From 57041feefdc7edd658a5e3844812f785f4f9cbfd Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Matej=20Ba=C4=8Do?= <matejbaco2000@gmail.com>
Date: Tue, 21 Apr 2026 10:19:38 +0200
Subject: [PATCH] Allowlist support

---
 app/controllers/shared/api.php                   | 16 +++++++++++++++-
 .../Modules/Proxy/Http/Rules/Site/Create.php     |  7 +++++++
 2 files changed, 22 insertions(+), 1 deletion(-)

diff --git a/app/controllers/shared/api.php b/app/controllers/shared/api.php
index bba00bede1..9a1ca6e8cd 100644
--- a/app/controllers/shared/api.php
+++ b/app/controllers/shared/api.php
@@ -944,7 +944,21 @@ Http::shutdown()
              */
             $pattern = $route->getLabel('audits.payload', true);
             if (! empty($pattern)) {
-                $auditContext->payload = $responsePayload;
+                $pattern = $route->getLabel('audits.payload.allowList', []);
+                if(empty($pattern)) {
+                    $auditContext->payload = $responsePayload;
+                } else {
+                    $auditContextPayload = [];
+                    
+                    foreach ($pattern as $key) {
+                        if (isset($responsePayload[$key])) {
+                            $auditContextPayload[$key] = $responsePayload[$key];
+                        }
+                    }
+                    
+                    $auditContext->payload = $auditContextPayload;
+                }
+                
             }
 
             $publisherForAudits->enqueue(AuditMessage::fromContext($auditContext));
diff --git a/src/Appwrite/Platform/Modules/Proxy/Http/Rules/Site/Create.php b/src/Appwrite/Platform/Modules/Proxy/Http/Rules/Site/Create.php
index a9dfa93a49..ea4cdbecf6 100644
--- a/src/Appwrite/Platform/Modules/Proxy/Http/Rules/Site/Create.php
+++ b/src/Appwrite/Platform/Modules/Proxy/Http/Rules/Site/Create.php
@@ -43,6 +43,13 @@ class Create extends Action
             ->label('event', 'rules.[ruleId].create')
             ->label('audits.event', 'rule.create')
             ->label('audits.resource', 'rule/{response.$id}')
+            ->label('audits.payload', true)
+            ->label('audits.payload.allowList', [
+                'domain', 'type', 'region', 'trigger', // Generic config
+                'deploymentId', 'deploymentInternalId', // Deployment congif
+                'deploymentResourceInternalId', 'deploymentResourceId', 'deploymentResourceType', // Site / Function config
+                'redirectUrl', 'redirectStatusCode', // Redirect config
+            ])
             ->label('sdk', new Method(
                 namespace: 'proxy',
                 group: null,