From 3b3931d86b56b4108f01471bb052bcdbb5eae57e Mon Sep 17 00:00:00 2001
From: Oleksandr Piskun <oleksandr2088@icloud.com>
Date: Tue, 20 Oct 2026 13:55:38 +0000
Subject: [PATCH] fix(harp): send the route verb to HaRP

Signed-off-by: Oleksandr Piskun <oleksandr2088@icloud.com>
---
 lib/Service/HarpService.php           |  1 +
 tests/php/Service/HarpServiceTest.php | 44 +++++++++++++++++++++++++++
 2 files changed, 45 insertions(+)
 create mode 100644 tests/php/Service/HarpServiceTest.php

diff --git a/lib/Service/HarpService.php b/lib/Service/HarpService.php
index f473a8f0b..d4b366919 100644
--- a/lib/Service/HarpService.php
+++ b/lib/Service/HarpService.php
@@ -119,6 +119,7 @@ public function getHarpExApp(ExApp $exApp): array {
 			'routes' => array_map(function ($route) {
 				return [
 					'url' => $route['url'],
+					'verb' => $route['verb'],
 					'access_level' => $route['access_level'],
 					'bruteforce_protection' => ExAppMapper::parseJsonList($route['bruteforce_protection'] ?? null),
 				];
diff --git a/tests/php/Service/HarpServiceTest.php b/tests/php/Service/HarpServiceTest.php
new file mode 100644
index 000000000..aa7035577
--- /dev/null
+++ b/tests/php/Service/HarpServiceTest.php
@@ -0,0 +1,44 @@
+<?php
+
+declare(strict_types=1);
+
+/**
+ * SPDX-FileCopyrightText: 2026 Nextcloud GmbH and Nextcloud contributors
+ * SPDX-License-Identifier: AGPL-3.0-or-later
+ */
+
+namespace OCA\AppAPI\Tests\php\Service;
+
+use OCA\AppAPI\Db\ExApp;
+use OCA\AppAPI\Service\HarpService;
+use OCP\ICertificateManager;
+use OCP\IConfig;
+use OCP\Security\ICrypto;
+use PHPUnit\Framework\TestCase;
+use Psr\Log\LoggerInterface;
+
+class HarpServiceTest extends TestCase {
+
+	public function testGetHarpExAppSendsTheRouteVerbs(): void {
+		$harpService = new HarpService(
+			$this->createMock(LoggerInterface::class),
+			$this->createMock(IConfig::class),
+			$this->createMock(ICertificateManager::class),
+			$this->createMock(ICrypto::class),
+		);
+		// One URL with a public GET and an admin-only POST: HaRP needs the verbs to tell the two routes apart.
+		$exApp = new ExApp([
+			'appid' => 'test-deploy',
+			'deploy_config' => [],
+			'routes' => [
+				['url' => '^/settings$', 'verb' => 'GET', 'access_level' => 0, 'headers_to_exclude' => '[]', 'bruteforce_protection' => '[]'],
+				['url' => '^/settings$', 'verb' => 'POST', 'access_level' => 2, 'headers_to_exclude' => '[]', 'bruteforce_protection' => '[401]'],
+			],
+		]);
+
+		self::assertSame([
+			['url' => '^/settings$', 'verb' => 'GET', 'access_level' => 0, 'bruteforce_protection' => []],
+			['url' => '^/settings$', 'verb' => 'POST', 'access_level' => 2, 'bruteforce_protection' => [401]],
+		], $harpService->getHarpExApp($exApp)['routes']);
+	}
+}