Return empty rather than forbidden on no access

[jakub-id]

avoid leaking information about presence

[Copilot]

Pull Request Overview

This PR modifies the API’s behavior to prevent leaking information by returning empty responses instead of forbidden errors when access is not allowed. Key changes include updating HTTP status codes and response bodies in tests, adjusting error handling and owner checks in the API endpoints, and removing the forbidden error helper.

Reviewed Changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

File	Description
broker/test/api/api-handler_test.go	Updated tests to reflect empty responses rather than forbidden errors for unauthorized access.
broker/api/api-handler.go	Revised error and access handling logic for multiple endpoints to return empty responses or not found errors.

[adamdickmeiss]

You should also remove '403': # Example error response from the open-api.yaml file to indicate it's no longer a possible response.

[adamdickmeiss]

One condition could be simplified.

[Copilot]

Pull Request Overview

This PR updates the API behavior to return an empty response (or a not found error) instead of a forbidden error when access is not granted, in order to avoid information leakage about resource presence. Key changes include:

• Modifying test assertions in the API handler tests to expect empty responses or a not found error.
• Updating error handling in the API endpoints to return an empty JSON array or a not found error instead of a forbidden error.
• Introducing a helper function (httpGetTrans) in tests for unmarshalling transaction lists.

Reviewed Changes

Copilot reviewed 2 out of 3 changed files in this pull request and generated 2 comments.

File	Description
broker/test/api/api-handler_test.go	Tests updated to check for empty responses and changed status codes.
broker/api/api-handler.go	API endpoints updated error handling logic to return empty or not found responses instead of forbidden.

Files not reviewed (1)

• broker/oapi/open-api.yaml: Language not supported