
        rec.dataClasses = dataClasses;
        rec.severity    = computeSeverity(dataClasses);
 
        results.push_back(std::move(rec));
    }
 
    return results;
}
 
LeakRecord::Severity
HibpProvider::computeSeverity(
    const std::vector<std::string>& dataClasses) const
{
    bool hasPassword = false;
    bool hasEmail    = false;
    bool hasPII      = false;
 
    for (const auto& dc : dataClasses) {
        if (dc == "Passwords" || dc == "Password hints")
            hasPassword = true;
        else if (dc == "Email addresses")
            hasEmail = true;
        else
            hasPII = true;
    }
 
    if (hasPassword && hasEmail)
        return LeakRecord::Severity::CRITICAL;
 
    if (hasPassword)
        return LeakRecord::Severity::HIGH;
 
    if (hasEmail && hasPII)
        return LeakRecord::Severity::MEDIUM;
 
    if (hasEmail)
        return LeakRecord::Severity::LOW;
 
    return LeakRecord::Severity::INFO;
}