@sap/xsodata/lib/uri/checks/checkPostPutDeleteChecks.js

Expose data from a HANA database as OData V2 service with help of .xsodata files.

'use strict';
const methodNotAllowed = require('../../utils/errors/http/methodNotAllowed');

module.exports = function (context, callback) {
    const method = context.request.method.toLowerCase();

    if (method === 'post') {
        checkPost(context, callback);
    } else if (method === 'put') {
        checkPut(context, callback);
    } else if (method === 'delete') {
        checkDelete(context, callback);
    } else {
        return callback(null, context);
    }
};

function createNowAllowed(mess, context) {
    return new methodNotAllowed(mess, context);
}

function checkPost(context, callback) {
    const dbLast = context.oData.dbSegmentLast;
    if (
        (dbLast.previousDBSegment && !context.oData.dbSegment.isLinks) ||
        dbLast.nextDBSegment
    ) {
        return callback(
            createNowAllowed('POST only allowed on direct entitySets', context),
            context
        );
    }
    return callback(null, context);
}

function checkPut(context, callback) {
    const dbLast = context.oData.dbSegmentLast;
    if (
        (dbLast.previousDBSegment && !context.oData.dbSegment.isLinks) ||
        dbLast.nextDBSegment
    ) {
        return callback(
            createNowAllowed('PUT only allowed on direct entitySets', context),
            context
        );
    }
    return callback(null, context);
}
function checkDelete(context, callback) {
    const dbLast = context.oData.dbSegmentLast;
    if (
        (dbLast.previousDBSegment && !context.oData.dbSegment.isLinks) ||
        dbLast.nextDBSegment
    ) {
        return callback(
            createNowAllowed(
                'DELETE only allowed on direct entitySets',
                context
            ),
            context
        );
    }
    return callback(null, context);
}