probo/pkg/agent/tools/security/hibp.go

// Copyright (c) 2026 Probo Inc <hello@getprobo.com>.
//
// Permission to use, copy, modify, and/or distribute this software for any
// purpose with or without fee is hereby granted, provided that the above
// copyright notice and this permission notice appear in all copies.
//
// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
// PERFORMANCE OF THIS SOFTWARE.

package security

import (
	"context"
	"encoding/json"
	"fmt"
	"io"
	"net/http"
	"net/url"
	"time"

	"go.probo.inc/probo/pkg/agent"
)

type (
	hibpParams struct {
		Domain string `json:"domain" jsonschema:"The domain to check for known data breaches (e.g. example.com)"`
	}

	breach struct {
		Name         string   `json:"Name"`
		BreachDate   string   `json:"BreachDate"`
		PwnCount     int      `json:"PwnCount"`
		DataClasses  []string `json:"DataClasses"`
		Description  string   `json:"Description"`
		IsVerified   bool     `json:"IsVerified"`
		IsSensitive  bool     `json:"IsSensitive"`
		IsRetired    bool     `json:"IsRetired"`
		IsSpamList   bool     `json:"IsSpamList"`
		IsMalware    bool     `json:"IsMalware"`
		IsSubscFree  bool     `json:"IsSubscriptionFree"`
		IsFabricated bool     `json:"IsFabricated"`
	}

	hibpResult struct {
		Found       bool     `json:"found"`
		Count       int      `json:"count"`
		Breaches    []breach `json:"breaches,omitempty"`
		ErrorDetail string   `json:"error_detail,omitempty"`
	}
)

func CheckBreachesTool() agent.Tool {
	return agent.FunctionTool(
		"check_breaches",
		"Check if a domain has been involved in known data breaches using the Have I Been Pwned API.",
		func(ctx context.Context, p hibpParams) (agent.ToolResult, error) {
			client := &http.Client{Timeout: 10 * time.Second}

			hibpURL, err := url.Parse("https://haveibeenpwned.com/api/v3/breaches")
			if err != nil {
				return agent.ResultJSON(
					hibpResult{
						ErrorDetail: fmt.Sprintf("cannot parse HIBP URL: %s", err),
					},
				), nil
			}

			q := hibpURL.Query()
			q.Set("domain", p.Domain)
			hibpURL.RawQuery = q.Encode()

			req, err := http.NewRequestWithContext(ctx, http.MethodGet, hibpURL.String(), nil)
			if err != nil {
				return agent.ResultJSON(
					hibpResult{
						ErrorDetail: fmt.Sprintf("cannot create request: %s", err),
					},
				), nil
			}

			req.Header.Set("User-Agent", "Probo-Vendor-Assessment")

			resp, err := client.Do(req)
			if err != nil {
				return agent.ResultJSON(
					hibpResult{
						ErrorDetail: fmt.Sprintf("cannot fetch breaches: %s", err),
					},
				), nil
			}

			defer func() { _ = resp.Body.Close() }()

			body, err := io.ReadAll(resp.Body)
			if err != nil {
				return agent.ResultJSON(
					hibpResult{
						ErrorDetail: fmt.Sprintf("cannot read response: %s", err),
					},
				), nil
			}

			if resp.StatusCode == http.StatusNotFound {
				return agent.ResultJSON(hibpResult{Found: false, Count: 0}), nil
			}

			if resp.StatusCode != http.StatusOK {
				return agent.ResultJSON(
					hibpResult{
						ErrorDetail: fmt.Sprintf("HIBP API returned status %d", resp.StatusCode),
					},
				), nil
			}

			var breaches []breach
			if err := json.Unmarshal(body, &breaches); err != nil {
				return agent.ResultJSON(
					hibpResult{
						ErrorDetail: fmt.Sprintf("cannot parse response: %s", err),
					},
				), nil
			}

			return agent.ResultJSON(
				hibpResult{
					Found:    len(breaches) > 0,
					Count:    len(breaches),
					Breaches: breaches,
				},
			), nil
		},
	)
}