fix: preserve catalog-canonical casing for control IDs

[gusfcarvalho]

Problem

Implemented requirements auto-created when a profile is attached to an SSP were stored with lowercased control IDs (gd.sec.c08) while the catalog and profiles use canonical mixed casing (GD.Sec.C08). The lowercasing came from normalizeControlID (strings.ToLower) introduced in #380, applied to the stored value in the AddProfile/AttachProfile fan-out.

Because the frontend resolves control display by exact-string match against the catalog, the 12 lowercased requirements on the ToDo Demo SSP failed resolution and rendered as bare IDs. Other write paths (direct create, OSCAL import) already stored canonical casing — so the inconsistency was the real bug.

Fix

Converge storage on catalog-canonical casing, keep all matching case-insensitive (every downstream join already folds with UPPER(...)):

• dedupeControlIDs — new helper: case-insensitive dedup that preserves first-seen casing. normalizeControlID/normalizeControlIDs are now documented as comparison-key / SQL LOWER(...) IN helpers only — never stored or displayed.
• Resolvers (getControlIDsForProfile, getControlIDsForAllProfiles, extractControlIDsFromProfile) return canonical casing.
• Auto-create loops (AddProfile, AttachProfile) persist the control ID verbatim; the lowercased value is used only as the existingMap dedup key.
• Three LOWER(control_id) IN ? filter sites lower their arg explicitly now that the resolver returns canonical casing (this was the load-bearing dependency a naive fix would break).
• Hardening — canonicalizeControlID: direct CreateImplementedRequirement/UpdateImplementedRequirement snap client-supplied casing to the bound profile's profile_controls form, falling back to the input verbatim when the control isn't part of a bound profile.

Tests

• Added TestImplementedRequirements_PreserveCanonicalCasing — uses mixed-case profile controls and asserts (a) auto-created IRs keep canonical casing / aren't lowercased, and (b) a direct POST with gd.conf.c01 is stored as GD.Conf.C01. The pre-existing tests only used lowercase IDs, so they could never have caught this.
• go build + go vet clean; all three SSP integration suites pass (profiles, SSP API, component suggestions); golangci-lint adds 0 new issues.

Notes

• No backfill migration — the affected environment is ephemeral, so existing lowercase rows aren't worth migrating. In a persistent env, a re-case migration matching UPPER(ir.control_id) = UPPER(pc.control_id) would be needed for already-stored rows.

🤖 Generated with Claude Code

[coderabbitai]

Caution

Review failed

An error occurred during the review process. Please try again later.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Caution

Review failed

The head commit changed during the review from dc98562 to 7035ae7.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}