API analyzers should support undeclared 200 status codes

[jawn]

Describe the bug

API analyzers should flag an undeclared 200 status code, and provide an option to fix it.

To Reproduce

Steps to reproduce the behavior:

1. Using ASP.NET Core 3.0 with analyzers enabled

<PropertyGroup>
 <IncludeOpenAPIAnalyzers>true</IncludeOpenAPIAnalyzers>
</PropertyGroup>

2. Run this code (adapted from this sample with the ProducesResponseType attribute removed)

// GET api/contacts/{guid}
[HttpGet("{id}", Name = "GetById")]
public IActionResult Get(string id)
{
    var contact = _contacts.Get(id);

    if (contact == null)
    {
        return NotFound();
    }

    return Ok(contact);
}

3. The API analyzer flags the NotFound using a warning (this is expected).
4. The API analyzer does not flag the return Ok(...); (not expected)

Expected behavior

4. The API analyzer does flag the return Ok(...) using a warning.
5. An option to fix this warning is provided, choosing it adds the following attribute
   [ProducesResponseType(typeof(Contact), StatusCodes.Status200OK)]

Why I think this is a bug

From the docs:

The analyzers package notifies you of any controller action that:

• Returns an undeclared status code.
• Returns an undeclared success result.

Additional context

Follow up to dotnet/AspNetCore.Docs#15269 (comment)

.NET Core SDK: 3.0.100
.NET Core runtimes installed:
Microsoft.NETCore.App 3.0.0 [C:\Program Files\dotnet\shared\Microsoft.NETCore.App]
Microsoft.WindowsDesktop.App 3.0.0 [C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App]

[pranavkm]

The 200 Status code is implicit for every action that does not specify any ProducesResponseType attributes. Admittedly it might a bit confusing for it to not flag the response type, but the analyzer inspect those.

[jawn]

Strictly speaking, this means no warning needs to be generated by the analyzers.

Would it still be possible to provide an optional quick fix to add the strongly typed ProducesResponseType for the Status Code 200?

[pranavkm]

Would it still be possible to provide an optional quick fix to add the strongly typed ProducesResponseType for the Status Code 200?

I think at some point our plan was to provide a code fix to use ActionResult<T> when the action returns an IActionResult and uses Ok, Created etc, but that was never developed. This does seem like an area the analyzer could improve upon.