From b8e5d5ea37cc64ffa05352c3fb3130ca59471935 Mon Sep 17 00:00:00 2001 From: srdusr <99972264+srdusr@users.noreply.github.com> Date: Tue, 17 Feb 2026 19:18:00 +0200 Subject: Flagged marker for history entries MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Last of the "should build soon" items from the Burp/ZAP/Caido gap research - Burp's row highlighting and Caido's Findings both serve the same real workflow: mark something interesting mid-engagement, revisit later. Scoped to a boolean flag (★) rather than full free-text notes/comments, which would need their own text-input overlay for comparatively modest extra value over a simple marker - tracked as a real follow-up in PLAN.md, not dropped silently. internal/store: history gains a flagged column (migrated in for existing databases the same way source was) plus Store.SetFlagged and Summary/Entry.Flagged. Search's structured-filter layer (added last commit for status:/source:) gains flagged:true/false alongside them - extractStructured already existed for exactly this kind of "pull it out before it reaches FTS5" filter. internal/ipc gains a "set_flagged" request. cmd/mitmux: 'f' toggles the flag on the selected history row (applied optimistically to local state, persisted async - a drift between local and server state on failure is an acceptable trade-off for a marker this low-stakes), shown as a ★ column in the list and in the detail view's title. store_test.go covers the flagged: parsing (true/false spellings, and a "looks like it but isn't" case - flagged:maybe - falling through as literal search text, matching the existing pattern for status:). Verified live: toggling 'f' shows the star immediately, flagged:true correctly filtered to just that entry, and a direct SQLite check confirmed the flag actually persisted to the database (flagged=1), not just reflected in local UI state. --- internal/ipc/ipc.go | 24 +++++++++++++++++++- internal/ipc/server.go | 9 +++++++- internal/store/store.go | 54 ++++++++++++++++++++++++++++++++++++-------- internal/store/store_test.go | 27 ++++++++++++++++++++++ 4 files changed, 103 insertions(+), 11 deletions(-) (limited to 'internal') diff --git a/internal/ipc/ipc.go b/internal/ipc/ipc.go index d295238..7d81473 100644 --- a/internal/ipc/ipc.go +++ b/internal/ipc/ipc.go @@ -44,11 +44,14 @@ type Request struct { Rule *rules.Rule `json:"rule,omitempty"` RuleID int64 `json:"rule_id,omitempty"` RuleEnabled bool `json:"rule_enabled,omitempty"` + + // For "set_flagged": ID identifies the history entry. + Flagged bool `json:"flagged,omitempty"` } // Response is sent by the daemon to a client. type Response struct { - Type string `json:"type"` // "list", "get", "new", "repeat", "rules", "intrude_result", "intrude_done", "status", or "error" + Type string `json:"type"` // "list", "get", "new", "repeat", "rules", "intrude_result", "intrude_done", "status", "flagged", or "error" Entries []store.Summary `json:"entries,omitempty"` // for "list" Detail *EntryDetail `json:"detail,omitempty"` // for "get" and "repeat" New *store.Summary `json:"new,omitempty"` // for "new" (subscribe push) @@ -117,6 +120,25 @@ func (c *Client) Close() error { return c.conn.Close() } +// SetFlagged sets the flagged marker on a history entry - a simple +// "mark this, revisit later" bit, filterable via flagged:true/false in +// Search. +func (c *Client) SetFlagged(id int64, flagged bool) error { + c.mu.Lock() + defer c.mu.Unlock() + if err := c.enc.Encode(Request{Type: "set_flagged", ID: id, Flagged: flagged}); err != nil { + return err + } + var resp Response + if err := c.dec.Decode(&resp); err != nil { + return err + } + if resp.Type == "error" { + return errors.New(resp.Error) + } + return nil +} + // Status returns basic daemon info for a status bar. func (c *Client) Status() (*StatusMsg, error) { c.mu.Lock() diff --git a/internal/ipc/server.go b/internal/ipc/server.go index eea0ebb..28279a7 100644 --- a/internal/ipc/server.go +++ b/internal/ipc/server.go @@ -178,6 +178,13 @@ func (s *Server) handleConn(conn net.Conn) { } enc.Encode(Response{Type: "intrude_done"}) + case "set_flagged": + if err := s.db.SetFlagged(req.ID, req.Flagged); err != nil { + enc.Encode(Response{Type: "error", Error: err.Error()}) + continue + } + enc.Encode(Response{Type: "flagged"}) + case "rules_list": rs, err := s.db.ListRules() if err != nil { @@ -259,7 +266,7 @@ func detailFromEntry(e *store.Entry) *EntryDetail { ID: e.ID, StartedAt: e.StartedAt, Duration: e.Duration, Method: e.Method, Scheme: e.Scheme, Host: e.Host, Path: e.Path, StatusCode: e.StatusCode, ReqSize: len(e.RequestRaw), RespSize: len(e.ResponseRaw), - Error: e.Error, Source: e.Source, + Error: e.Error, Source: e.Source, Flagged: e.Flagged, }, RequestRaw: e.RequestRaw, ResponseRaw: e.ResponseRaw, RequestExact: e.RequestExact, ResponseExact: e.ResponseExact, diff --git a/internal/store/store.go b/internal/store/store.go index d04887b..4de4fa1 100644 --- a/internal/store/store.go +++ b/internal/store/store.go @@ -33,7 +33,8 @@ CREATE TABLE IF NOT EXISTS history ( request_exact INTEGER NOT NULL, response_exact INTEGER NOT NULL, error TEXT NOT NULL DEFAULT '', - source TEXT NOT NULL DEFAULT 'proxy' + source TEXT NOT NULL DEFAULT 'proxy', + flagged INTEGER NOT NULL DEFAULT 0 ); CREATE VIRTUAL TABLE IF NOT EXISTS history_fts USING fts5( @@ -87,6 +88,7 @@ func Open(path string) (*Store, error) { // Added after the initial schema; ignore the "duplicate column" error // on databases that already have it. db.Exec("ALTER TABLE history ADD COLUMN source TEXT NOT NULL DEFAULT 'proxy'") + db.Exec("ALTER TABLE history ADD COLUMN flagged INTEGER NOT NULL DEFAULT 0") // Backfill history_fts for rows inserted before it existed. A no-op // once caught up, since every Insert keeps both tables in sync. if _, err := db.Exec(` @@ -121,6 +123,7 @@ type Entry struct { ResponseExact bool Error string // network/transport error, if the request never got a response Source string // "proxy" or "repeater" + Flagged bool } // Summary is the lightweight metadata used for the history list view - @@ -138,6 +141,7 @@ type Summary struct { RespSize int Error string Source string + Flagged bool } // Insert stores e (and indexes it for search) and returns its assigned ID. @@ -207,7 +211,7 @@ func (s *Store) List(limit int, beforeID int64) ([]Summary, error) { } rows, err := s.db.Query( `SELECT id, started_at, duration_ms, method, scheme, host, path, - COALESCE(status_code, 0), length(request_raw), COALESCE(length(response_raw), 0), error, source + COALESCE(status_code, 0), length(request_raw), COALESCE(length(response_raw), 0), error, source, flagged FROM history WHERE id < ? ORDER BY id DESC LIMIT ?`, beforeID, limit, ) @@ -220,10 +224,12 @@ func (s *Store) List(limit int, beforeID int64) ([]Summary, error) { for rows.Next() { var sum Summary var startedAt, durationMs int64 + var flagged int if err := rows.Scan(&sum.ID, &startedAt, &durationMs, &sum.Method, &sum.Scheme, &sum.Host, &sum.Path, - &sum.StatusCode, &sum.ReqSize, &sum.RespSize, &sum.Error, &sum.Source); err != nil { + &sum.StatusCode, &sum.ReqSize, &sum.RespSize, &sum.Error, &sum.Source, &flagged); err != nil { return nil, fmt.Errorf("scan history row: %w", err) } + sum.Flagged = flagged != 0 sum.StartedAt = time.UnixMilli(startedAt) sum.Duration = time.Duration(durationMs) * time.Millisecond out = append(out, sum) @@ -267,6 +273,10 @@ func (s *Store) Search(query string, limit int, beforeID int64) ([]Summary, erro where = append(where, "h.source = ?") args = append(args, pred.source) } + if pred.flagged != nil { + where = append(where, "h.flagged = ?") + args = append(args, boolToInt(*pred.flagged)) + } var q string if remaining == "" { @@ -274,7 +284,7 @@ func (s *Store) Search(query string, limit int, beforeID int64) ([]Summary, erro // FTS5 join or ranking needed. q = `SELECT h.id, h.started_at, h.duration_ms, h.method, h.scheme, h.host, h.path, COALESCE(h.status_code, 0), length(h.request_raw), COALESCE(length(h.response_raw), 0), - h.error, h.source + h.error, h.source, h.flagged FROM history h WHERE ` + strings.Join(where, " AND ") + ` ORDER BY h.id DESC LIMIT ?` @@ -287,7 +297,7 @@ func (s *Store) Search(query string, limit int, beforeID int64) ([]Summary, erro args = append([]any{prepareFTSQuery(remaining)}, args...) q = `SELECT h.id, h.started_at, h.duration_ms, h.method, h.scheme, h.host, h.path, COALESCE(h.status_code, 0), length(h.request_raw), COALESCE(length(h.response_raw), 0), - h.error, h.source + h.error, h.source, h.flagged FROM history_fts JOIN history h ON h.id = history_fts.rowid WHERE ` + strings.Join(where, " AND ") + ` @@ -305,10 +315,12 @@ func (s *Store) Search(query string, limit int, beforeID int64) ([]Summary, erro for rows.Next() { var sum Summary var startedAt, durationMs int64 + var flagged int if err := rows.Scan(&sum.ID, &startedAt, &durationMs, &sum.Method, &sum.Scheme, &sum.Host, &sum.Path, - &sum.StatusCode, &sum.ReqSize, &sum.RespSize, &sum.Error, &sum.Source); err != nil { + &sum.StatusCode, &sum.ReqSize, &sum.RespSize, &sum.Error, &sum.Source, &flagged); err != nil { return nil, fmt.Errorf("scan search row: %w", err) } + sum.Flagged = flagged != 0 sum.StartedAt = time.UnixMilli(startedAt) sum.Duration = time.Duration(durationMs) * time.Millisecond out = append(out, sum) @@ -322,6 +334,7 @@ type structuredPredicate struct { statusSQL string statusArgs []any source string + flagged *bool } var ( @@ -358,6 +371,18 @@ func extractStructured(query string) (remaining string, pred structuredPredicate case strings.HasPrefix(lower, "source:"): pred.source = strings.ToLower(strings.TrimPrefix(f, "source:")) continue + case strings.HasPrefix(lower, "flagged:"): + val := strings.ToLower(strings.TrimPrefix(lower, "flagged:")) + switch val { + case "true", "1", "yes": + b := true + pred.flagged = &b + continue + case "false", "0", "no": + b := false + pred.flagged = &b + continue + } } kept = append(kept, f) } @@ -369,24 +394,35 @@ func (s *Store) Get(id int64) (*Entry, error) { row := s.db.QueryRow( `SELECT id, started_at, duration_ms, method, scheme, host, path, COALESCE(status_code, 0), request_raw, response_raw, - request_exact, response_exact, error, source + request_exact, response_exact, error, source, flagged FROM history WHERE id = ?`, id, ) var e Entry var startedAt, durationMs int64 - var reqExact, respExact int + var reqExact, respExact, flagged int if err := row.Scan(&e.ID, &startedAt, &durationMs, &e.Method, &e.Scheme, &e.Host, &e.Path, - &e.StatusCode, &e.RequestRaw, &e.ResponseRaw, &reqExact, &respExact, &e.Error, &e.Source); err != nil { + &e.StatusCode, &e.RequestRaw, &e.ResponseRaw, &reqExact, &respExact, &e.Error, &e.Source, &flagged); err != nil { return nil, fmt.Errorf("get history entry %d: %w", id, err) } e.StartedAt = time.UnixMilli(startedAt) e.Duration = time.Duration(durationMs) * time.Millisecond e.RequestExact = reqExact != 0 e.ResponseExact = respExact != 0 + e.Flagged = flagged != 0 return &e, nil } +// SetFlagged toggles the flagged marker on a history entry - a simple +// "mark this, revisit later" bit, filterable via flagged:true/false in +// Search. Doesn't touch anything else about the entry. +func (s *Store) SetFlagged(id int64, flagged bool) error { + if _, err := s.db.Exec(`UPDATE history SET flagged = ? WHERE id = ?`, boolToInt(flagged), id); err != nil { + return fmt.Errorf("set flagged on entry %d: %w", id, err) + } + return nil +} + // prepareFTSQuery makes free text safe to hand to FTS5's MATCH, whose // query grammar reserves a wide range of punctuation ('.', '-', '/', // '@', '(', ')', and more - confirmed empirically, not just from docs) diff --git a/internal/store/store_test.go b/internal/store/store_test.go index 7999ac3..7fa985a 100644 --- a/internal/store/store_test.go +++ b/internal/store/store_test.go @@ -3,6 +3,8 @@ package store import "testing" func TestExtractStructured(t *testing.T) { + boolPtr := func(b bool) *bool { return &b } + tests := []struct { name string query string @@ -10,12 +12,30 @@ func TestExtractStructured(t *testing.T) { statusSQL string statusArgs []any source string + flagged *bool }{ { name: "plain text only", query: "admin login", remaining: "admin login", }, + { + name: "flagged true", + query: "flagged:true", + remaining: "", + flagged: boolPtr(true), + }, + { + name: "flagged false", + query: "flagged:no", + remaining: "", + flagged: boolPtr(false), + }, + { + name: "not a real flagged token falls through as text", + query: "flagged:maybe", + remaining: "flagged:maybe", + }, { name: "exact status", query: "status:404", @@ -90,6 +110,13 @@ func TestExtractStructured(t *testing.T) { if pred.source != tt.source { t.Errorf("source = %q, want %q", pred.source, tt.source) } + switch { + case pred.flagged == nil && tt.flagged == nil: + case pred.flagged == nil || tt.flagged == nil: + t.Errorf("flagged = %v, want %v", pred.flagged, tt.flagged) + case *pred.flagged != *tt.flagged: + t.Errorf("flagged = %v, want %v", *pred.flagged, *tt.flagged) + } }) } } -- cgit v1.2.3