Structured search filters: status:, source:

Closes another top item from the Burp/ZAP/Caido gap research: status-
code and MIME/type filtering alongside free text is used constantly in
practice (Caido's HTTPQL, Burp's proxy history filter). Scoped to
status and source for now - method: already works today via FTS5's own
method column (a plain text match on "POST" is effectively exact for a
short alphanumeric token), so it didn't need special handling.

status_code isn't a text column FTS5 can index, and doesn't benefit
from full-text matching anyway (it's a numeric comparison, not a word
search), so extractStructured pulls status:/source: tokens out of the
query before it reaches FTS5 and turns them into real parameterized SQL
predicates against history's typed columns: status:404 (exact),
status:>=400 / status:!=200 (comparison operators), status:4xx (also
2xx/3xx/5xx - the shorthand people actually reach for: "show me the
errors"), source:repeater/intruder/proxy. Whatever text remains after
extraction still goes through the existing FTS5 path, so "admin
status:200" correctly ANDs a real full-text match with a real status
predicate in one query. When nothing remains (pure "status:4xx"),
Search skips the FTS5 join entirely and queries history directly.

store_test.go covers the parsing (exact/operator/range/source,
combined with free text, and two "looks like it but isn't" cases -
status:banana and the malformed 4-digit status:4004 - to confirm they
fall through as literal search text instead of being misparsed).

Verified live against real varied traffic (status 200/404/500 requests
plus a POST with an "admin" body) - status:4xx matched only the 404;
status:>=400 matched both 404 and 500; "admin status:200" correctly
matched only the POST and excluded the other unrelated 200; source:proxy
matched everything captured so far. All against the actual SQL execution
path, not just the pure parsing function.

1 files changed, 95 insertions, 0 deletions

diff --git a/internal/store/store_test.go b/internal/store/store_test.go
new file mode 100644
index 0000000..7999ac3
--- /dev/null
+++ b/internal/store/store_test.go
@@ -0,0 +1,95 @@
+package store
+
+import "testing"
+
+func TestExtractStructured(t *testing.T) {
+	tests := []struct {
+		name       string
+		query      string
+		remaining  string
+		statusSQL  string
+		statusArgs []any
+		source     string
+	}{
+		{
+			name:      "plain text only",
+			query:     "admin login",
+			remaining: "admin login",
+		},
+		{
+			name:       "exact status",
+			query:      "status:404",
+			remaining:  "",
+			statusSQL:  "status_code = ?",
+			statusArgs: []any{404},
+		},
+		{
+			name:       "status with operator",
+			query:      "status:>=400",
+			remaining:  "",
+			statusSQL:  "status_code >= ?",
+			statusArgs: []any{400},
+		},
+		{
+			name:       "status not-equal",
+			query:      "status:!=200",
+			remaining:  "",
+			statusSQL:  "status_code != ?",
+			statusArgs: []any{200},
+		},
+		{
+			name:       "status range shorthand",
+			query:      "status:4xx",
+			remaining:  "",
+			statusSQL:  "status_code >= ? AND status_code < ?",
+			statusArgs: []any{400, 500},
+		},
+		{
+			name:      "source filter",
+			query:     "source:repeater",
+			remaining: "",
+			source:    "repeater",
+		},
+		{
+			name:       "combined with free text",
+			query:      "admin status:>=400 source:proxy",
+			remaining:  "admin",
+			statusSQL:  "status_code >= ?",
+			statusArgs: []any{400},
+			source:     "proxy",
+		},
+		{
+			name:      "not a real status token falls through as text",
+			query:     "status:banana",
+			remaining: "status:banana",
+		},
+		{
+			name:      "malformed 4-digit status falls through as text",
+			query:     "status:4004",
+			remaining: "status:4004",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			remaining, pred := extractStructured(tt.query)
+			if remaining != tt.remaining {
+				t.Errorf("remaining = %q, want %q", remaining, tt.remaining)
+			}
+			if pred.statusSQL != tt.statusSQL {
+				t.Errorf("statusSQL = %q, want %q", pred.statusSQL, tt.statusSQL)
+			}
+			if len(pred.statusArgs) != len(tt.statusArgs) {
+				t.Fatalf("statusArgs = %v, want %v", pred.statusArgs, tt.statusArgs)
+			}
+			for i := range pred.statusArgs {
+				if pred.statusArgs[i] != tt.statusArgs[i] {
+					t.Errorf("statusArgs[%d] = %v, want %v", i, pred.statusArgs[i], tt.statusArgs[i])
+				}
+			}
+			if pred.source != tt.source {
+				t.Errorf("source = %q, want %q", pred.source, tt.source)
+			}
+		})
+	}
+}