parlov-elicit 0.5.0

//! `CaseNormalizeElicitation` -- uppercases the path component of both baseline and probe URLs.
//!
//! Applies the case transform symmetrically so the resource ID is the only
//! variable that differs across the pair. Servers that serve directly at the
//! uppercased path return 200 (or another anchor) for an existing resource and
//! 404 for a nonexistent one. Complements `rd-case-variation` which only
//! detects 3xx canonicalizing redirects.

use http::Method;
use parlov_core::{
    always_applicable, NormativeStrength, OracleClass, SignalSurface, Technique, Vector,
};

use crate::strategy::Strategy;
use crate::types::{ProbeSpec, RiskLevel, StrategyMetadata};
use crate::util::{substitute_url, url_pair_specs_with_canonical};
use crate::ScanContext;

static METADATA: StrategyMetadata = StrategyMetadata {
    strategy_id: "case-normalize-elicit",
    strategy_name: "Case Normalize Elicitation",
    risk: RiskLevel::Safe,
};

static TECHNIQUE: Technique = Technique {
    id: "case-normalize",
    name: "URL path case normalization",
    oracle_class: OracleClass::Existence,
    vector: Vector::StatusCodeDiff,
    strength: NormativeStrength::May,
    normalization_weight: Some(0.05),
    inverted_signal_weight: None,
    method_relevant: false,
    parser_relevant: false,
    applicability: always_applicable,
    contradiction_surface: SignalSurface::Status,
};

/// Uppercases the path component of a URL, leaving scheme, authority, and query intact.
fn uppercase_url_path(url: &str) -> String {
    match url.split_once('?') {
        Some((path, query)) => format!("{}?{query}", path.to_uppercase()),
        None => url.to_uppercase(),
    }
}

/// Elicits existence differentials by uppercasing the path component on both sides.
pub struct CaseNormalizeElicitation;

impl Strategy for CaseNormalizeElicitation {
    fn metadata(&self) -> &'static StrategyMetadata {
        &METADATA
    }

    fn technique_def(&self) -> &'static Technique {
        &TECHNIQUE
    }

    fn methods(&self) -> &[Method] {
        &[Method::GET, Method::HEAD]
    }

    fn is_applicable(&self, _ctx: &ScanContext) -> bool {
        true
    }

    fn generate(&self, ctx: &ScanContext) -> Vec<ProbeSpec> {
        // body_template intentionally ignored: this strategy mutates the URL, not the body.
        // The canonical baseline is the unmutated original-case URL; the runner dispatches it
        // alongside the mutated pair so `control_integrity` can detect case-sensitive routing
        // that would otherwise produce phantom `SameStatus` Contradictory.
        let canonical_url = substitute_url(&ctx.target, &ctx.baseline_id);
        let baseline_url = uppercase_url_path(&canonical_url);
        let probe_url = uppercase_url_path(&substitute_url(&ctx.target, &ctx.probe_id));
        url_pair_specs_with_canonical(
            &baseline_url,
            &probe_url,
            &canonical_url,
            &ctx.headers,
            &METADATA,
            &TECHNIQUE,
        )
    }
}

#[cfg(test)]
mod tests {
    use super::*;
    use crate::test_utils::minimal_ctx;
    use crate::types::ProbePair;
    use http::Method;

    fn make_ctx() -> ScanContext {
        ScanContext {
            probe_id: "abc".to_owned(),
            ..minimal_ctx()
        }
    }

    fn make_ctx_with_query() -> ScanContext {
        ScanContext {
            target: "https://api.example.com/users/{id}?foo=bar".to_owned(),
            ..make_ctx()
        }
    }

    fn find_pair_for<'a>(specs: &'a [ProbeSpec], method: &Method) -> &'a ProbePair {
        specs
            .iter()
            .find_map(|s| {
                if let ProbeSpec::Pair(p) = s {
                    if p.probe.method == *method {
                        return Some(p);
                    }
                }
                None
            })
            .expect("pair for method must exist")
    }

    #[test]
    fn risk_is_safe() {
        assert_eq!(CaseNormalizeElicitation.risk(), RiskLevel::Safe);
    }

    #[test]
    fn generate_returns_two_items() {
        assert_eq!(CaseNormalizeElicitation.generate(&make_ctx()).len(), 2);
    }

    #[test]
    fn probe_url_path_is_uppercased() {
        let specs = CaseNormalizeElicitation.generate(&make_ctx());
        let pair = find_pair_for(&specs, &Method::GET);
        assert!(
            pair.probe.url.contains("/USERS/ABC"),
            "got: {}",
            pair.probe.url
        );
    }

    #[test]
    fn baseline_url_path_is_uppercased() {
        let specs = CaseNormalizeElicitation.generate(&make_ctx());
        let pair = find_pair_for(&specs, &Method::GET);
        assert!(
            pair.baseline.url.contains("/USERS/"),
            "baseline path must be uppercased; got: {}",
            pair.baseline.url
        );
    }

    #[test]
    fn baseline_and_probe_paths_use_same_case_transform() {
        let specs = CaseNormalizeElicitation.generate(&make_ctx());
        for method in [Method::GET, Method::HEAD] {
            let pair = find_pair_for(&specs, &method);
            let baseline_path: String = pair
                .baseline
                .url
                .chars()
                .take_while(|&c| c != '?')
                .collect();
            let probe_path: String = pair.probe.url.chars().take_while(|&c| c != '?').collect();
            assert_eq!(
                baseline_path,
                baseline_path.to_uppercase(),
                "baseline path must be fully uppercased for {method}; got {baseline_path}"
            );
            assert_eq!(
                probe_path,
                probe_path.to_uppercase(),
                "probe path must be fully uppercased for {method}; got {probe_path}"
            );
        }
    }

    #[test]
    fn query_string_is_not_uppercased() {
        let specs = CaseNormalizeElicitation.generate(&make_ctx_with_query());
        for method in [Method::GET, Method::HEAD] {
            let pair = find_pair_for(&specs, &method);
            assert!(
                pair.probe.url.contains("?foo=bar"),
                "probe query must be preserved for {method}; got: {}",
                pair.probe.url
            );
            assert!(
                pair.baseline.url.contains("?foo=bar"),
                "baseline query must be preserved for {method}; got: {}",
                pair.baseline.url
            );
        }
    }

    #[test]
    fn baseline_and_probe_headers_are_identical() {
        let specs = CaseNormalizeElicitation.generate(&make_ctx());
        for method in [Method::GET, Method::HEAD] {
            let pair = find_pair_for(&specs, &method);
            assert_eq!(
                pair.baseline.headers, pair.probe.headers,
                "headers must be byte-identical on both sides for {method}"
            );
        }
    }

    #[test]
    fn baseline_url_uses_baseline_id_probe_url_uses_probe_id() {
        let ctx = make_ctx();
        let specs = CaseNormalizeElicitation.generate(&ctx);
        for method in [Method::GET, Method::HEAD] {
            let pair = find_pair_for(&specs, &method);
            let uppercased_baseline = ctx.baseline_id.to_uppercase();
            let uppercased_probe = ctx.probe_id.to_uppercase();
            assert!(
                pair.baseline.url.contains(&uppercased_baseline),
                "baseline url must embed uppercased baseline_id ({uppercased_baseline}) for {method}; got {}",
                pair.baseline.url
            );
            assert!(
                pair.probe.url.contains(&uppercased_probe),
                "probe url must embed uppercased probe_id ({uppercased_probe}) for {method}; got {}",
                pair.probe.url
            );
        }
    }

    #[test]
    fn technique_strength_is_may() {
        let specs = CaseNormalizeElicitation.generate(&make_ctx());
        assert_eq!(specs[0].technique().strength, NormativeStrength::May);
    }

    #[test]
    fn normalization_weight_is_0_05() {
        assert_eq!(TECHNIQUE.normalization_weight, Some(0.05));
    }

    #[test]
    fn inverted_signal_weight_is_none() {
        assert_eq!(TECHNIQUE.inverted_signal_weight, None);
    }
}