fix: [event] Deserialize protected with flexible_bool

[elhoim]

BLUF — A numeric protected flag from MISP fails deserialization of the whole event.

• Problem — MispEvent.protected in src/models/event.rs was a bare Option<bool>, the only bool-shaped field not using the flexible_bool helpers; MISP emits boolean columns as 0/"0", so "protected": 0 breaks deserialization of the entire event.
• Fix — Applies the existing flexible_bool_opt module from serde_helpers.rs to protected, matching published, locked, proposal_email_lock and disable_correlation, with a test covering 0, "0", 1, "1", true and absent.
• Effect — Events carrying a protected flag parse instead of failing outright.
• CI — Red from a repo-level CI bug (the job ran on ubuntu-22.04, which has no php8.3 mod_php, and test_event_crud_lifecycle raced the publish worker), fixed in PR fix: [ci] Run integration tests on ubuntu-24.04 to match php8.3 #53 and unrelated to this PR.

Finding

protected is the only MispEvent bool without flexible_bool
Every sibling flag uses flexible_bool because MISP emits 0/"0". If MISP returns "protected": 0, deserialization of the entire event fails.

Change

Confirmed MispEvent.protected (src/models/event.rs) was the only bool-shaped field using a bare Option<bool> instead of the flexible_bool helper family used by published/locked/proposal_email_lock/disable_correlation. Applied the existing flexible_bool_opt module (already defined in serde_helpers.rs for Option fields) to protected, and added a test that deserializes protected from 0, "0", 1, "1", true, and absent, which fails on main for the numeric/string-zero cases and passes after the fix.

Upstream evidence

MISP core app/Model/Event.php:176 lists 'protected' as a plain field alongside published/locked/etc. in the Event model's schema-derived field list (also referenced at lines 3187, 5370, 5764), confirming MISP treats it as the same boolean-column type as the other flags that are already wrapped in flexible_bool in event.rs (published at line ~57, locked/proposal_email_lock/disable_correlation nearby) — MISP's CakePHP/MySQL boolean columns serialize as 0/1 or "0"/"1" over the API the same way for every such field, so protected needed the identical treatment.

Verified against MISP core 843b6744 and PyMISP e7debb4f.

Tests

• event_protected_accepts_flexible_bool_variants (src/models/event.rs)

---

Verified locally: cargo fmt --check, cargo clippy --all-targets --all-features -- -D warnings, cargo test --all-features --lib, --test integration_tests --no-run, and cargo check --examples, each in an isolated target directory.

🤖 Generated with Claude Code