fix: [models] Handle integer timestamps in MispUser, relax statistics assertions

- Add string_or_int_as_string_opt serde helper for fields that MISP
  returns as either strings or integers (timestamps)
- Apply to last_login, date_created, date_modified in MispUser
- Relax statistics test to accept both object and array responses
  (fresh MISP instances return empty arrays)

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: iglocska

src/models/serde_helpers.rs

@@ -44,6 +44,40 @@ pub mod string_or_i64_opt {
     }
 }
 
+/// Deserialize an `Option<String>` that may arrive as a string or integer.
+/// Handles: `null`, `"text"`, `123` (→ `"123"`), `""` (→ `None`).
+/// Useful for timestamp fields MISP returns as either strings or integers.
+pub mod string_or_int_as_string_opt {
+    use super::*;
+
+    pub fn serialize<S>(value: &Option<String>, serializer: S) -> Result<S::Ok, S::Error>
+    where
+        S: Serializer,
+    {
+        match value {
+            Some(v) => serializer.serialize_str(v),
+            None => serializer.serialize_none(),
+        }
+    }
+
+    pub fn deserialize<'de, D>(deserializer: D) -> Result<Option<String>, D::Error>
+    where
+        D: Deserializer<'de>,
+    {
+        let opt: Option<serde_json::Value> = Option::deserialize(deserializer)?;
+        match opt {
+            None | Some(serde_json::Value::Null) => Ok(None),
+            Some(serde_json::Value::String(s)) if s.is_empty() => Ok(None),
+            Some(serde_json::Value::String(s)) => Ok(Some(s)),
+            Some(serde_json::Value::Number(n)) => Ok(Some(n.to_string())),
+            Some(serde_json::Value::Bool(b)) => Ok(Some(b.to_string())),
+            Some(other) => Err(serde::de::Error::custom(format!(
+                "expected string or number, got {other}"
+            ))),
+        }
+    }
+}
+
 /// Deserialize a value that may be a string or number into an `i64`.
 /// Handles: `"123"`, `123`.
 pub mod string_or_i64 {

src/models/user.rs

@@ -1,7 +1,9 @@
 use serde::{Deserialize, Deserializer, Serialize};
 
 use super::organisation::MispOrganisation;
-use super::serde_helpers::{flexible_bool, flexible_bool_opt, string_or_i64_opt};
+use super::serde_helpers::{
+    flexible_bool, flexible_bool_opt, string_or_i64_opt, string_or_int_as_string_opt,
+};
 
 /// Deserialize password, treating masked values (all '*') as None like PyMISP.
 fn deserialize_password<'de, D>(deserializer: D) -> Result<Option<String>, D::Error>
@@ -135,15 +137,27 @@ pub struct MispUser {
     pub notification_monthly: Option<bool>,
 
     /// Timestamp of last login.
-    #[serde(default, skip_serializing_if = "Option::is_none")]
+    #[serde(
+        default,
+        with = "string_or_int_as_string_opt",
+        skip_serializing_if = "Option::is_none"
+    )]
     pub last_login: Option<String>,
 
     /// Date the user was created.
-    #[serde(default, skip_serializing_if = "Option::is_none")]
+    #[serde(
+        default,
+        with = "string_or_int_as_string_opt",
+        skip_serializing_if = "Option::is_none"
+    )]
     pub date_created: Option<String>,
 
     /// Date the user was last modified.
-    #[serde(default, skip_serializing_if = "Option::is_none")]
+    #[serde(
+        default,
+        with = "string_or_int_as_string_opt",
+        skip_serializing_if = "Option::is_none"
+    )]
     pub date_modified: Option<String>,
 
     /// Nested Organisation object (read-only, returned by server).

tests/integration_tests.rs

@@ -1868,13 +1868,22 @@ async fn test_statistics() {
         .attributes_statistics(None, None)
         .await
         .expect("attr stats");
-    assert!(attr_stats.is_object(), "Should return JSON object");
+    assert!(
+        attr_stats.is_object() || attr_stats.is_array(),
+        "Should return JSON object or array"
+    );
 
     let tag_stats = client.tags_statistics(None, None).await.expect("tag stats");
-    assert!(tag_stats.is_object(), "Should return JSON object");
+    assert!(
+        tag_stats.is_object() || tag_stats.is_array(),
+        "Should return JSON object or array"
+    );
 
     let user_stats = client.users_statistics(None).await.expect("user stats");
-    assert!(user_stats.is_object(), "Should return JSON object");
+    assert!(
+        user_stats.is_object() || user_stats.is_array(),
+        "Should return JSON object or array"
+    );
 }
 
 // ============================================================================