@digitalbazaar/ezcap-express 4.3.0 → 4.3.1

package/CHANGELOG.md

@@ -1,5 +1,12 @@
 # @digitalbazaar/ezcap-express Changelog
 
+## 4.3.1 - 2021-12-13
+
+### Fixed
+- Fix `expectedAction` to be `write` for `DELETE` method.
+- Throw error when no `expectedAction` is given for a given HTTP method and
+  provide defaults for all common HTTP methods.
+
 ## 4.3.0 - 2021-12-10
 
 ### Added

package/lib/helpers.js

@@ -10,6 +10,19 @@ import {verifyHeaderValue} from '@digitalbazaar/http-digest-header';
 
 const {ZCAP_CONTEXT_URL} = zCapConstants;
 
+const DEFAULT_ACTION_FOR_METHOD = new Map([
+  ['GET', 'read'],
+  ['HEAD', 'read'],
+  ['OPTIONS', 'read'],
+  ['POST', 'write'],
+  ['PUT', 'write'],
+  ['PATCH', 'write'],
+  ['DELETE', 'write'],
+  ['CONNECT', 'write'],
+  ['TRACE', 'write'],
+  ['PATCH', 'write']
+]);
+
 export const ZCAP_ROOT_PREFIX = 'urn:zcap:root:';
 
 // middleware used to collect expected values for zcap authorization
@@ -87,16 +100,23 @@ export function createExpectationMiddleware({
 
     /* Note: This is safe as long as the server's request handling
     infrastructure differentiates based on HTTP method (as is typical practice
-    with express/connect routing. So, while the client specifies the HTTP
+    with express/connect routing). So, while the client specifies the HTTP
     method, the server specifies the handler for that HTTP method. For example,
     this middleware will ensure that if a client specifies "POST" then it
-    must be invoking a zcap that grants "write" action authority. Then, provided
-    that the server's router ensures that only the "POST" handler will be
-    executed (typical routing practice), all is well. If the handler code is
+    must be invoking a zcap that grants "write" action authority. Then,
+    provided that the server's router ensures that only the "POST" handler will
+    be executed (typical routing practice), all is well. If the handler code is
     chosen via some other means, e.g., via the request body, then the caller
     MUST provide the expected action and not rely on default behavior. */
     if(req.ezcap.expectedAction === undefined) {
-      req.ezcap.expectedAction = req.method === 'POST' ? 'write' : 'read';
+      req.ezcap.expectedAction = DEFAULT_ACTION_FOR_METHOD.get(req.method);
+      if(req.ezcap.expectedAction === undefined) {
+        const error = new Error(
+          `The HTTP method ${req.method} has no expected capability action.`);
+        error.name = 'NotSupportedError';
+        error.httpStatusCode = 400;
+        return helpers.handleError({error, onError});
+      }
     }
 
     try {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@digitalbazaar/ezcap-express",
-  "version": "4.3.0",
+  "version": "4.3.1",
   "main": "lib",
   "module": "main.js",
   "repository": {