Update EmergencyAccessInviteQuery to return encoded URLs and a JSON object (#7741)

* update EmergencyAccessInviteQuery to return a JSON object and properly encode the URLs, update test to account for this change

* fix file encoding

* remove comment

Author: bnagawiecki

test/SeederApi.IntegrationTest/QueryControllerTests.cs

@@ -47,10 +47,11 @@ public async Task QueryEndpoint_WithValidQueryAndArguments_ReturnsOk()
 
         Assert.NotNull(result);
 
-        var urls = System.Text.Json.JsonSerializer.Deserialize<List<string>>(result);
-        Assert.NotNull(urls);
-        // For a non-existent email, we expect an empty list
-        Assert.Empty(urls);
+        var response2 = System.Text.Json.JsonSerializer.Deserialize<EmergencyAccessInviteResponse>(result,
+            new System.Text.Json.JsonSerializerOptions { PropertyNameCaseInsensitive = true });
+        Assert.NotNull(response2);
+        Assert.NotNull(response2.Urls);
+        Assert.Empty(response2.Urls);
     }
 
     [Fact]
@@ -77,4 +78,6 @@ public async Task QueryEndpoint_WithMissingRequiredField_ReturnsBadRequest()
 
         Assert.Equal(HttpStatusCode.BadRequest, response.StatusCode);
     }
+
+    private sealed record EmergencyAccessInviteResponse(List<string> Urls);
 }

util/Seeder/Queries/EmergencyAccessInviteQuery.cs

@@ -1,4 +1,6 @@
 using System.ComponentModel.DataAnnotations;
+using System.Globalization;
+using System.Net;
 using Bit.Core.Auth.Models.Business.Tokenables;
 using Bit.Core.Tokens;
 using Bit.Infrastructure.EntityFramework.Repositories;
@@ -11,25 +13,34 @@ namespace Bit.Seeder.Queries;
 public class EmergencyAccessInviteQuery(
     DatabaseContext db,
     IDataProtectorTokenFactory<EmergencyAccessInviteTokenable> dataProtectorTokenizer)
-    : IQuery<EmergencyAccessInviteQuery.Request, IEnumerable<string>>
+    : IQuery<EmergencyAccessInviteQuery.Request, EmergencyAccessInviteQuery.Response>
 {
     public class Request
     {
         [Required]
         public required string Email { get; set; }
     }
 
-    public Task<IEnumerable<string>> Execute(Request request)
+    public class Response
     {
-        var invites = db.EmergencyAccesses
+        public required List<string> Urls { get; set; }
+    }
+
+    public Task<Response> Execute(Request request)
+    {
+        var urls = db.EmergencyAccesses
             .Where(ea => ea.Email == request.Email).ToList().Select(ea =>
             {
                 var token = dataProtectorTokenizer.Protect(
                     new EmergencyAccessInviteTokenable(ea, hoursTillExpiration: 1)
                 );
-                return $"/accept-emergency?id={ea.Id}&name=Dummy&email={ea.Email}&token={token}";
-            });
+                return string.Format(CultureInfo.InvariantCulture,
+                    "/accept-emergency?id={0}&name=Dummy&email={1}&token={2}",
+                    WebUtility.UrlEncode(ea.Id.ToString()),
+                    WebUtility.UrlEncode(ea.Email),
+                    WebUtility.UrlEncode(token));
+            }).ToList();
 
-        return Task.FromResult(invites);
+        return Task.FromResult(new Response { Urls = urls });
     }
 }