[bugfix] http-client: honor http:body/@method for inline body serialization

The native EXPath HTTP Client ignored the @method attribute on http:body, so an
inline body could only be XML-serialized or sent as text -- a binary/base64/hex
inline body could not be sent at all (only http:body/@src, added in eXist-db#6510/eXist-db#6511,
delivered raw bytes). RequestBuilder now honors @method (EXPath HTTP Client 3.1):

- binary / base64: the body's content is base64-decoded and sent as raw bytes.
- hex: the content is hex-decoded and sent as raw bytes.
- text: the content's string value is sent (an element child is serialized as
  its text, not its markup).
- xml / xhtml / html (or no @method): unchanged -- child elements are
  XML-serialized as before.

Malformed base64/hex content raises err:HC005. The string value of body content
is computed by an explicit recursive walk, because the in-memory DOM's
getTextContent does not recurse into element children of a constructed http:body.

Multipart-part @method, JSON/adaptive serialization, and multiple external
$bodies remain follow-ups (eXist-db#6512).

SendRequestFunctionTest gains bodyMethodBinarySendsDecodedBytes,
bodyMethodHexSendsDecodedBytes, and bodyMethodTextSerializesAsText.

Part of eXist-db#6512

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: joewiz

extensions/modules/http-client/src/main/java/org/exist/xquery/modules/httpclient/RequestBuilder.java

@@ -54,6 +54,7 @@
 import java.util.ArrayList;
 import java.util.Base64;
 import java.util.HashMap;
+import java.util.HexFormat;
 import java.util.List;
 import java.util.Map;
 
@@ -84,6 +85,7 @@ public class RequestBuilder {
     private String bodyContent;
     private String bodySrc;
     private byte[] bodyResourceBytes;
+    private String bodyMethod;
     private String multipartMediaType;
     private final List<BodyPart> multipartBodies = new ArrayList<>();
 
@@ -143,8 +145,12 @@ private void parseBody(final Element bodyElem) throws XPathException {
         bodyMediaType = bodyElem.getAttribute("media-type");
         bodySrc = getAttr(bodyElem, "src");
         if (bodySrc == null) {
-            // Body content is the text/XML content of the body element
-            bodyContent = getBodyContent(bodyElem);
+            bodyMethod = getAttr(bodyElem, "method");
+            // For binary/base64/hex/text the body is the string value of the content (the base64/hex
+            // lexical, or the text serialization; decoded as needed in applyBody); for xml/xhtml/html
+            // (or no @method) the child elements are XML-serialized.
+            bodyContent = isRawContentMethod(bodyMethod)
+                    ? stringValue(bodyElem) : getBodyContent(bodyElem);
             return;
         }
         if (hasNonWhitespaceContent(bodyElem)) {
@@ -326,7 +332,7 @@ private void applyAuthorization(final HttpRequest.Builder builder, final String
         }
     }
 
-    private void applyBody(final HttpRequest.Builder builder, final String upperMethod, final boolean isMultipart) {
+    private void applyBody(final HttpRequest.Builder builder, final String upperMethod, final boolean isMultipart) throws XPathException {
         if (isMultipart) {
             applyMultipartBody(builder, upperMethod);
         } else if (bodyResourceBytes != null) {
@@ -350,6 +356,35 @@ private void applyResourceBody(final HttpRequest.Builder builder, final String u
         builder.method(upperMethod, HttpRequest.BodyPublishers.ofByteArray(bodyResourceBytes));
     }
 
+    /**
+     * The http:body @method values whose content is sent as raw bytes (binary/base64/hex) or as a
+     * plain string (text), rather than XML-serialized.
+     */
+    private static boolean isRawContentMethod(final String method) {
+        return "binary".equals(method) || "base64".equals(method)
+                || "hex".equals(method) || "text".equals(method);
+    }
+
+    /**
+     * The string value of an element: the concatenation of all descendant text, computed explicitly
+     * because the in-memory DOM's getTextContent does not recurse into element children for a
+     * constructed http:body.
+     */
+    private static String stringValue(final Node node) {
+        final StringBuilder sb = new StringBuilder();
+        final NodeList children = node.getChildNodes();
+        for (int i = 0; i < children.getLength(); i++) {
+            final Node child = children.item(i);
+            final short type = child.getNodeType();
+            if (type == Node.TEXT_NODE || type == Node.CDATA_SECTION_NODE) {
+                sb.append(child.getNodeValue());
+            } else if (type == Node.ELEMENT_NODE) {
+                sb.append(stringValue(child));
+            }
+        }
+        return sb.toString();
+    }
+
     /**
      * Multipart request body, built with Methanol's MultipartBodyPublisher (the JDK client has no
      * multipart support). Each http:body part becomes a part with its own Content-Type.
@@ -373,19 +408,44 @@ private void applyMultipartBody(final HttpRequest.Builder builder, final String
         builder.method(upperMethod, publisher);
     }
 
-    private void applySingleBody(final HttpRequest.Builder builder, final String upperMethod) {
-        final Charset charset = bodyMediaType != null
-                ? Charset.forName(ContentTypeHelper.extractCharset(bodyMediaType))
-                : StandardCharsets.UTF_8;
-        final HttpRequest.BodyPublisher bodyPublisher =
-                HttpRequest.BodyPublishers.ofString(bodyContent, charset);
+    private void applySingleBody(final HttpRequest.Builder builder, final String upperMethod) throws XPathException {
+        final HttpRequest.BodyPublisher bodyPublisher = bodyPublisherForMethod();
         // Set Content-Type if not already set via headers
         if (bodyMediaType != null && headers.stream().noneMatch(h -> "Content-Type".equalsIgnoreCase(h[0]))) {
             builder.header("Content-Type", bodyMediaType);
         }
         builder.method(upperMethod, bodyPublisher);
     }
 
+    /**
+     * Builds the body publisher for a single (non-multipart) body, honoring http:body/@method (EXPath
+     * HTTP Client 3.1). {@code binary}/{@code base64} decode the body's text content from base64 and
+     * {@code hex} from hexadecimal -- both sent as raw bytes; {@code text}/{@code xml}/{@code xhtml}/
+     * {@code html} (or no @method) are sent as a string in the media-type's charset (default UTF-8).
+     */
+    private HttpRequest.BodyPublisher bodyPublisherForMethod() throws XPathException {
+        if ("binary".equals(bodyMethod) || "base64".equals(bodyMethod)) {
+            try {
+                return HttpRequest.BodyPublishers.ofByteArray(Base64.getMimeDecoder().decode(bodyContent.strip()));
+            } catch (final IllegalArgumentException e) {
+                throw new XPathException((org.exist.xquery.Expression) null, HttpClientModule.HC005,
+                        "http:body with method='" + bodyMethod + "' requires base64-encoded content: " + e.getMessage());
+            }
+        }
+        if ("hex".equals(bodyMethod)) {
+            try {
+                return HttpRequest.BodyPublishers.ofByteArray(HexFormat.of().parseHex(bodyContent.strip()));
+            } catch (final IllegalArgumentException e) {
+                throw new XPathException((org.exist.xquery.Expression) null, HttpClientModule.HC005,
+                        "http:body with method='hex' requires hexadecimal content: " + e.getMessage());
+            }
+        }
+        final Charset charset = bodyMediaType != null
+                ? Charset.forName(ContentTypeHelper.extractCharset(bodyMediaType))
+                : StandardCharsets.UTF_8;
+        return HttpRequest.BodyPublishers.ofString(bodyContent, charset);
+    }
+
     /**
      * Whether a 401 response should be answered with credentials (EXPath challenge-response):
      * credentials and an auth method are present but were not sent preemptively (because

extensions/modules/http-client/src/test/java/org/exist/xquery/modules/httpclient/SendRequestFunctionTest.java

@@ -816,6 +816,56 @@ public void bodySrcWithoutMediaTypeThrowsHC005() {
                 .withStackTraceContaining("HC005");
     }
 
+    /**
+     * http:body/@method='binary' decodes the body's base64 text content and sends the raw bytes
+     * (EXPath HTTP Client 3.1 serialization method). base64('hello') = 'aGVsbG8='.
+     */
+    @Test
+    public void bodyMethodBinarySendsDecodedBytes() throws XMLDBException {
+        final ResourceSet result = existEmbeddedServer.executeQuery(
+                HTTP_NS +
+                "let $response := http:send-request(\n" +
+                "  <http:request method='POST' href='" + baseUrl() + "/echo'>\n" +
+                "    <http:body media-type='application/octet-stream' method='binary'>aGVsbG8=</http:body>\n" +
+                "  </http:request>)\n" +
+                "return parse-json($response[2])?body");
+        assertEquals("method='binary' should base64-decode the body to raw bytes",
+                "hello", result.getResource(0).getContent().toString());
+    }
+
+    /**
+     * http:body/@method='hex' decodes the body's hexadecimal text content. hex('hi') = '6869'.
+     */
+    @Test
+    public void bodyMethodHexSendsDecodedBytes() throws XMLDBException {
+        final ResourceSet result = existEmbeddedServer.executeQuery(
+                HTTP_NS +
+                "let $response := http:send-request(\n" +
+                "  <http:request method='POST' href='" + baseUrl() + "/echo'>\n" +
+                "    <http:body media-type='application/octet-stream' method='hex'>6869</http:body>\n" +
+                "  </http:request>)\n" +
+                "return parse-json($response[2])?body");
+        assertEquals("method='hex' should hex-decode the body to raw bytes",
+                "hi", result.getResource(0).getContent().toString());
+    }
+
+    /**
+     * http:body/@method='text' serializes element content as text (its string value), not as XML --
+     * so a child element is sent as its text, not its markup.
+     */
+    @Test
+    public void bodyMethodTextSerializesAsText() throws XMLDBException {
+        final ResourceSet result = existEmbeddedServer.executeQuery(
+                HTTP_NS +
+                "let $response := http:send-request(\n" +
+                "  <http:request method='POST' href='" + baseUrl() + "/echo'>\n" +
+                "    <http:body media-type='text/plain' method='text'><a>x</a></http:body>\n" +
+                "  </http:request>)\n" +
+                "return parse-json($response[2])?body");
+        assertEquals("method='text' should send the element's string value, not its markup",
+                "x", result.getResource(0).getContent().toString());
+    }
+
     @Test
     public void putMethod() throws XMLDBException {
         final ResourceSet result = existEmbeddedServer.executeQuery(