[ianardee]

Description

Types of changes

• Docs change / refactoring / dependency upgrade
• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to change)
• Requires a change to the official Guide documentation.

[Copilot]

🟡 Changes recommended

The HMAC validation updates still allow whitespace-only secret keys and include avoidable dead/culture-sensitive casing logic that should be corrected before approval.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

This PR tightens and expands HMAC signature validation behavior in BaseLocalResponse and updates the unit tests around local response parsing and job/error response parsing metadata to better reflect expected behavior.

Changes:

• Adjusts IsValidHmacSignature parameter checks and adds additional HMAC validation cases in unit tests (null/empty/uppercase signature).
• Updates XML documentation strings around local response constructors.
• Refactors/renames several unit tests and updates [Trait] / [Fact(DisplayName=...)] metadata for clearer categorization.

File summaries

File	Description
tests/Mindee.UnitTests/V2/Parsing/LocalResponseTest.cs	Adds more IsValidHmacSignature assertions (null/empty/uppercase) and renames test methods.
tests/Mindee.UnitTests/V2/Parsing/JobTest.cs	Updates test categorization metadata and moves helper method for readability.
tests/Mindee.UnitTests/V2/Parsing/ErrorResponseTest.cs	Adds test categorization metadata and improves test display name.
src/Mindee/Parsing/BaseLocalResponse.cs	Updates constructor XML docs and tightens HMAC signature validation logic.

Review details

Suppressed comments (2)

src/Mindee/Parsing/BaseLocalResponse.cs:133

• The expectedSignature == "" guard is unreachable with the current GetHmacSignature implementation (it always returns a non-empty hex string). Keeping this branch adds dead code and makes the method harder to reason about.

            string expectedSignature = GetHmacSignature(secretKey);
            if (expectedSignature == "")
                return false;

src/Mindee/Parsing/BaseLocalResponse.cs:136

• signature.ToLower() is culture-sensitive; for a header value that should be ASCII/hex, normalize using ToLowerInvariant() to avoid any locale-dependent behavior.

            byte[] actualBytes = Encoding.UTF8.GetBytes(signature.ToLower());

• Files reviewed: 4/4 changed files
• Comments generated: 3
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.