[oleksandr-nc]

AppAPI's ExApp proxy reads the <verb> of a route with a substring check and refuses HEAD unless a route lists it, while HaRP (nextcloud/HaRP#149) reads the verb as a list of methods and accepts HEAD wherever GET is listed. So the same ExApp answered differently depending on whether a request went through the proxy or through HaRP: a HEAD to a page (link previews, monitors) got 404 from the proxy, and a verb written as GETPOST matched both GET and POST on the proxy but neither on HaRP.

Changes

• The proxy splits the verb of a route on commas and whitespace and compares whole methods, ignoring case. A verb with other separators, such as GET;POST, no longer matches by substring, so such a request is decided by a later route of the path, as on HaRP. No published ExApp writes its verbs like that.
• HEAD is accepted on routes that list GET. Nextcloud already routes HEAD to the proxy's GET action, which forwards it as GET.
• Tests for how the proxy picks a route.
• CHANGELOG entries for this change and for fix(harp): send the route verb to HaRP #1138, which sends the verb of each route to HaRP.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 05fbff05-0834-4b1c-b075-74e3a6f6c6e5

📥 Commits

Reviewing files that changed from the base of the PR and between c6f1660 and 2b868b8.

📒 Files selected for processing: 1

• tests/php/Controller/ExAppProxyControllerTest.php

Included review availability: This review used your included allowance. Your plan provides up to 2 included reviews per hour; 0 remain after this review.

📝 Walkthrough

The proxy now matches uppercased request methods against complete route verb tokens separated by commas or whitespace. It accepts HEAD for routes that list GET. The first matching path-and-method route and its access-level check remain. New tests cover route selection, access checks, HEAD, and mixed-case method lists. The changelog records related proxy and HaRP changes.

Priority: ➖ Normal

Merge Risk: ⚪ Minimal · up to 2b868

No actionable merge-blocking risk remains; the route-matching change is mergeable.

Pre-merge checks: 4 · 1

Failed checks: 1 warning

Check name	Status	Explanation	Resolution
Docstring Coverage		Docstring coverage is 25.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 8 functions across 2 files.	Write docstrings for the functions missing them to satisfy the coverage threshold.

Passed checks: 4 passed

Check name	Status	Explanation
Title check		The title names the main change: the ExApp proxy now matches route verbs the way HaRP does. It is short, specific, and follows the fix(scope) convention. The changeset splits verbs into whole methods,…
Description check		The description states the problem: the AppAPI proxy uses substring matching on route verbs and rejects HEAD, while HaRP treats verbs as a method list. It lists the changes (whole-method comparison, H…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Title check

Explanation

The title names the main change: the ExApp proxy now matches route verbs the way HaRP does. It is short, specific, and follows the fix(scope) convention. The changeset splits verbs into whole methods, ignores case, and accepts HEAD on GET routes, all of which match the title's intent.

Full details: Description check

Explanation

The description states the problem: the AppAPI proxy uses substring matching on route verbs and rejects HEAD, while HaRP treats verbs as a method list. It lists the changes (whole-method comparison, HEAD accepted on GET routes, new tests, and CHANGELOG entries), which match the raw summary and the PR objectives.

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Warning

Some tools did not complete. Review the errors below.

🔧 PHPStan (2.3.0)

PHPStan reported 1 non-file analysis error(s); analysis is incomplete

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}