[PR #2131] feat: Add HTTP method filtering to resource rules #2875

New Issue

2026-04-16T09:39:38-05:00

GiteaMirror commented

2026-04-16 09:39:38 -05:00

📋 Pull Request Information

Original PR: https://github.com/fosrl/pangolin/pull/2131
Author: @djcrafts
Created: 12/21/2025
Status: 🔄 Open

Base: main ← Head: feature/http-verb-rules

📝 Commits (3)

355da6a feat: add HTTP method filtering to resource rules
c946da6 rules: add multi-condition AND support\n- Schema: add optional JSON 'conditions'; allow nullable 'match'/'value'\n- APIs: accept/validate conditions in create/update; JSON encode\n- Engine: evaluate method + all conditions (AND); null guards\n- UI: handle nullable fields in rules page\n- Tests: standalone rulesEval helpers; basic path/conditions tests
2b3c902 fix: legend/tooltip typings for analytics chart

📊 Changes

14 files changed (+541 additions, -71 deletions)

View changed files

📝 messages/en-US.json (+3 -0)
📝 server/db/pg/schema/schema.ts (+6 -2)
📝 server/db/sqlite/schema/schema.ts (+6 -2)
📝 server/lib/blueprints/proxyResources.ts (+6 -3)
📝 server/lib/blueprints/types.ts (+2 -1)
➕ server/lib/rulesEval.ts (+101 -0)
📝 server/routers/badger/verifySession.ts (+94 -4)
📝 server/routers/resource/createResourceRule.ts (+107 -36)
📝 server/routers/resource/listResourceRules.ts (+2 -1)
📝 server/routers/resource/updateResourceRule.ts (+60 -4)
📝 src/app/[orgId]/settings/resources/proxy/[niceId]/rules/page.tsx (+78 -8)
📝 src/components/LogAnalyticsData.tsx (+8 -1)
📝 src/components/ui/chart.tsx (+12 -9)
➕ test/rules.test.ts (+56 -0)

📄 Description

Summary

Implements HTTP method filtering for resource rules as requested in #1408.

This allows users to create fine-grained access control policies based on HTTP verbs, enabling scenarios like:

Public GET access for reading data
Authenticated POST/PUT/DELETE for mutations
Different policies for different HTTP methods on the same path

Changes

Backend

Database Schema: Added optional method column to resourceRules table (SQLite and PostgreSQL)
API Endpoints: Updated create, update, and list rule endpoints to accept/return method field
Rule Engine: Modified checkRules function to filter rules by HTTP method
Blueprint Support: Added method field to YAML-based configuration

Frontend

Rules Table: Added HTTP Method column with dropdown selector
Add Rule Form: Added method selector (GET, POST, PUT, DELETE, PATCH, HEAD, OPTIONS)
Translations: Added UI labels for HTTP method field

Backward Compatibility

No breaking changes: Method field is optional
Existing rules continue to work: NULL/undefined method matches all HTTP methods
Safe database migration: Adding nullable column

Example Usage

// Public read access
{
  match: "PATH",
  value: "/api/items",
  method: "GET",
  action: "ACCEPT",
  priority: 1
}

// Require authentication for mutations
{
  match: "PATH",
  value: "/api/items",
  method: "POST",
  action: "PASS",
  priority: 2
}

Closes

Fixes #1408

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/fosrl/pangolin/pull/2131 **Author:** [@djcrafts](https://github.com/djcrafts) **Created:** 12/21/2025 **Status:** 🔄 Open **Base:** `main` ← **Head:** `feature/http-verb-rules` --- ### 📝 Commits (3) - [`355da6a`](https://github.com/fosrl/pangolin/commit/355da6a18e48c5b7e7bf0202f035dbdf5e24b1f5) feat: add HTTP method filtering to resource rules - [`c946da6`](https://github.com/fosrl/pangolin/commit/c946da6591351b6c4bdc584aab5413c68be50eea) rules: add multi-condition AND support\n- Schema: add optional JSON 'conditions'; allow nullable 'match'/'value'\n- APIs: accept/validate conditions in create/update; JSON encode\n- Engine: evaluate method + all conditions (AND); null guards\n- UI: handle nullable fields in rules page\n- Tests: standalone rulesEval helpers; basic path/conditions tests - [`2b3c902`](https://github.com/fosrl/pangolin/commit/2b3c902a89d25e1a2cb2428e4ce3e1ab0a06f180) fix: legend/tooltip typings for analytics chart ### 📊 Changes **14 files changed** (+541 additions, -71 deletions) <details> <summary>View changed files</summary> 📝 `messages/en-US.json` (+3 -0) 📝 `server/db/pg/schema/schema.ts` (+6 -2) 📝 `server/db/sqlite/schema/schema.ts` (+6 -2) 📝 `server/lib/blueprints/proxyResources.ts` (+6 -3) 📝 `server/lib/blueprints/types.ts` (+2 -1) ➕ `server/lib/rulesEval.ts` (+101 -0) 📝 `server/routers/badger/verifySession.ts` (+94 -4) 📝 `server/routers/resource/createResourceRule.ts` (+107 -36) 📝 `server/routers/resource/listResourceRules.ts` (+2 -1) 📝 `server/routers/resource/updateResourceRule.ts` (+60 -4) 📝 `src/app/[orgId]/settings/resources/proxy/[niceId]/rules/page.tsx` (+78 -8) 📝 `src/components/LogAnalyticsData.tsx` (+8 -1) 📝 `src/components/ui/chart.tsx` (+12 -9) ➕ `test/rules.test.ts` (+56 -0) </details> ### 📄 Description ## Summary Implements HTTP method filtering for resource rules as requested in #1408. This allows users to create fine-grained access control policies based on HTTP verbs, enabling scenarios like: - Public GET access for reading data - Authenticated POST/PUT/DELETE for mutations - Different policies for different HTTP methods on the same path ## Changes ### Backend - **Database Schema**: Added optional `method` column to `resourceRules` table (SQLite and PostgreSQL) - **API Endpoints**: Updated create, update, and list rule endpoints to accept/return method field - **Rule Engine**: Modified `checkRules` function to filter rules by HTTP method - **Blueprint Support**: Added method field to YAML-based configuration ### Frontend - **Rules Table**: Added HTTP Method column with dropdown selector - **Add Rule Form**: Added method selector (GET, POST, PUT, DELETE, PATCH, HEAD, OPTIONS) - **Translations**: Added UI labels for HTTP method field ## Backward Compatibility - No breaking changes: Method field is optional - Existing rules continue to work: NULL/undefined method matches all HTTP methods - Safe database migration: Adding nullable column ## Example Usage ```javascript // Public read access { match: "PATH", value: "/api/items", method: "GET", action: "ACCEPT", priority: 1 } // Require authentication for mutations { match: "PATH", value: "/api/items", method: "POST", action: "PASS", priority: 2 } ``` ## Closes Fixes #1408 --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

GiteaMirror added the pull-request label 2026-04-16 09:39:38 -05:00