fix: Add server-side validation for device POST api

[ShradhaGupta31]

• Add explicit server-side checks in the insert handler that return 400 Bad Request when hostname, username, or password is absent
• With this change POST /api/v1/devices will not accept requests with empty hostname, username, and password

** POST /api/v1/devices Behaviour before changes:-**

$ curl -sk -X POST https://localhost:8181/api/v1/devices   -H "Authorization: Bearer $TOKEN"   -H "Content-Type: application/json"   -d '{
    "hostname": "device",
    "friendlyName": "device",
    "username": "device",
    "password": "",
    "tenantId": "",
    "useTLS": false,
    "allowSelfSigned": false,
    "guid": "",
    "tags": []
  }' | jq .
{
  "connectionStatus": false,
  "mpsInstance": "",
  "hostname": "device",
  "guid": "2f7b265d-a940-40eb-b3f3-c26625d62f2a",
  "mpsusername": "",
  "tags": [],
  "tenantId": "",
  "friendlyName": "device",
  "dnsSuffix": "",
  "username": "device",
  "password": "",
  "mpspassword": "",
  "mebxpassword": "",
  "useTLS": false,
  "allowSelfSigned": false,
  "certHash": ""
}

** POST /api/v1/devices Behaviour after changes:**

$ curl -sk -X POST https://localhost:8181/api/v1/devices \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "hostname": "",
    "friendlyName": "",
    "username": "",
    "password": "",
    "tenantId": "",
    "useTLS": false,
    "allowSelfSigned": false,
    "guid": "",
    "tags": []
  }' | jq .
{
  "error": "Invalid input: hostname is required",
  "message": "Invalid input: hostname is required"
}

$ curl -sk -X POST https://localhost:8181/api/v1/devices   -H "Authorization: Bearer $TOKEN"   -H "Content-Type: application/json"   -d '{
    "hostname": "random-hostname",
    "friendlyName": "",
    "username": "",
    "password": "",
    "tenantId": "",
    "useTLS": false,
    "allowSelfSigned": false,
    "guid": "",
    "tags": []
  }' | jq .
{
  "error": "Invalid input: username is required",
  "message": "Invalid input: username is required"
}

$ curl -sk -X POST https://localhost:8181/api/v1/devices   -H "Authorization: Bearer $TOKEN"   -H "Content-Type: application/json"   -d '{
    "hostname": "random-hostname",
    "friendlyName": "",
    "username": "random-username",
    "password": "",
    "tenantId": "",
    "useTLS": false,
    "allowSelfSigned": false,
    "guid": "",
    "tags": []
  }' | jq .
{
  "error": "Invalid input: password is required",
  "message": "Invalid input: password is required"
}

[Copilot]

Pull request overview

Adds explicit server-side input validation to the v1 devices insert route so POST /api/v1/devices rejects requests missing required connection fields, and updates tests to cover the new 400 Bad Request behavior.

Changes:

• Added hostname/username/password presence checks in the v1 devices insert handler, returning 400 on invalid input.
• Added new route tests for the invalid-input insert cases and updated an existing insert test payload to include the now-required fields.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

File	Description
internal/controller/httpapi/v1/devices.go	Adds server-side required-field validation for device insert and introduces sentinel errors used to produce consistent 400 responses.
internal/controller/httpapi/v1/devices_test.go	Adds coverage for insert requests with missing required fields; updates a full-device insert test to include required username/password.

Suppressed comments (2)

internal/controller/httpapi/v1/devices.go:218

• Validation only checks for an empty string. A request with whitespace-only password (e.g., " ") will bypass this check and still be accepted. If the intent is to require a non-blank password, consider checking strings.TrimSpace(password) instead (without mutating the password value).

	if device.Password == "" {

internal/controller/httpapi/v1/devices.go:212

• Validation only checks for an empty string. A request with whitespace-only username (e.g., " ") will bypass this check and still be accepted. Using strings.TrimSpace for the emptiness check closes that gap.

	if device.Username == "" {

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 49.79%. Comparing base (0ea1e2a) to head (45c04db).

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #1182      +/-   ##
==========================================
+ Coverage   49.72%   49.79%   +0.06%     
==========================================
  Files         146      146              
  Lines       13455    13464       +9     
==========================================
+ Hits         6691     6704      +13     
+ Misses       6184     6177       -7     
- Partials      580      583       +3     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[madhavilosetty-intel]

@ShradhaGupta31 According to me, this is a breaking change to /api/v1. Previously, a device could be created without providing a hostname, username, or password. With this change, those fields have become mandatory, and requests that previously succeeded now return a 400 Bad Request when any of them are omitted.

Since existing clients can no longer use the same requests that worked before, wouldn't this be considered a backward-incompatible change?

Even if a device creation with empty values is allowed, I don't see a security risk. A device without a hostname, username, or password can not be accessed, AMT operations will fail. Am I missing anything specific ?