fix: drop appId uppercasing in AppRoleAssignment.MarshalJSON (BED-9235)

[ktstrader]

Description

BED-9100 (c8fdff7) uppercased appId, but appId is a constant-match key, not a node endpoint. BHE compares it verbatim against the lowercase Microsoft Graph app id (00000003-0000-0000-c000-000000000000) via a case-sensitive == to build the
AZMG* edges. Uppercasing broke that match and silently dropped ~2.29M edges. This reverts appId to the casing every other producer already emits (v3.0.0, BARK, the Graph API). resourceId/tenantId/principalId stay uppercased — those are real endpoints the raw-ingest path needs.

Fixed in the collector (not BHE) because the regression is collector-side and this works against all existing BHE versions with no deploy.

Motivation and Context

Resolves: BED-9235

Changes

 // models/app-role-assignments.go — MarshalJSON
 	a.ResourceId = strings.ToUpper(a.ResourceId)
-	a.AppId = strings.ToUpper(a.AppId)
 	a.TenantId = strings.ToUpper(a.TenantId)

 // models/marshal_test.go — regression guard
-	require.Equal(t, "APP-1", out["appId"])
+	require.Equal(t, "app-1", out["appId"])

Impact

Total AZ edges	AZMGAddOwner	AZMGAddSecret	AZMGAddMember	AZMGGrantRole
545,339 → 2,838,921	0 → 1,195,654	0 → 977,214	0 → 116,923	0 → 3,611

Testing

• go build ./... and go test ./... pass.
• BHE end-to-end (v3.0.0 raw OFF / patched raw OFF / patched raw ON): 0 splits, 0 duplicates, 0 non-uppercase objectids; patched raw OFF == raw ON (byte-identical 2,838,921 edges, so use_raw_object_id is a no-op); all AZMG* kinds match the v3.0.0 baseline. Residual 115/10-edge diff vs v3.0.0 is collection-time tenant drift, not a code difference.

Summary by CodeRabbit

• Bug Fixes
  • App role assignment data now preserves the original casing of the application ID when serialized.
  • Resource and tenant identifiers continue to be normalized as before.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: dc9e5089-b756-490b-b483-a19a606fb902

📥 Commits

Reviewing files that changed from the base of the PR and between c8fdff7 and 05ea457.

📒 Files selected for processing (2)

• models/app-role-assignments.go
• models/marshal_test.go

💤 Files with no reviewable changes (1)

• models/app-role-assignments.go

---

Walkthrough

The change preserves AppId casing during AppRoleAssignment JSON marshaling. The related test now expects the lowercase value. ResourceId and TenantId normalization remain unchanged.

Changes

App role assignment serialization

Layer / File(s)	Summary
Preserve AppId casing models/app-role-assignments.go, models/marshal_test.go	MarshalJSON no longer uppercases AppId. The test expects the lowercase appId value.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Possibly related PRs

• SpecterOps/AzureHound#202: Both changes modify AppRoleAssignment.MarshalJSON and UUID casing tests.
• SpecterOps/AzureHound#204: Both changes modify AppRoleAssignment.MarshalJSON and its marshaling test.

Suggested reviewers: strandutton

Poem

A rabbit checks the casing line,
“Keep AppId just as it’s signed.”
Lowercase hops through JSON bright,
While tests confirm the value right.
ResourceId and TenantId stay,
Unchanged upon their way.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: removing appId uppercasing in AppRoleAssignment.MarshalJSON.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch BED-9235-drop-appId-uppercasing

---

_{Comment @coderabbitai help to get the list of available commands.}