[oleksandr-nc]

AppAPI sends HaRP the routes of each ExApp so HaRP can check the access level of requests to /exapps/..., but it left out the route's verb. The PHP proxy uses the first route that matches both the path and the verb, while HaRP can only match the path, so an ExApp that declares the same URL with different verbs and access levels is handled differently on the two paths.

The routes sent to HaRP now include verb, in the comma-separated form AppAPI stores. No HaRP release rejects unknown fields, so this changes nothing until HaRP starts using it. A unit test covers the route list sent to HaRP.

[oleksandr-nc]

/backport to stable35

[oleksandr-nc]

/backport to stable34

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: d91cb079-97fe-40dc-8ac1-3edc9c7324c3

📥 Commits

Reviewing files that changed from the base of the PR and between dc49d26 and 3b3931d.

📒 Files selected for processing: 2

• lib/Service/HarpService.php
• tests/php/Service/HarpServiceTest.php

Included review availability: This review used your included allowance. Your plan provides up to 2 included reviews per hour; 1 remain after this review.

📝 Walkthrough

getHarpExApp now includes each route’s HTTP method in its serialized payload. A new PHPUnit test checks GET and POST routes that share a URL, including their access levels and decoded brute-force protection values.

Priority: ⬇️ Low

Merge Risk: ⚪ Minimal · up to 3b393

No merge-blocking issue is identified for the route-verb payload change; normal validation can proceed.

Pre-merge checks: 4 · 1

Failed checks: 1 warning

Check name	Status	Explanation	Resolution
Docstring Coverage		Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 2 functions across 2 files.	Write docstrings for the functions missing them to satisfy the coverage threshold.

Passed checks: 4 passed

Check name	Status	Explanation
Title check		The title clearly and concisely describes the main change: sending each route verb to HaRP.
Description check		The description directly explains the route verb omission, the proxy and HaRP behavior, the compatibility impact, and the added test.
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

• Fix all pre-merge checks with AI

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Warning

Some tools did not complete. Review the errors below.

🔧 PHPStan (2.2.16)

PHPStan reported 1 non-file analysis error(s); analysis is incomplete

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}