Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

ktor-server/ktor-server-plugins/ktor-server-health-check/common/src/io/ktor/server/plugins/healthcheck/HealthCheck.kt (1)

75-80: ⚠️ Potential issue | 🟠 Major

Don't turn cancellation into DOWN, and don't expose raw failure text.

Line 79 catches CancellationException via Exception, so shutdown/request cancellation is reported as a normal health failure. Line 80 also returns raw backend messages from a typically public probe endpoint. Rethrow cancellation and return a sanitized failure string instead.

🔒 Proposed fix

 private suspend fun evaluateCheck(namedCheck: NamedCheck): CheckResult =
     try {
         val healthy = namedCheck.check()
         CheckResult(namedCheck.name, if (healthy) CheckStatus.UP else CheckStatus.DOWN)
+    } catch (cause: CancellationException) {
+        throw cause
     } catch (cause: Exception) {
-        CheckResult(namedCheck.name, CheckStatus.DOWN, cause.message)
+        CheckResult(namedCheck.name, CheckStatus.DOWN, "Health check failed")
     }

Based on learnings: "In Ktor, io.ktor.utils.io.CancellationException is a typealias for kotlinx.coroutines.CancellationException, which is a supertype of JobCancellationException. Therefore, checking e !is io.ktor.utils.io.CancellationException is sufficient to exclude all coroutine cancellation exceptions."

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In
`@ktor-server/ktor-server-plugins/ktor-server-health-check/common/src/io/ktor/server/plugins/healthcheck/HealthCheck.kt`
around lines 75 - 80, In evaluateCheck, avoid turning coroutine cancellations
into DOWN and stop leaking raw error text: change the catch in
evaluateCheck(namedCheck: NamedCheck) to rethrow cancellation exceptions (check
for io.ktor.utils.io.CancellationException or
kotlinx.coroutines.CancellationException) and for other exceptions return
CheckResult(namedCheck.name, CheckStatus.DOWN, "<unavailable>" or a fixed
sanitized message) instead of cause.message; keep references to NamedCheck,
CheckResult and CheckStatus so the handler location is clear.

ktor-server/ktor-server-plugins/ktor-server-health-check/common/src/io/ktor/server/plugins/healthcheck/HealthCheckConfig.kt (1)

96-97: Reject blank health-check names when registering a check.

check("", ...) currently succeeds and produces ambiguous "name" fields in the JSON payload and logs. Validate name.isNotBlank() before storing it.

🛡️ Proposed fix

     public fun check(name: String, block: suspend () -> Boolean) {
+        require(name.isNotBlank()) {
+            "Health check name must not be blank (received length=${name.length})"
+        }
         checks += NamedCheck(name, block)
     }

As per coding guidelines: "Use require(...) for argument validation" and "Make error messages actionable by including the problematic value and context".

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In
`@ktor-server/ktor-server-plugins/ktor-server-health-check/common/src/io/ktor/server/plugins/healthcheck/HealthCheckConfig.kt`
around lines 96 - 97, The check(name: String, block: suspend () -> Boolean)
function currently allows blank names; update it to validate the argument with
require(name.isNotBlank()) before adding NamedCheck to checks, and make the
require message actionable by including the invalid value and context (e.g.
"health check name must not be blank: '<value>'") so callers get a clear error;
adjust any tests or callers if they relied on blank names.

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

ktor-server/ktor-server-plugins/ktor-server-health-check/common/test/io/ktor/server/plugins/healthcheck/HealthCheckTest.kt (1)

180-191: Consider adding a test for duplicate endpoint path rejection.

The configuration validates against duplicate paths with require(), but there's no test verifying this behavior throws an exception.

✅ Proposed test

`@Test`
fun `duplicate endpoint path throws exception`() = testApplication {
    val exception = assertFailsWith<IllegalArgumentException> {
        install(HealthCheck) {
            liveness("/health") {
                check("ok") { true }
            }
            readiness("/health") {
                check("db") { true }
            }
        }
    }
    assertContains(exception.message.orEmpty(), "/health")
    assertContains(exception.message.orEmpty(), "already configured")
}

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In
`@ktor-server/ktor-server-plugins/ktor-server-health-check/common/test/io/ktor/server/plugins/healthcheck/HealthCheckTest.kt`
around lines 180 - 191, Add a unit test that verifies the HealthCheck
configuration rejects duplicate paths by asserting an IllegalArgumentException
is thrown when installing HealthCheck with the same path twice; in the test
(e.g., name it `duplicate endpoint path throws exception`) call
install(HealthCheck) and configure liveness("/health") { check("ok") { true } }
and readiness("/health") { check("db") { true } } inside
assertFailsWith<IllegalArgumentException> and assert that the exception.message
contains "/health" and "already configured" to ensure the require() validation
in the HealthCheck setup is exercised.

ktor-server/ktor-server-plugins/ktor-server-health-check/common/src/io/ktor/server/plugins/healthcheck/HealthCheckConfig.kt (1)

83-85: Consider validating check names to prevent duplicates and empty names.

The check() method accepts any string as a name without validation. Empty/blank names or duplicate check names within the same endpoint would produce confusing health responses.

🛡️ Proposed validation

     public fun check(name: String, block: suspend () -> Boolean) {
+        require(name.isNotBlank()) { "Health check name must not be blank" }
+        require(checks.none { it.name == name }) {
+            "Health check '$name' is already defined in this endpoint"
+        }
         checks += NamedCheck(name, block)
     }

As per coding guidelines: "Use require(...) for argument validation" and "Make error messages actionable by including the problematic value and context".

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In
`@ktor-server/ktor-server-plugins/ktor-server-health-check/common/src/io/ktor/server/plugins/healthcheck/HealthCheckConfig.kt`
around lines 83 - 85, The check(name: String, block: suspend () -> Boolean)
method in HealthCheckConfig accepts any name; add argument validation using
require(...) to ensure name.isNotBlank() and throw a clear message including the
provided name and context (e.g. "check name must not be blank: '<name>'"); also
ensure uniqueness by checking the existing checks collection (checks) for an
existing NamedCheck with the same name and require it not to exist, with an
actionable message like "duplicate check name for HealthCheckConfig: '<name>'";
update the check(...) function to perform these two require(...) validations
before adding NamedCheck(name, block).

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

ktor-server/ktor-server-plugins/ktor-server-health-check/common/src/io/ktor/server/plugins/healthcheck/HealthCheckConfig.kt (1)

31-37: Validate blank path and blank check name during configuration.

readiness/liveness currently allow "" (normalized to /), and check() allows empty names. Validating both early makes misconfiguration obvious.

♻️ Proposed fix

 private fun addEndpoint(path: String, block: HealthCheckBuilder.() -> Unit) {
+    require(path.isNotBlank()) {
+        "Health check endpoint path must not be blank (received: '$path')"
+    }
     val normalizedPath = path.ensureLeadingSlash()
     require(endpoints.none { it.path == normalizedPath }) {
         "Health check endpoint path '$normalizedPath' is already configured"
     }
     endpoints += HealthCheckEndpoint(normalizedPath, HealthCheckBuilder().apply(block).checks.toList())
 }
@@
 public fun check(name: String, block: suspend () -> Boolean) {
+    require(name.isNotBlank()) {
+        "Health check name must not be blank (received: '$name')"
+    }
     checks += NamedCheck(name, block)
 }

As per coding guidelines: "Use require(...) for argument validation" and "Make error messages actionable by including the problematic value and context".

Also applies to: 83-85

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In
`@ktor-server/ktor-server-plugins/ktor-server-health-check/common/src/io/ktor/server/plugins/healthcheck/HealthCheckConfig.kt`
around lines 31 - 37, Reject blank endpoint paths and blank check names early:
in addEndpoint (and the other endpoint-adding overload around lines 83-85) add a
require that the normalizedPath is not "/" (or that the original path is not
blank) with an actionable message including the offending value; and in
HealthCheckBuilder.check validate the provided name with
require(name.isNotBlank()) and an error message that includes the empty
name/context. Use require(...) for these argument checks and reference
HealthCheckEndpoint/HealthCheckBuilder.addEndpoint and HealthCheckBuilder.check
so the validation is added in the right methods.

ktor-server/ktor-server-plugins/ktor-server-health-check/common/src/io/ktor/server/plugins/healthcheck/HealthCheck.kt (1)

81-83: ⚠️ Potential issue | 🟠 Major

Do not return raw exception messages from health responses.

Line 82 forwards cause.message to callers, which can leak internal details from dependencies or infrastructure errors.

🔒 Proposed change

 } catch (cause: Exception) {
-    CheckResult(namedCheck.name, CheckStatus.DOWN, cause.message ?: "Health Check Failed")
+    CheckResult(namedCheck.name, CheckStatus.DOWN, "Health check failed")
 }

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In
`@ktor-server/ktor-server-plugins/ktor-server-health-check/common/src/io/ktor/server/plugins/healthcheck/HealthCheck.kt`
around lines 81 - 83, The catch block in HealthCheck.kt that currently returns
CheckResult(namedCheck.name, CheckStatus.DOWN, cause.message ?: "Health Check
Failed") must not forward raw exception messages; instead return a generic
message like "Health check failed" (or the existing fallback) and log the full
exception separately using the module logger (so callers don't receive internal
error details). Update the catch in the health check execution (the code
producing CheckResult) to remove cause.message from the response, replace it
with a safe constant, and add a logger.error or logger.debug call that includes
the caught exception (cause) for internal diagnostics; keep
CheckResult(namedCheck.name, CheckStatus.DOWN, "<generic>") as the returned
value.

ktor-server/ktor-server-plugins/ktor-server-health-check/common/src/io/ktor/server/plugins/healthcheck/HealthCheckConfig.kt (2)

31-33: Validate blank endpoint paths before normalizing.

Line 32 turns "" into "/", which can silently register the root path. Add an explicit non-blank guard first.

🔧 Proposed change

 private fun addEndpoint(path: String, block: HealthCheckBuilder.() -> Unit) {
+    require(path.isNotBlank()) { "Health check endpoint path must not be blank" }
     val normalizedPath = path.ensureLeadingSlash()
     require(endpoints.none { it.path == normalizedPath }) {
         "Health check endpoint path '$normalizedPath' is already configured"
     }

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In
`@ktor-server/ktor-server-plugins/ktor-server-health-check/common/src/io/ktor/server/plugins/healthcheck/HealthCheckConfig.kt`
around lines 31 - 33, The addEndpoint function currently normalizes an empty
string into "/" via ensureLeadingSlash, allowing accidental registration of the
root path; before calling ensureLeadingSlash, add an explicit non-blank guard
(e.g., require(path.isNotBlank()) with a clear error message) to reject blank
endpoint paths, then proceed to compute normalizedPath and the existing
uniqueness check against endpoints; reference addEndpoint, ensureLeadingSlash,
normalizedPath and endpoints in the change.

---

83-85: Reject blank check names to keep payloads actionable.

Line 84 allows check(""), producing ambiguous entries in the response JSON.

🔧 Proposed change

 public fun check(name: String, block: suspend () -> Boolean) {
+    require(name.isNotBlank()) { "Health check name must not be blank" }
     checks += NamedCheck(name, block)
 }

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In
`@ktor-server/ktor-server-plugins/ktor-server-health-check/common/src/io/ktor/server/plugins/healthcheck/HealthCheckConfig.kt`
around lines 83 - 85, The check(name: String, block: suspend () -> Boolean)
method in HealthCheckConfig allows empty or blank names which yields ambiguous
NamedCheck entries in responses; validate the name (e.g.,
require(name.isNotBlank()) or require(name.trim().isNotEmpty())) at the start of
check and throw an IllegalArgumentException with a clear message when it fails
so blank names are rejected before adding NamedCheck(name, block).

ktor-server/ktor-server-plugins/ktor-server-health-check/common/src/io/ktor/server/plugins/healthcheck/HealthCheck.kt (1)

49-57: Optional: pre-index endpoints by path to avoid per-request linear scan.

find { it.path == path } is O(n) on every probe. A precomputed map keeps lookup O(1).

♻️ Proposed change

-    val endpoints = pluginConfig.endpoints.toList()
+    val endpointsByPath = pluginConfig.endpoints.associateBy { it.path }

     onCall { call ->
         if (call.response.isCommitted) return@onCall
         if (call.request.httpMethod != HttpMethod.Get) return@onCall

         val path = call.request.path()
-        val endpoint = endpoints.find { it.path == path } ?: return@onCall
+        val endpoint = endpointsByPath[path] ?: return@onCall

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In
`@ktor-server/ktor-server-plugins/ktor-server-health-check/common/src/io/ktor/server/plugins/healthcheck/HealthCheck.kt`
around lines 49 - 57, Precompute a lookup map from path to endpoint once instead
of scanning pluginConfig.endpoints per request: build a Map<String,
HealthEndpoint> (e.g., endpointsByPath) from pluginConfig.endpoints during
plugin initialization and then in onCall use endpointsByPath[path] to get the
endpoint; replace the endpoints.find { it.path == path } lookup with this O(1)
map access while preserving the existing guards (call.response.isCommitted and
method check) and behavior when no endpoint is found.