fix: reject unlisted HTTP methods on multi-method PAT action routes

Author: nicktrn

apps/webapp/app/routes/api.v1.orgs.$orgParam.ts

@@ -13,10 +13,12 @@ const RenameOrgRequestBody = z.object({
   title: z.string().min(1),
 });
 
-// Multi-method (PATCH rename / DELETE), so no `method` and no builder body
-// schema — the handler branches and parses the PATCH body itself.
+// Multi-method (PATCH rename / DELETE): declare both so other verbs 405, and
+// the handler branches. No builder body schema — DELETE has none, so the PATCH
+// branch parses its own body.
 export const action = createActionPATApiRoute(
   {
+    method: ["PATCH", "DELETE"],
     params: ParamsSchema,
     // Resolve the org (id only, no membership) so the plugin can compute the
     // caller's role floor for the manage:organization gate below.

apps/webapp/app/routes/api.v1.projects.$projectRef.ts

@@ -69,10 +69,12 @@ const RenameProjectRequestBody = z.object({
   name: z.string().min(1),
 });
 
-// Multi-method (PATCH rename / DELETE), so no `method` and no builder body
-// schema — the handler branches and parses the PATCH body itself.
+// Multi-method (PATCH rename / DELETE): declare both so other verbs 405, and
+// the handler branches. No builder body schema — DELETE has none, so the PATCH
+// branch parses its own body.
 export const action = createActionPATApiRoute(
   {
+    method: ["PATCH", "DELETE"],
     params: ParamsSchema,
     // Resolve the org (id only, no membership) so the plugin can compute the
     // caller's role floor for the manage:project gate below.

apps/webapp/app/services/routeBuilders/apiBuilder.server.ts

@@ -644,13 +644,16 @@ export function createLoaderPATApiRoute<
 // can raise typed 4xx errors instead of the route string-matching messages.
 // Deliberately self-contained (not sharing internals with the loader) so
 // existing PAT loader routes are untouched.
+type PATActionMethod = "POST" | "PUT" | "DELETE" | "PATCH";
+
 type PATActionRouteBuilderOptions<
   TParamsSchema extends AnyZodSchema | undefined = undefined,
   TSearchParamsSchema extends AnyZodSchema | undefined = undefined,
   THeadersSchema extends AnyZodSchema | undefined = undefined,
   TBodySchema extends AnyZodSchema | undefined = undefined,
 > = PATRouteBuilderOptions<TParamsSchema, TSearchParamsSchema, THeadersSchema> & {
-  method?: "POST" | "PUT" | "DELETE" | "PATCH";
+  // A single verb, or a list for multi-method routes (e.g. ["PATCH", "DELETE"]).
+  method?: PATActionMethod | PATActionMethod[];
   body?: TBodySchema;
 };
 
@@ -710,10 +713,14 @@ export function createActionPATApiRoute<
       return apiCors(request, json({}));
     }
 
-    if (method && request.method.toUpperCase() !== method) {
+    const allowedMethods = method ? (Array.isArray(method) ? method : [method]) : undefined;
+    if (allowedMethods && !(allowedMethods as string[]).includes(request.method.toUpperCase())) {
       return await wrapResponse(
         request,
-        json({ error: "Method not allowed" }, { status: 405, headers: { Allow: method } }),
+        json(
+          { error: "Method not allowed" },
+          { status: 405, headers: { Allow: allowedMethods.join(", ") } }
+        ),
         corsStrategy !== "none"
       );
     }

apps/webapp/test/auth-api.e2e.full.test.ts

@@ -3036,4 +3036,20 @@ describe("API", () => {
       expect(res.status).toBe(400);
     });
   });
+
+  // Multi-method PAT action routes declare their allowed verbs, so a verb they
+  // don't handle (e.g. POST on a PATCH/DELETE route) is rejected rather than
+  // falling through to the rename branch.
+  describe("Multi-method routes reject other verbs", () => {
+    it("POST to the org rename/delete route: 405", async () => {
+      const server = getTestServer();
+      const { organization, pat } = await seedTestUserProject(server.prisma);
+      const res = await server.webapp.fetch(`/api/v1/orgs/${organization.id}`, {
+        method: "POST",
+        headers: { Authorization: `Bearer ${pat.token}`, "Content-Type": "application/json" },
+        body: JSON.stringify({ title: "New name" }),
+      });
+      expect(res.status).toBe(405);
+    });
+  });
 });