Phase 8 (Bridge): SID/phishing header passthrough, updated TODO

- proxy.rs: forward_to_core() now accepts the incoming headers vec
  and passes X-UT-SID, X-UT-PHISHING-TOKEN, and X-Request-ID through
  to Core on every mapped request (#19, #20)
- TODO.md: mark #15-#20 as complete with implementation notes;
  update test counts; clean up duplicate #15 entry

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

TODO.md

@@ -21,14 +21,23 @@
        → TLS: danger_accept_invalid_certs=true so self-signed certs work
 - [x] #13 Add `DELETE /_bridge/captures` to wipe capture folder
 - [x] #14 Add capture deduplication (same method+path within 1 second)
-- [ ] #15 Add request diff tool: show what changed between two captures
+- [x] #15 Add request diff tool: `GET /_bridge/captures/diff?a=<id>&b=<id>`
+       → Reports method/path/status changes, header diffs, JSON body key-level diff
 
 ## Mapper
-- [ ] #16 Implement actual auth endpoint mapping (static token response)
+- [x] #16 Implement auth endpoint mapping + response shaping
-- [ ] #17 Map squad read endpoint when confirmed
+       → `src/shaper.rs` wraps Core `/auth/local` response in FUT auth envelope
-- [ ] #18 Map pack details endpoint when confirmed
+       → Includes sid, phishingToken, persona, pid, userAccountInfo
-- [ ] #19 Add X-UT-SID session header pass-through to Core
+- [x] #17 Map squad read/write endpoints
-- [ ] #20 Add phishing token passthrough
+       → `GET /ut/game/fut/squad/active` → Core GET /squad
+       → `PUT /ut/game/fut/squad/active` → Core POST /squad
+- [x] #18 Map pack details endpoint
+       → `GET /ut/game/fut/store/packdetails` → Core GET /packs
+       → Response shaped into FUT purchasedPacks envelope
+- [x] #19 Add X-UT-SID session header pass-through to Core
+       → Forwarded verbatim on every mapped Core request
+- [x] #20 Add phishing token passthrough
+       → X-UT-PHISHING-TOKEN forwarded on every mapped Core request
 
 ## Admin UI
 - [x] #21 Build a simple web dashboard for viewing captures (`GET /_bridge/admin`)
@@ -37,9 +46,10 @@
        → Reports each unique endpoint as mapped/known/unknown
 - [x] #23 Add live capture stream via SSE (`GET /_bridge/captures/stream`)
        → `event: capture` events pushed on each new capture
-- [ ] #15 Add request diff tool
 
 ## Testing
 - [x] #24 Add test for placeholder response format
 - [x] #25 Add integration test that fires real HTTP at the Bridge
-       → 8 new tests: health, placeholder, captures CRUD, status, TLS cert gen
+       → 13 tests: health, placeholder, captures CRUD, status, TLS cert gen
+- [x] Shaper unit tests (4) — auth envelope shape, dispatch, passthrough, market
+- [x] Mapper unit tests (6) — auth, market, events, squad PUT, unknown, trailing slash

src/proxy.rs

@@ -100,7 +100,7 @@ pub async fn catch_all_handler(
     );
 
     let mut capture =
-        CapturedRequest::new(&method, &path, query.as_deref(), headers, body_str.clone());
+        CapturedRequest::new(&method, &path, query.as_deref(), headers.clone(), body_str.clone());
 
     let (response_body, status_code): (Value, u16) =
         if let Some(mapping) = map_to_core(&method, &path) {
@@ -116,6 +116,7 @@ pub async fn catch_all_handler(
                 mapping.method,
                 mapping.core_path,
                 body_str.as_deref(),
+                &headers,
             )
             .await
             {
@@ -168,16 +169,26 @@ async fn forward_to_core(
     method: &str,
     path: &str,
     body: Option<&str>,
+    incoming_headers: &[(String, String)],
 ) -> anyhow::Result<(Value, u16)> {
     let url = format!("{}{}", state.config.core_url, path);
-    let builder = match method {
+    let mut builder = match method {
         "POST" => state.http_client.post(&url),
         "PUT" => state.http_client.put(&url),
         "DELETE" => state.http_client.delete(&url),
         _ => state.http_client.get(&url),
     };
 
-    let builder = if let Some(b) = body {
+    // Pass through FUT session and anti-phishing headers so Core can log/correlate them.
+    // These are used in #19 (X-UT-SID) and #20 (X-UT-PHISHING-TOKEN) passthrough.
+    for (k, v) in incoming_headers {
+        let lower = k.to_lowercase();
+        if lower == "x-ut-sid" || lower == "x-ut-phishing-token" || lower == "x-request-id" {
+            builder = builder.header(k.as_str(), v.as_str());
+        }
+    }
+
+    builder = if let Some(b) = body {
         builder
             .header("content-type", "application/json")
             .body(b.to_string())