From adeb393fb03246b42f7551b1ed291acfae0a5f83 Mon Sep 17 00:00:00 2001
From: Blacks-Army <104644957+Blacks-Army@users.noreply.github.com>
Date: Sat, 5 Sep 2026 11:10:21 +0200
Subject: [PATCH 1/2] Add HTTP method matching to resource rules

A rule with match "METHOD" carries a comma-separated list of HTTP
methods in its value, e.g. "POST,PUT", and applies when the request
method is in that list.
---
 server/routers/badger/verifySession.ts | 21 +++++++++++++++++++--
 1 file changed, 19 insertions(+), 2 deletions(-)

diff --git a/server/routers/badger/verifySession.ts b/server/routers/badger/verifySession.ts
index eb7a296..3b8a13a 100644
--- a/server/routers/badger/verifySession.ts
+++ b/server/routers/badger/verifySession.ts
@@ -113,6 +113,7 @@ export async function verifyResourceSession(
             path,
             headers,
             query,
+            method,
             badgerVersion
         } = parsedBody.data;
 
@@ -236,7 +237,8 @@ export async function verifyResourceSession(
                 clientIp,
                 path,
                 ipCC,
-                ipAsn
+                ipAsn,
+                method
             );
 
             if (action === "ACCEPT") {
@@ -1206,7 +1208,8 @@ async function checkRules(
     clientIp: string | undefined,
     path: string | undefined,
     ipCC?: string,
-    ipAsn?: number
+    ipAsn?: number,
+    method?: string
 ): Promise<"ACCEPT" | "DROP" | "PASS" | undefined> {
     const ruleCacheKey = `rules:${resourceId}`;
 
@@ -1278,12 +1281,26 @@ async function checkRules(
             (await isIpInRegion(ipCC, rule.value))
         ) {
             return rule.action as any;
+        } else if (
+            method &&
+            rule.match === "METHOD" &&
+            isMethodAllowed(rule.value, method)
+        ) {
+            return rule.action as any;
         }
     }
 
     return;
 }
 
+// rule.value holds a comma-separated list of HTTP methods, e.g. "POST,PUT".
+function isMethodAllowed(ruleValue: string, method: string): boolean {
+    const requestMethod = method.toUpperCase();
+    return ruleValue
+        .split(",")
+        .some((ruleMethod) => ruleMethod.trim().toUpperCase() === requestMethod);
+}
+
 // Decodes percent-encoding (so an encoded slash like `%2F` is treated as a
 // real path separator, matching what most backends will do) and then
 // resolves `.` / `..` segments, so a request like `/public%2F..%2Fadmin/`

From 91b25c2e4542c00c28234d80c052dd55f3a42766 Mon Sep 17 00:00:00 2001
From: Blacks-Army <104644957+Blacks-Army@users.noreply.github.com>
Date: Sat, 19 Sep 2026 20:11:20 +0200
Subject: [PATCH 2/2] Trigger CI