Fix: Re-read request params at each hook/action call site

Dispatcher::execute hoisted \$this->request->getParams() into a local
before any init hooks fired, then passed that stale array to every
subsequent getArguments() call. That broke the init-hook-mutates-params
contract: if an init hook applied filter/rewrite via
\$request->setQueryString(), the route action and shutdown hooks would
still see the pre-mutation view.

The old Http::execute called \$request->getParams() inline at each call
site specifically to preserve this ordering. Restore that behaviour.

Adds two regression tests: init-hook mutation visible to the route
action, and init-hook mutation visible to a shutdown hook's params.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: loks0n

src/Http/Dispatcher.php

@@ -143,41 +143,45 @@ public function execute(RouteMatch $match): void
         $route = $match->route;
         $groups = $route->getGroups();
         $pathValues = $route->getPathValues($this->request, $match->preparedPath);
-        $requestParams = $this->request->getParams();
+
+        // Request params are re-read at each call site: init/request hooks
+        // may mutate the request (e.g. applying filters), and later hooks +
+        // the route action must see the updated view. Hoisting this into a
+        // local would cache stale params across the lifecycle.
 
         try {
             if ($route->getHook()) {
                 foreach (Hooks::$init as $hook) {
                     if (\in_array('*', $hook->getGroups())) {
-                        \call_user_func_array($hook->getAction(), $this->http->getArguments($hook, $pathValues, $requestParams));
+                        \call_user_func_array($hook->getAction(), $this->http->getArguments($hook, $pathValues, $this->request->getParams()));
                     }
                 }
             }
 
             foreach ($groups as $group) {
                 foreach (Hooks::$init as $hook) {
                     if (\in_array($group, $hook->getGroups())) {
-                        \call_user_func_array($hook->getAction(), $this->http->getArguments($hook, $pathValues, $requestParams));
+                        \call_user_func_array($hook->getAction(), $this->http->getArguments($hook, $pathValues, $this->request->getParams()));
                     }
                 }
             }
 
             if (!$this->response->isSent()) {
-                \call_user_func_array($route->getAction(), $this->http->getArguments($route, $pathValues, $requestParams));
+                \call_user_func_array($route->getAction(), $this->http->getArguments($route, $pathValues, $this->request->getParams()));
             }
 
             foreach ($groups as $group) {
                 foreach (Hooks::$shutdown as $hook) {
                     if (\in_array($group, $hook->getGroups())) {
-                        \call_user_func_array($hook->getAction(), $this->http->getArguments($hook, $pathValues, $requestParams));
+                        \call_user_func_array($hook->getAction(), $this->http->getArguments($hook, $pathValues, $this->request->getParams()));
                     }
                 }
             }
 
             if ($route->getHook()) {
                 foreach (Hooks::$shutdown as $hook) {
                     if (\in_array('*', $hook->getGroups())) {
-                        \call_user_func_array($hook->getAction(), $this->http->getArguments($hook, $pathValues, $requestParams));
+                        \call_user_func_array($hook->getAction(), $this->http->getArguments($hook, $pathValues, $this->request->getParams()));
                     }
                 }
             }
@@ -188,7 +192,7 @@ public function execute(RouteMatch $match): void
                 foreach (Hooks::$errors as $error) {
                     if (\in_array($group, $error->getGroups())) {
                         try {
-                            \call_user_func_array($error->getAction(), $this->http->getArguments($error, $pathValues, $requestParams));
+                            \call_user_func_array($error->getAction(), $this->http->getArguments($error, $pathValues, $this->request->getParams()));
                         } catch (\Throwable $e) {
                             throw new Exception('Error handler had an error: ' . $e->getMessage(), 500, $e);
                         }
@@ -199,7 +203,7 @@ public function execute(RouteMatch $match): void
             foreach (Hooks::$errors as $error) {
                 if (\in_array('*', $error->getGroups())) {
                     try {
-                        \call_user_func_array($error->getAction(), $this->http->getArguments($error, $pathValues, $requestParams));
+                        \call_user_func_array($error->getAction(), $this->http->getArguments($error, $pathValues, $this->request->getParams()));
                     } catch (\Throwable $e) {
                         throw new Exception('Error handler had an error: ' . $e->getMessage(), 500, $e);
                     }

tests/DispatcherTest.php

@@ -9,6 +9,7 @@
 use Utopia\Http\Adapter\FPM\Request;
 use Utopia\Http\Adapter\FPM\Response;
 use Utopia\Http\Adapter\FPM\Server;
+use Utopia\Validator\Text;
 
 /**
  * End-to-end coverage for {@see Dispatcher} via Http::run().
@@ -220,6 +221,60 @@ public function testOptionsHookFiresForOptionsMethod(): void
         $this->assertStringNotContainsString('GET-HANDLER', $output);
     }
 
+    public function testInitHookMutationsToRequestParamsAreVisibleToRouteAction(): void
+    {
+        // Regression: Dispatcher::execute must re-read $request->getParams()
+        // at each hook/action call site. Hoisting the array into a local
+        // before init hooks fire would cache a pre-hook snapshot, so the
+        // route action would see stale params despite an init hook having
+        // mutated them (e.g. to apply auth/filter rewrites).
+        Http::init()
+            ->inject('request')
+            ->action(function (Request $request) {
+                $request->setQueryString(['x' => 'from-init-hook']);
+            });
+
+        Http::get('/filter-me')
+            ->param('x', 'original', new Text(64), 'x param', true)
+            ->inject('response')
+            ->action(function (string $x, Response $response) {
+                $response->send($x);
+            });
+
+        $output = $this->runRequest('GET', '/filter-me');
+
+        $this->assertSame('from-init-hook', $output);
+    }
+
+    public function testShutdownHookSeesMutationsFromInitHook(): void
+    {
+        // The same guarantee for the init → shutdown path: shutdown hooks
+        // read getArguments() fresh, so an init-time mutation is visible.
+        Http::init()
+            ->inject('request')
+            ->action(function (Request $request) {
+                $request->setQueryString(['token' => 'init-token']);
+            });
+
+        Http::shutdown()
+            ->param('token', '', new Text(64), 'token param', true)
+            ->inject('response')
+            ->action(function (string $token, Response $response) {
+                echo '|shutdown:' . $token;
+            });
+
+        Http::get('/lifecycle-params')
+            ->inject('response')
+            ->action(function (Response $response) {
+                $response->send('ok');
+            });
+
+        $output = $this->runRequest('GET', '/lifecycle-params');
+
+        $this->assertStringContainsString('ok', $output);
+        $this->assertStringContainsString('|shutdown:init-token', $output);
+    }
+
     public function testWildcardRouteMatchCarriesWildcardToken(): void
     {
         Http::wildcard()