fix: validate form edits and enforce task result ownership

internal/database/asset.go

@@ -135,8 +135,10 @@ func normalizeAsset(a *Asset) {
 	if strings.Contains(a.Host, "://") {
 		if parsed, err := url.Parse(a.Host); err == nil && parsed.Hostname() != "" && parsed.User == nil {
 			hostname := strings.Trim(strings.ToLower(parsed.Hostname()), "[]")
-			if net.ParseIP(hostname) != nil && a.IP == "" {
-				a.IP = hostname
+			if net.ParseIP(hostname) != nil {
+				if a.IP == "" {
+					a.IP = hostname
+				}
 			} else if a.Domain == "" {
 				if ascii, err := idna.Lookup.ToASCII(hostname); err == nil {
 					a.Domain = strings.ToLower(ascii)

internal/database/asset_test.go

@@ -447,3 +447,25 @@ func TestAssetListFlexibleFiltersAndOldestScanPagination(t *testing.T) {
 		t.Fatalf("structured filters: total=%d assets=%#v err=%v", total, filtered, err)
 	}
 }
+
+func TestAssetIPURLWithPrefilledIPDoesNotBecomeDomain(t *testing.T) {
+	db, err := NewDB(filepath.Join(t.TempDir(), "ip-url.db"), zap.NewNop())
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer db.Close()
+	cases := []*Asset{
+		{Host: "http://192.168.200.100:18081", IP: "192.168.200.100", Port: 18081, Protocol: "http"},
+		{Host: "http://[2001:db8::1]:18081", IP: "2001:db8::1", Port: 18081, Protocol: "http"},
+		{Host: "http://192.0.2.1:18081"},
+	}
+	for _, a := range cases {
+		result, err := db.UpsertAssets([]*Asset{a}, "")
+		if err != nil || result.Created != 1 {
+			t.Fatalf("rejected IP URL: %#v %v", result, err)
+		}
+		if a.Domain != "" || a.IP == "" || a.Port != 18081 {
+			t.Fatalf("wrong structured fields: %#v", a)
+		}
+	}
+}