fix(proxy): commit on first matching route by path and verb

fix(proxy): commit on first matching route by path and verb

Signed-off-by: Oleksander Piskun <oleksandr2088@icloud.com>

[skip ci]

Author: oleksandr-nc

lib/Controller/ExAppProxyController.php

@@ -316,7 +316,8 @@ private function passesExAppProxyRoutesChecks(ExApp $exApp, string $exAppRoute):
 				str_contains(strtolower($route['verb']), strtolower($this->request->getMethod())) &&
 				$this->passesExAppProxyRouteAccessLevelCheck($route['access_level'])
 			) {
-				return $route;
+				// First match by path+verb wins. Apply its access level without falling through to broader routes.
+				return $this->passesExAppProxyRouteAccessLevelCheck($route['access_level']) ? $route : [];
 			}
 		}
 		return [];

lib/Db/ExAppMapper.php

@@ -48,6 +48,7 @@ public function findAll(?int $limit = null, ?int $offset = null): array {
 			->leftJoin('a', 'ex_apps_daemons', 'd', $qb->expr()->eq('a.daemon_config_name', 'd.name'))
 			->leftJoin('a', 'ex_apps_routes', 'r', $qb->expr()->eq('a.appid', 'r.appid'))
 			->orderBy('a.appid', 'ASC')
+			->addOrderBy('r.id', 'ASC')
 			->setMaxResults($limit)
 			->setFirstResult($offset);
 		return $this->buildExAppWithRoutes($qb->executeQuery()->fetchAll());
@@ -80,6 +81,7 @@ public function findByAppId(string $appId): Entity {
 			->leftJoin('a', 'ex_apps_daemons', 'd', $qb->expr()->eq('a.daemon_config_name', 'd.name'))
 			->leftJoin('a', 'ex_apps_routes', 'r', $qb->expr()->eq('a.appid', 'r.appid'))
 			->orderBy('a.appid', 'ASC')
+			->addOrderBy('r.id', 'ASC')
 			->where(
 				$qb->expr()->eq('a.appid', $qb->createNamedParameter($appId))
 			);