@sap/xsodata/lib/uri/checks/checkAllowedMethodsForResourcePath.js

Expose data from a HANA database as OData V2 service with help of .xsodata files.

'use strict';
const Http405_MethodNotAllowed = require('../../utils/errors/http/methodNotAllowed'),
    Http501_MethodNotSupported = require('../../utils/errors/http/notSupported');

module.exports = function checkAllowdMethodsForResourePath(context, callback) {
    const method = context.request.method.toLowerCase();
    const dbLast = context.oData.dbSegmentLast;

    const batchError = getBatchMethodError(context, method);
    if (batchError) {
        return callback(batchError, context);
    }

    let err = null;
    if (method === 'post') {
        err = validatePost(context, dbLast);
    } else if (method === 'put') {
        err = validatePut(context, dbLast);
    } else if (method === 'delete') {
        err = validateDelete(context, dbLast);
    }

    return callback(err, context);
};

function getBatchMethodError(context, method) {
    if (!context.batchContext) {
        return null;
    }
    if (context.batchContext.inChangeSet) {
        return null;
    }
    if (method === 'post') {
        return new Http405_MethodNotAllowed(
            'When using OData batch method POST is only allowed inside changesets'
        );
    }
    if (method === 'put') {
        return new Http405_MethodNotAllowed(
            'When using OData batch method PUT is only allowed inside changesets'
        );
    }
    if (method === 'delete') {
        return new Http405_MethodNotAllowed(
            'When using OData batch method DELETE is only allowed inside changesets'
        );
    }
    return null;
}

function validatePost(context, dbLast) {
    if (dbLast.isCollection) {
        return null;
    }
    if (context.oData.dbSegment && context.oData.dbSegment.isLinks) {
        return new Http405_MethodNotAllowed(
            'The URI is not valid for POST operation. To edit linked resources of this relationship type, please use PUT.'
        );
    }
    return new Http405_MethodNotAllowed(
        'The URI is not valid for POST operation. The URI must point to an entity set for POST operations.'
    );
}

function validatePut(context, dbLast) {
    if (dbLast.isCollection) {
        if (
            !context.oData.dbSegment ||
            context.oData.dbSegment === context.oData.dbSegmentLast
        ) {
            return new Http405_MethodNotAllowed(
                'The URI is not valid for PUT operation. The URI must point to a single resource for PUT operations.'
            );
        }
        if (context.oData.dbSegment && !context.oData.dbSegment.isLinks) {
            return new Http405_MethodNotAllowed(
                'The URI is not valid for PUT operation. The URI must point to a single resource for PUT operations.'
            );
        }
        if (
            context.oData.dbSegment &&
            context.oData.dbSegment.isLinks &&
            !context.oData.dbSegment.getOver()
        ) {
            return new Http405_MethodNotAllowed(
                'The URI is not valid for PUT operation. To edit linked resources of this relationship type, please use POST.'
            );
        }
    }

    if (dbLast.restriction.onlyValue) {
        return new Http501_MethodNotSupported(
            'PUT is not supported for $value'
        );
    }
    return null;
}

function validateDelete(context, dbLast) {
    if (dbLast.isCollection) {
        return new Http405_MethodNotAllowed(
            'The URI is not valid for DELETE operation. The URI must point to a single resource from an entity set or from a property referring to a set of resources.'
        );
    }

    if (dbLast.restriction.onlyValue) {
        return new Http405_MethodNotAllowed('DELETE is not valid for $value');
    }
    if (dbLast.singleProperty) {
        return new Http405_MethodNotAllowed('DELETE is not valid for property');
    }
    return null;
}