Compare MAX channel handles without case changes affecting post identity

max_api.py

@@ -91,6 +91,22 @@ def message_id_from_link(channel_id: int, post_id: str) -> str:
     return "mid." + chat_bytes.hex() + message_bytes.hex()
 
 
+def same_public_post_url(returned_url, canonical_link):
+    """Channel handles are case-insensitive; short message IDs are not."""
+    try:
+        actual, expected = urlsplit(returned_url), urlsplit(canonical_link)
+        if (actual.scheme not in ("http", "https") or actual.hostname != "max.ru"
+                or actual.username or actual.password or actual.port):
+            return False
+        actual_parts = actual.path.rstrip("/").split("/")
+        expected_parts = expected.path.rstrip("/").split("/")
+        return (len(actual_parts) == len(expected_parts) == 3
+                and actual_parts[1].casefold() == expected_parts[1].casefold()
+                and actual_parts[2] == expected_parts[2])
+    except (ValueError, TypeError):
+        return False
+
+
 def get_public_post(session, slug, post_id, canonical_link, timeout):
     title = slug
     try:
@@ -129,8 +145,7 @@ def get_public_post(session, slug, post_id, canonical_link, timeout):
             LOGGER.warning("MAX API returned a different message for %s", canonical_link)
             return title, None
         if message.get("url"):
-            returned_path = urlsplit(message["url"]).path.rstrip("/")
-            if returned_path != urlsplit(canonical_link).path.rstrip("/"):
+            if not same_public_post_url(message["url"], canonical_link):
                 LOGGER.warning("MAX API returned a different post URL for %s", canonical_link)
                 return title, None
         views = stat.get("views")

tests/test_max_api.py

@@ -79,6 +79,25 @@ class MaxPublicPostTests(unittest.TestCase):
             session, "vkontakte", "AaE-viFyB3E", URL, (5, 8),
         )[1], 0)
 
+    @patch.dict(os.environ, {"MAX_ACCESS_TOKEN": "test-token"})
+    def test_case_only_channel_difference_keeps_exact_message_check(self):
+        session = Mock()
+        session.get.side_effect = [page_response(), Mock(status_code=200, json=lambda: {
+            "body": {"mid": MID}, "stat": {"views": 1197},
+            "url": "https://max.ru/VKONTAKTE/AaE-viFyB3E/",
+        })]
+        self.assertEqual(max_api.get_public_post(session, "vkontakte", "AaE-viFyB3E", URL, (5, 8))[1], 1197)
+
+    def test_url_comparison_rejects_other_posts_and_hosts(self):
+        for url in ["https://max.ru/vkontakte/aaE-viFyB3E",
+                    "https://max.ru/other/AaE-viFyB3E",
+                    "https://evil.test/vkontakte/AaE-viFyB3E",
+                    "https://user:pass@max.ru/vkontakte/AaE-viFyB3E",
+                    "https://max.ru:8443/vkontakte/AaE-viFyB3E"]:
+            with self.subTest(url=url):
+                self.assertFalse(max_api.same_public_post_url(url, URL))
+        self.assertTrue(max_api.same_public_post_url("https://max.ru/Vkontakte/AaE-viFyB3E?from=share", URL))
+
     def test_output_keeps_max_counters_and_partial_sum(self):
         lines = [("max", URL, "vkontakte", "AaE-viFyB3E"),
                  ("max", "https://max.ru/other/AaE-viFyB3E", "other", "AaE-viFyB3E")]