[elhoim]

BLUF — Enrichment now hits attributes/enrich/{id} and sends the module map MISP actually reads.

• Problem — enrich_attribute in src/client.rs posted to attributes/enrichAttribute/{id}, not an action on AttributesController (MISP defines enrich($id)), so every call was a MissingAction. Both also sent {"modules": [...]} where MISP reads module => enabled pairs, so enrich_event asked for a module named modules.
• Fix — Repoints enrich_attribute and builds both bodies via a shared enrichment_body() helper emitting {module: true}.
• Effect — Both calls now run the requested modules; three tests added, the first coverage enrich_attribute ever had.
• CI — Red from a repo-level CI bug (ubuntu-22.04 runner lacks php8.3 mod_php; test_event_crud_lifecycle races the publish worker), fixed in unmerged PR fix: [ci] Run integration tests on ubuntu-24.04 to match php8.3 #53 and unrelated to this change.

Finding

enrich_attribute() posted to attributes/enrichAttribute/{id}. That is not an action on AttributesController — MISP defines enrich($id) (app/Controller/AttributesController.php:3717). Every call was a MissingAction.

While fixing the path I found the request body is wrong too, on both enrichment methods:

foreach ($this->request->data as $module => $enabled) {
    if ($enabled) { $modules[] = $module; }
}

MISP reads the posted data as $module => $enabled pairs, so the body must be a map of module name to true. EventsController::enrichEvent() does the same (wrapping in an Event key if absent). The previous {"modules": [...]} body therefore meant enrich_event() — whose path was already correct — requested a single module literally named "modules", with the array as its truthy "enabled" value. So enrich_event was silently broken as well, which is why it is included here.

PyMISP agrees on both points: POST /attributes/enrich/{id} with {module_name: True} (pymisp/api.py:1164).

Change

• enrich_attribute → attributes/enrich/{id}
• both methods build the body via a shared enrichment_body() helper emitting {module: true}

Tests

There was no test for enrich_attribute at all. Adds three:

• enrich_attribute_uses_misp_path_and_module_map_body — asserts the path and the body via body_json
• enrich_event_sends_module_map_body — asserts the corrected body on the already-correct path
• enrichment_body_is_a_module_map — unit test on the helper, including the None case

Verified locally: cargo fmt --check, cargo clippy --all-targets --all-features -- -D warnings, and cargo test --all-features --lib (370 passed) all clean, plus --test integration_tests --no-run and cargo check --examples.

Verified against MISP core 843b6744 and PyMISP e7debb4f.

🤖 Generated with Claude Code