fix: [search] Rename date keys for events/index in search_index

[elhoim]

BLUF — search_index posts restSearch-shaped date keys to events/index, which drops them.

• Problem — search_index() in src/client.rs posted SearchParameters::to_json() verbatim, sending from/to, but EventsController's index action only recognizes datefrom/dateuntil, so date filters were silently discarded.
• Fix — Renames from to datefrom and to to dateuntil in the JSON body immediately before the events/index POST, mirroring PyMISP's explicit rename, with a wiremock test search_index_renames_date_keys_for_events_index asserting the exact body.
• Effect — Date-bounded index searches return the requested window rather than every event.
• CI — Red from a repo-level CI bug (the job ran on ubuntu-22.04, which has no php8.3 mod_php, and test_event_crud_lifecycle raced the publish worker), fixed in PR fix: [ci] Run integration tests on ubuntu-24.04 to match php8.3 #53 and unrelated to this PR.

Finding

search_index sends restSearch-shaped date keys to events/index
events/index expects datefrom/dateuntil; PyMISP explicitly renames date_from->datefrom and date_to->dateuntil. Date filters are silently dropped.

Change

search_index() posted SearchParameters::to_json() (restSearch-shaped from/to keys) directly to events/index, but MISP's events/index action only recognizes datefrom/dateuntil, so date filters were silently dropped. Fixed by renaming from->datefrom and to->dateuntil in the JSON body immediately before the events/index POST in search_index, mirroring PyMISP's explicit rename. Added a wiremock test that asserts the exact renamed request body via body_json.

Upstream evidence

pymisp/pymisp/api.py:3214-3217 (search_index pops 'date_from'/'date_to' and reinserts as 'datefrom'/'dateuntil' before posting to events/index, contrasted with search() at api.py:3027-3028 which uses 'from'/'to' for restSearch); misp/app/Controller/EventsController.php:37,333,339,719 (events/index action recognizes 'datefrom'/'dateuntil', not 'from'/'to').

Verified against MISP core 843b6744 and PyMISP e7debb4f.

Tests

• search_index_renames_date_keys_for_events_index

Caveats

cargo test could not be run per task constraints (serialized/shared target dir); fail-before-fix reasoning is by inspection: pre-fix body is {"from":...,"to":...}, which would not satisfy the test's exact body_json({"datefrom":...,"dateuntil":...}) matcher, so wiremock returns no match (404) and the test fails; post-fix the body matches exactly since only the two date fields are set on the SearchParameters used in the test. SearchParameters is a general restSearch-shaped struct reused across search() and search_index(); only the date_from/date_to mapping was audited/fixed for the events/index path — other events/index-specific quirks, if any, are out of scope for this minimal fix.

---

Verified locally: cargo fmt --check, cargo clippy --all-targets --all-features -- -D warnings, cargo test --all-features --lib, --test integration_tests --no-run, and cargo check --examples, each in an isolated target directory.

🤖 Generated with Claude Code