@mandujs/core 0.54.23 → 0.54.24

package/src/filling/filling.ts

@@ -606,7 +606,13 @@ export class ManduFilling<TLoaderData = unknown> {
       if (this.config.handlers.has("GET") && !allowed.includes("HEAD")) {
         allowed.push("HEAD");
       }
-      return ctx.json({ status: "error", message: `Method ${method} not allowed`, allowed }, 405);
+      // RFC 7231 §6.5.5: a 405 response MUST include an `Allow` header listing
+      // every supported method (not just the body field). ctx.json() cannot
+      // attach headers, so build the response directly here.
+      return Response.json(
+        { status: "error", message: `Method ${method} not allowed`, allowed },
+        { status: 405, headers: { Allow: allowed.join(", ") } },
+      );
     }
     const lifecycleWithDefaults = this.createLifecycleWithDefaults(routeContext);
     const runHandler = async () => {

package/src/filling/head-method.test.ts

@@ -69,4 +69,39 @@ describe("Filling HEAD handling (#319)", () => {
     expect(body.allowed).toContain("GET");
     expect(body.allowed).toContain("HEAD");
   });
+
+  // Issue #321: 405 responses MUST carry an `Allow` header listing every
+  // supported method — for multi-method routes too, not just single-method.
+  it("sets the Allow header to a single method route's methods", async () => {
+    const filling = ManduFillingFactory.filling().get((ctx) => ctx.json({ ok: true }));
+
+    const putRes = await filling.handle(
+      new Request("http://localhost/api/health", { method: "PUT" }),
+    );
+
+    expect(putRes.status).toBe(405);
+    const allow = putRes.headers.get("Allow") ?? "";
+    expect(allow.split(", ")).toContain("GET");
+    expect(allow.split(", ")).toContain("HEAD");
+  });
+
+  it("sets the Allow header to ALL methods for a multi-method route (#321)", async () => {
+    const filling = ManduFillingFactory.filling()
+      .get((ctx) => ctx.json({ ok: true }))
+      .post((ctx) => ctx.json({ ok: true }))
+      .delete((ctx) => ctx.json({ ok: true }));
+
+    const putRes = await filling.handle(
+      new Request("http://localhost/api/pledges", { method: "PUT" }),
+    );
+
+    expect(putRes.status).toBe(405);
+    const allow = putRes.headers.get("Allow") ?? "";
+    const methods = allow.split(", ");
+    expect(methods).toContain("GET");
+    expect(methods).toContain("POST");
+    expect(methods).toContain("DELETE");
+    // HEAD is implied by GET.
+    expect(methods).toContain("HEAD");
+  });
 });