feat: Add HTTP method filtering to resource rules #453

New Issue

MrUnknownDE · 2026-04-05T17:10:54+02:00

MrUnknownDE commented

2026-04-05 17:10:54 +02:00

Originally created by @djcrafts on 12/21/2025

Summary

Implements HTTP method filtering for resource rules as requested in #1408.

This allows users to create fine-grained access control policies based on HTTP verbs, enabling scenarios like:

Public GET access for reading data
Authenticated POST/PUT/DELETE for mutations
Different policies for different HTTP methods on the same path

Changes

Backend

Database Schema: Added optional method column to resourceRules table (SQLite and PostgreSQL)
API Endpoints: Updated create, update, and list rule endpoints to accept/return method field
Rule Engine: Modified checkRules function to filter rules by HTTP method
Blueprint Support: Added method field to YAML-based configuration

Frontend

Rules Table: Added HTTP Method column with dropdown selector
Add Rule Form: Added method selector (GET, POST, PUT, DELETE, PATCH, HEAD, OPTIONS)
Translations: Added UI labels for HTTP method field

Backward Compatibility

No breaking changes: Method field is optional
Existing rules continue to work: NULL/undefined method matches all HTTP methods
Safe database migration: Adding nullable column

Example Usage

// Public read access
{
  match: "PATH",
  value: "/api/items",
  method: "GET",
  action: "ACCEPT",
  priority: 1
}

// Require authentication for mutations
{
  match: "PATH",
  value: "/api/items",
  method: "POST",
  action: "PASS",
  priority: 2
}

Closes

Fixes #1408

*Originally created by @djcrafts on 12/21/2025* ## Summary Implements HTTP method filtering for resource rules as requested in #1408. This allows users to create fine-grained access control policies based on HTTP verbs, enabling scenarios like: - Public GET access for reading data - Authenticated POST/PUT/DELETE for mutations - Different policies for different HTTP methods on the same path ## Changes ### Backend - **Database Schema**: Added optional `method` column to `resourceRules` table (SQLite and PostgreSQL) - **API Endpoints**: Updated create, update, and list rule endpoints to accept/return method field - **Rule Engine**: Modified `checkRules` function to filter rules by HTTP method - **Blueprint Support**: Added method field to YAML-based configuration ### Frontend - **Rules Table**: Added HTTP Method column with dropdown selector - **Add Rule Form**: Added method selector (GET, POST, PUT, DELETE, PATCH, HEAD, OPTIONS) - **Translations**: Added UI labels for HTTP method field ## Backward Compatibility - No breaking changes: Method field is optional - Existing rules continue to work: NULL/undefined method matches all HTTP methods - Safe database migration: Adding nullable column ## Example Usage ```javascript // Public read access { match: "PATH", value: "/api/items", method: "GET", action: "ACCEPT", priority: 1 } // Require authentication for mutations { match: "PATH", value: "/api/items", method: "POST", action: "PASS", priority: 2 } ``` ## Closes Fixes #1408

Sign in to join this conversation.

Branches Tags

main

dev

dependabot/npm_and_yarn/dev-minor-updates-b4e5d6b9c5

revert-2766-feature/systemd-install-instructions

dependabot/npm_and_yarn/prod-patch-updates-05702d39f2

dependabot/npm_and_yarn/next-16.2.1

dependabot/npm_and_yarn/recharts-3.8.1

alerting-rules

private-site-ha

dependabot/docker/docker/library/node-25-slim

ssh

delete-account

msg-delivery

org-only-idp

cicd

patch

site-targets-auto-login

No Label

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github/pangolin#453