feat: support the HTTP QUERY method (RFC 10008)

[indrekj]

What

Adds QUERY to the METHODS bitmask table so routes can match on it.

RFC 10008 (Proposed Standard) defines QUERY as a safe and idempotent request method that carries the query in the request content instead of the URI. It is intended for queries that do not fit a URI well — large filter expressions, or ones containing values that should not land in access logs, browser history or Referer headers — while keeping GET's semantics (cacheable, transparently retryable), which the usual POST-based workaround gives up.

Today the method cannot be routed:

• rx:match("/aa", {method = "QUERY"}) never matches a route that restricts methods, because METHODS["QUERY"] is nil and the type check at radixtree.lua:721 fails.
• radix.new{{paths = {"/aa"}, methods = {"QUERY"}}} errors at radixtree.lua:425 — bit.bor on a nil bitmask.

Routes that omit methods already match any method token, so this only affects method-restricted routes.

QUERY is appended to the end of the list, so the bitmask values of existing methods are unchanged.

This is the same shape of change as #115, which added PURGE (released in v2.8.2).

Tests

t/sanity.t TEST 11 mirrors the existing PURGE test (TEST 10): a route restricted to QUERY matches a QUERY request and nothing else. The following Iterator test is renumbered 11 → 12.

Drive-by doc fix

The methods row in README's route-options table listed valid values as GET, POST, PUT, DELETE, PATCH, HEAD, OPTIONS, CONNECT, TRACE — it never picked up PURGE. Updated to match the code, including QUERY.

Downstream note

Apache APISIX validates route methods against the same list in apisix/schema_def.lua, so adding QUERY there depends on a release containing this change (its rockspec pins lua-resty-radixtree). Happy to follow up on the APISIX side once this lands.

Summary by CodeRabbit

• New Features
  • Added support for the QUERY HTTP method in route matching.
  • Routes can now distinguish QUERY requests from other methods, including nested paths.
  • Documented PURGE and QUERY among the valid HTTP methods for routes.
• Tests
  • Added coverage verifying correct QUERY matching behavior and preventing unintended matches for other methods or paths.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 03208c08-850e-4ee0-9547-34277026b589

📥 Commits

Reviewing files that changed from the base of the PR and between 8166eea and 9b2a77e.

📒 Files selected for processing (3)

• README.md
• lib/resty/radixtree.lua
• t/sanity.t

---

📝 Walkthrough

Walkthrough

The documented route methods now include PURGE and QUERY. The radixtree recognizes QUERY in its method bitmask. A sanity test validates exact /aa matching and rejects /aa/bb and GET requests.

Changes

HTTP method support

Layer / File(s)	Summary
QUERY method matching and validation lib/resty/radixtree.lua, t/sanity.t, README.md	The radixtree recognizes QUERY. Sanity coverage verifies path and method filtering. The route documentation lists PURGE and QUERY.

Estimated code review effort: 1 (Trivial) | ~5 minutes

🚥 Pre-merge checks | ✅ 6

✅ Passed checks (6 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: adding support for the HTTP QUERY method.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
E2e Test Quality Review	✅ Passed	The OpenResty/Test::Nginx test exercises radix.new and rx:match end to end, with clear assertions for QUERY, path, and method mismatches; the code change is scoped and race-free.
Security Check	✅ Passed	The patch only appends QUERY to the route bitmask and updates docs/tests; it changes no logging, response, storage, authorization, ownership, TLS, shared-resource, or secret-resolution code.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[CLAassistant]

All committers have signed the CLA.