feat(fifa17): own non-economy static + security-question routes in Rust

Migrate 5 non-economy UTAS route families from the Python oracle proxy to
Rust host ownership: user/accountinfo, settings, leaderboards/options,
match/reset, and phishing/{trusteddevice,question,validate}.

- adapter fut::non_economy: pure IO-free shapers matching the observed prod
  oracle bodies + a verbatim port of security_question_route (stateless ack;
  answer never stored/compared; trusted-device is an invariant constant).
- host: Route variants + classify() arms + owner=RUST dispatch; the
  security-question X-UT-SID gate reuses SessionStore::session_known.
- tests: 9 adapter unit tests (contract) + host non_economy_route_ownership
  (classify + classify_economy negatives).

openfut-adapter-fifa17/src/fut/mod.rs

@@ -10,6 +10,7 @@ pub mod economy;
 pub mod economy_policy;
 pub mod entities;
 pub mod item;
+pub mod non_economy;
 pub mod owned_query;
 pub mod pack_content;
 pub mod squad;

openfut-adapter-fifa17/src/fut/non_economy.rs

@@ -0,0 +1,306 @@
+//! FIFA17 non-economy presentation routes, migrated from the Python oracle.
+//!
+//! Pure, IO-free shapers that reproduce the **observed production** oracle
+//! contract (`fifa17-recon/tools/utas_server.py`) for the non-economy UTAS
+//! routes a Rust host can own without any Core or account state:
+//!
+//! * `GET  …/user/accountinfo`        → `{}`               (FUT_ACCOUNTINFO off)
+//! * `GET  …/settings`                → `{"configs":[]}`   (FUT_SETTINGS off)
+//! * `GET  …/leaderboards/options`    → `{}`               (FUT_MODES off)
+//! * `PUT  …/match/reset`             → `{}`               (Tier-B no-op ack)
+//! * `GET/POST/PUT …/phishing/{trusteddevice,question,validate}` — the retired
+//!   FUT security-question service, a stateless acknowledgement.
+//!
+//! These match the bodies the live prod oracle actually returns under the
+//! production environment (`FUT_TRADING=1 FUT_PILESIZES=1 FUT_TRADEABLE=1`, none
+//! of the feature flags set). They carry no persisted state: the security
+//! record the oracle seeds (`{version:1,verified:true}`) is log-only — the
+//! response is invariant — so a faithful Rust owner needs no persistence.
+
+use serde_json::{json, Value};
+
+/// `GET …/user/accountinfo` — production oracle returns an empty object.
+pub fn accountinfo_body() -> Value {
+    json!({})
+}
+
+/// `GET …/settings` — production oracle returns an empty config list.
+pub fn settings_body() -> Value {
+    json!({ "configs": [] })
+}
+
+/// `GET …/leaderboards/options` — production oracle (FUT_MODES off) returns an
+/// empty object; the retail client ignores the body.
+pub fn leaderboard_options_body() -> Value {
+    json!({})
+}
+
+/// `PUT …/match/reset` — Tier-B no-op acknowledgement.
+pub fn match_reset_body() -> Value {
+    json!({})
+}
+
+/// The phishing/security-question action, parsed from the URL tail.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum SecurityAction {
+    TrustedDevice,
+    Question,
+    Validate,
+    Unknown,
+}
+
+/// The `phishing/<action>` selector from a `…/phishing/<action>` path tail.
+pub fn parse_security_action(tail: &str) -> SecurityAction {
+    let last = tail.trim_end_matches('/').rsplit('/').next().unwrap_or("");
+    match last {
+        "trusteddevice" => SecurityAction::TrustedDevice,
+        "question" => SecurityAction::Question,
+        "validate" => SecurityAction::Validate,
+        _ => SecurityAction::Unknown,
+    }
+}
+
+/// A well-formed FUT phishing token is an opaque 32-char lowercase/uppercase hex
+/// value (`_PHISHING_HEX32.fullmatch` in the oracle).
+fn is_hex32(s: &str) -> bool {
+    s.len() == 32 && s.bytes().all(|b| b.is_ascii_hexdigit())
+}
+
+/// Reproduce `utas_server.py::security_question_route` verbatim.
+///
+/// The retired FUT security-question service is a stateless acknowledgement: it
+/// validates request shape (session, 32-hex device id, 32-hex answer, numeric
+/// question) and returns fixed bodies. The answer is a client-transformed opaque
+/// value that is **never stored or compared**; the trusted-device response is an
+/// invariant `verified/trusted` constant.
+///
+/// * `session_known` — whether `X-UT-SID` maps to an open Rust session.
+/// * `device_id` / `question` / `answer` — decoded query parameters (`""`/`None`
+///   when absent).
+///
+/// Returns `(http_status, body)`.
+pub fn security_question_response(
+    method: &str,
+    action: SecurityAction,
+    session_known: bool,
+    device_id: &str,
+    question: Option<&str>,
+    answer: Option<&str>,
+) -> (u16, Value) {
+    let is = |m: &str| method.eq_ignore_ascii_case(m);
+    if !session_known {
+        return (400, json!({ "reason": "invalid_session" }));
+    }
+    if !is_hex32(device_id) {
+        return (400, json!({ "reason": "malformed_request" }));
+    }
+    match action {
+        SecurityAction::TrustedDevice => {
+            if !is("GET") {
+                return (405, json!({ "reason": "method_not_allowed" }));
+            }
+            (
+                200,
+                json!({ "changed": false, "exists": true, "locked": false, "trusted": true }),
+            )
+        }
+        SecurityAction::Question if is("GET") => (
+            200,
+            json!({ "question": 0, "attempts": 5, "recoverAttempts": 0 }),
+        ),
+        SecurityAction::Question if is("POST") || is("PUT") => {
+            let q = question.unwrap_or("");
+            let a = answer.unwrap_or("");
+            if q.is_empty() || !q.bytes().all(|b| b.is_ascii_digit()) || !is_hex32(a) {
+                return (400, json!({ "reason": "malformed_request" }));
+            }
+            (200, json!({}))
+        }
+        SecurityAction::Validate if is("POST") => {
+            let a = answer.unwrap_or("");
+            if !is_hex32(a) {
+                return (400, json!({ "reason": "malformed_request" }));
+            }
+            (200, json!({}))
+        }
+        _ => (405, json!({ "reason": "method_not_allowed" })),
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    const DEV: &str = "6236375476659cd0f6c780e728774b71"; // 32-hex (live deviceId)
+    const ANS: &str = "0123456789abcdef0123456789abcdef";
+
+    #[test]
+    fn static_bodies_match_oracle() {
+        assert_eq!(accountinfo_body(), json!({}));
+        assert_eq!(settings_body(), json!({ "configs": [] }));
+        assert_eq!(leaderboard_options_body(), json!({}));
+        assert_eq!(match_reset_body(), json!({}));
+    }
+
+    #[test]
+    fn action_parse() {
+        assert_eq!(
+            parse_security_action("phishing/trusteddevice"),
+            SecurityAction::TrustedDevice
+        );
+        assert_eq!(
+            parse_security_action("phishing/question/"),
+            SecurityAction::Question
+        );
+        assert_eq!(
+            parse_security_action("phishing/validate"),
+            SecurityAction::Validate
+        );
+        assert_eq!(
+            parse_security_action("phishing/other"),
+            SecurityAction::Unknown
+        );
+    }
+
+    #[test]
+    fn trusted_device_verified_constant() {
+        let (s, b) =
+            security_question_response("GET", SecurityAction::TrustedDevice, true, DEV, None, None);
+        assert_eq!(s, 200);
+        assert_eq!(
+            b,
+            json!({ "changed": false, "exists": true, "locked": false, "trusted": true })
+        );
+    }
+
+    #[test]
+    fn no_session_is_400_invalid_session() {
+        let (s, b) = security_question_response(
+            "GET",
+            SecurityAction::TrustedDevice,
+            false,
+            DEV,
+            None,
+            None,
+        );
+        assert_eq!(s, 400);
+        assert_eq!(b, json!({ "reason": "invalid_session" }));
+    }
+
+    #[test]
+    fn bad_device_id_is_malformed() {
+        for bad in [
+            "",
+            "xyz",
+            "6236375476659cd0f6c780e728774b7",
+            "not-hex-not-hex-not-hex-not-hexx",
+        ] {
+            let (s, b) = security_question_response(
+                "GET",
+                SecurityAction::TrustedDevice,
+                true,
+                bad,
+                None,
+                None,
+            );
+            assert_eq!(s, 400, "device {bad:?}");
+            assert_eq!(b, json!({ "reason": "malformed_request" }));
+        }
+    }
+
+    #[test]
+    fn trusted_device_wrong_method_405() {
+        let (s, _) = security_question_response(
+            "POST",
+            SecurityAction::TrustedDevice,
+            true,
+            DEV,
+            None,
+            None,
+        );
+        assert_eq!(s, 405);
+    }
+
+    #[test]
+    fn question_get_returns_prompt() {
+        let (s, b) =
+            security_question_response("GET", SecurityAction::Question, true, DEV, None, None);
+        assert_eq!(s, 200);
+        assert_eq!(
+            b,
+            json!({ "question": 0, "attempts": 5, "recoverAttempts": 0 })
+        );
+    }
+
+    #[test]
+    fn question_setup_validates_shape() {
+        // valid numeric question + 32-hex answer
+        let (s, b) = security_question_response(
+            "POST",
+            SecurityAction::Question,
+            true,
+            DEV,
+            Some("0"),
+            Some(ANS),
+        );
+        assert_eq!(s, 200);
+        assert_eq!(b, json!({}));
+        // empty question -> malformed
+        let (s, _) = security_question_response(
+            "POST",
+            SecurityAction::Question,
+            true,
+            DEV,
+            Some(""),
+            Some(ANS),
+        );
+        assert_eq!(s, 400);
+        // non-digit question -> malformed
+        let (s, _) = security_question_response(
+            "PUT",
+            SecurityAction::Question,
+            true,
+            DEV,
+            Some("x"),
+            Some(ANS),
+        );
+        assert_eq!(s, 400);
+        // bad answer -> malformed
+        let (s, _) = security_question_response(
+            "POST",
+            SecurityAction::Question,
+            true,
+            DEV,
+            Some("0"),
+            Some("short"),
+        );
+        assert_eq!(s, 400);
+    }
+
+    #[test]
+    fn validate_checks_answer() {
+        let (s, b) = security_question_response(
+            "POST",
+            SecurityAction::Validate,
+            true,
+            DEV,
+            None,
+            Some(ANS),
+        );
+        assert_eq!(s, 200);
+        assert_eq!(b, json!({}));
+        let (s, _) = security_question_response(
+            "POST",
+            SecurityAction::Validate,
+            true,
+            DEV,
+            None,
+            Some("nope"),
+        );
+        assert_eq!(s, 400);
+        // wrong method for validate
+        let (s, _) =
+            security_question_response("GET", SecurityAction::Validate, true, DEV, None, Some(ANS));
+        assert_eq!(s, 405);
+    }
+}