fix: include accurate Allow headers on 405 responses

rest.js

@@ -37,12 +37,19 @@ const createPatchOverrideMiddleware = (message) => {
     return (req, res, next) => {
         if (!checkPatchOverrideSupport(req, res)) {
             res.statusMessage = message
+            res.set("Allow", "PATCH,POST")
             return res.status(405).end()
         }
         next()
     }
 }
 
+const sendMethodNotAllowed = (res, message, allowedMethods) => {
+    res.statusMessage = message
+    res.set("Allow", allowedMethods)
+    return res.status(405).end()
+}
+
 /**
  * Detects multiple MIME types smuggled into a single Content-Type header.
  * The following are the cases that should result in a 415 (not a 500)
@@ -230,4 +237,4 @@ It may not have completed at all, and most likely did not complete successfully.
     res.status(error.status).send(error.message)
 }
 
-export default { checkPatchOverrideSupport, createPatchOverrideMiddleware, verifyJsonContentType, verifyEitherContentType, messenger }
+export default { checkPatchOverrideSupport, createPatchOverrideMiddleware, sendMethodNotAllowed, verifyJsonContentType, verifyEitherContentType, messenger }

routes/__tests__/route_wrappers.test.js

@@ -88,6 +88,7 @@ function assertInvalidOverride(router) {
   })
 
   assert.strictEqual(res.statusCode, 405)
+  assert.strictEqual(res.headers.Allow, 'PATCH,POST')
   assert.strictEqual(res.ended, true)
   assert.deepStrictEqual(nextCalls, [])
 }
@@ -105,13 +106,23 @@ function assertValidOverride(router) {
   assert.strictEqual(nextCalls[0], undefined)
 }
 
+function getAllowedMethods(route) {
+  const methods = Object.keys(route.methods)
+    .filter(method => method !== '_all')
+    .map(method => method.toUpperCase())
+  if (methods.includes('GET') && !methods.includes('HEAD')) methods.push('HEAD')
+  return methods.join(',')
+}
+
 function assertUnsupportedMethodOnPath(router, path) {
-  const fallbackLayer = getRoute(router, path).stack.at(-1)
+  const route = getRoute(router, path)
+  const fallbackLayer = route.stack.at(-1)
   assert.ok(fallbackLayer, `Expected fallback .all() layer for '${path}'`)
 
   const { res, nextCalls } = invokeLayer(fallbackLayer)
 
   assert.strictEqual(res.statusCode, 405)
+  assert.strictEqual(res.headers.Allow, getAllowedMethods(route))
   assert.strictEqual(res.ended, true)
   assert.deepStrictEqual(nextCalls, [])
 }

routes/_gog_fragments_from_manuscript.js

@@ -3,12 +3,12 @@ const router = express.Router()
 //This controller will handle all MongoDB interactions.
 import controller from '../db-controller.js'
 import auth from '../auth/index.js'
+import rest from '../rest.js'
 
 router.route('/')
     .post(auth.checkJwt, controller._gog_fragments_from_manuscript)
     .all((req, res, next) => {
-        res.statusMessage = 'Improper request method.  Please use POST.'
-        res.status(405).end()
+        rest.sendMethodNotAllowed(res, 'Improper request method.  Please use POST.', 'POST')
     })
 
 export default router

routes/_gog_glosses_from_manuscript.js

@@ -3,12 +3,12 @@ const router = express.Router()
 //This controller will handle all MongoDB interactions.
 import controller from '../db-controller.js'
 import auth from '../auth/index.js'
+import rest from '../rest.js'
 
 router.route('/')
     .post(auth.checkJwt, controller._gog_glosses_from_manuscript)
     .all((req, res, next) => {
-        res.statusMessage = 'Improper request method.  Please use POST.'
-        res.status(405).end()
+        rest.sendMethodNotAllowed(res, 'Improper request method.  Please use POST.', 'POST')
     })
 
 export default router

routes/_gog_id.js

@@ -1,13 +1,13 @@
 import express from 'express'
 const router = express.Router()
 import controller from '../db-controller.js'
+import rest from '../rest.js'
 
 // GoG-namespaced, stable, browser-cacheable URL returning the object with its targeting Annotations merged in.
 router.route('/:_id')
     .get(controller.expandedId)
     .all((req, res, next) => {
-        res.statusMessage = 'Improper request method, please use GET.'
-        res.status(405).end()
+        rest.sendMethodNotAllowed(res, 'Improper request method, please use GET.', 'GET,HEAD')
     })
 
 export default router

routes/bulkCreate.js

@@ -10,8 +10,7 @@ import rest from '../rest.js'
 router.route('/')
     .post(auth.checkJwt, rest.verifyJsonContentType, controller.bulkCreate)
     .all((req, res, next) => {
-        res.statusMessage = 'Improper request method for creating, please use POST.'
-        res.status(405).end()
+        rest.sendMethodNotAllowed(res, 'Improper request method for creating, please use POST.', 'POST')
     })
 
 export default router

routes/bulkUpdate.js

@@ -10,8 +10,7 @@ import rest from '../rest.js'
 router.route('/')
     .put(auth.checkJwt, rest.verifyJsonContentType, controller.bulkUpdate)
     .all((req, res, next) => {
-        res.statusMessage = 'Improper request method for creating, please use PUT.'
-        res.status(405).end()
+        rest.sendMethodNotAllowed(res, 'Improper request method for creating, please use PUT.', 'PUT')
     })
 
 export default router

routes/create.js

@@ -9,8 +9,7 @@ import rest from '../rest.js'
 router.route('/')
     .post(auth.checkJwt, rest.verifyJsonContentType, controller.create)
     .all((req, res, next) => {
-        res.statusMessage = 'Improper request method for creating, please use POST.'
-        res.status(405).end()
+        rest.sendMethodNotAllowed(res, 'Improper request method for creating, please use POST.', 'POST')
     })
 
 export default router

routes/delete.js

@@ -3,12 +3,12 @@ const router = express.Router()
 //This controller will handle all MongoDB interactions.
 import { deleteObj } from '../controllers/delete.js'
 import auth from '../auth/index.js'
+import rest from '../rest.js'
 
 router.route('/:_id')
     .delete(auth.checkJwt, deleteObj)
     .all((req, res, next) => {
-        res.statusMessage = 'Improper request method for deleting, please use DELETE.'
-        res.status(405).end()
+        rest.sendMethodNotAllowed(res, 'Improper request method for deleting, please use DELETE.', 'DELETE')
     })
 
 export default router

routes/history.js

@@ -2,12 +2,12 @@ import express from 'express'
 const router = express.Router()
 //This controller will handle all MongoDB interactions.
 import controller from '../db-controller.js'
+import rest from '../rest.js'
 
 router.route('/:_id')
     .get(controller.history)
     .all((req, res, next) => {
-        res.statusMessage = 'Improper request method, please use GET.'
-        res.status(405).end()
+        rest.sendMethodNotAllowed(res, 'Improper request method, please use GET.', 'GET,HEAD')
     })
 
 export default router

routes/id.js

@@ -8,15 +8,13 @@ router.route('/:_id/expanded')
     .get(controller.idExpanded)
     .post(rest.verifyJsonContentType, controller.idExpanded)
     .all((req, res, next) => {
-        res.statusMessage = 'Improper request method, please use GET or POST.'
-        res.status(405).end()
+        rest.sendMethodNotAllowed(res, 'Improper request method, please use GET or POST.', 'GET,POST,HEAD')
     })
 
 router.route('/:_id')
     .get(controller.id)
     .all((req, res, next) => {
-        res.statusMessage = 'Improper request method, please use GET.'
-        res.status(405).end()
+        rest.sendMethodNotAllowed(res, 'Improper request method, please use GET.', 'GET,HEAD')
     })
 
 export default router

routes/overwrite.js

@@ -9,8 +9,7 @@ import rest from '../rest.js'
 router.route('/')
     .put(auth.checkJwt, rest.verifyJsonContentType, controller.overwrite)
     .all((req, res, next) => {
-        res.statusMessage = 'Improper request method for overwriting, please use PUT to overwrite this object.'
-        res.status(405).end()
+        rest.sendMethodNotAllowed(res, 'Improper request method for overwriting, please use PUT to overwrite this object.', 'PUT')
     })
 
 export default router

routes/patchSet.js

@@ -11,8 +11,7 @@ router.route('/')
     .patch(auth.checkJwt, rest.verifyJsonContentType, controller.patchSet)
     .post(auth.checkJwt, rest.verifyJsonContentType, checkPatchOverride, controller.patchSet)
     .all((req, res, next) => {
-        res.statusMessage = 'Improper request method for updating, please use PATCH to add new keys to this object.'
-        res.status(405).end()
+        rest.sendMethodNotAllowed(res, 'Improper request method for updating, please use PATCH to add new keys to this object.', 'PATCH,POST')
     })
 
 export default router

routes/patchUnset.js

@@ -11,8 +11,7 @@ router.route('/')
     .patch(auth.checkJwt, rest.verifyJsonContentType, controller.patchUnset)
     .post(auth.checkJwt, rest.verifyJsonContentType, checkPatchOverride, controller.patchUnset)
     .all((req, res, next) => {
-        res.statusMessage = 'Improper request method for updating, please use PATCH to remove keys from this object.'
-        res.status(405).end()
+        rest.sendMethodNotAllowed(res, 'Improper request method for updating, please use PATCH to remove keys from this object.', 'PATCH,POST')
     })
 
 export default router

routes/patchUpdate.js

@@ -12,8 +12,7 @@ router.route('/')
 	.patch(auth.checkJwt, rest.verifyJsonContentType, controller.patchUpdate)
 	.post(auth.checkJwt, rest.verifyJsonContentType, checkPatchOverride, controller.patchUpdate)
 	.all((req, res, next) => {
-		res.statusMessage = 'Improper request method for updating, please use PATCH to alter existing keys on this object.'
-		res.status(405).end()
+			   rest.sendMethodNotAllowed(res, 'Improper request method for updating, please use PATCH to alter existing keys on this object.', 'PATCH,POST')
 	})
 
 export default router

routes/putUpdate.js

@@ -9,8 +9,7 @@ import rest from '../rest.js'
 router.route('/')
     .put(auth.checkJwt, rest.verifyJsonContentType, controller.putUpdate)
     .all((req, res, next) => {
-        res.statusMessage = 'Improper request method for updating, please use PUT to update this object.'
-        res.status(405).end()
+        rest.sendMethodNotAllowed(res, 'Improper request method for updating, please use PUT to update this object.', 'PUT')
     })
 
 export default router

routes/query.js

@@ -8,8 +8,7 @@ router.route('/')
     .post(rest.verifyJsonContentType, controller.query)
     .head(controller.queryHeadRequest)
     .all((req, res, next) => {
-        res.statusMessage = 'Improper request method for requesting objects with matching properties.  Please use POST.'
-        res.status(405).end()
+        rest.sendMethodNotAllowed(res, 'Improper request method for requesting objects with matching properties.  Please use POST.', 'POST,HEAD')
     })
 
 export default router

routes/release.js

@@ -4,12 +4,12 @@ const router = express.Router()
 //This controller will handle all MongoDB interactions.
 import controller from '../db-controller.js'
 import auth from '../auth/index.js'
+import rest from '../rest.js'
 
 router.route('/:_id')
     .patch(auth.checkJwt, controller.release)
     .all((req, res, next) => {
-        res.statusMessage = 'Improper request method for releasing, please use PATCH to release this object.'
-        res.status(405).end()
+        rest.sendMethodNotAllowed(res, 'Improper request method for releasing, please use PATCH to release this object.', 'PATCH')
     })
 
 export default router

routes/search.js

@@ -6,15 +6,13 @@ import rest from '../rest.js'
 router.route('/')
     .post(rest.verifyEitherContentType, controller.searchAsWords)
     .all((req, res, next) => {
-        res.statusMessage = 'Improper request method for search.  Please use POST.'
-        res.status(405).end()
+        rest.sendMethodNotAllowed(res, 'Improper request method for search.  Please use POST.', 'POST')
     })
 
 router.route('/phrase')
     .post(rest.verifyEitherContentType, controller.searchAsPhrase)
     .all((req, res, next) => {
-        res.statusMessage = 'Improper request method for search.  Please use POST.'
-        res.status(405).end()
+        rest.sendMethodNotAllowed(res, 'Improper request method for search.  Please use POST.', 'POST')
     })
 
 // Note that there are more search functions available in the controller, such as controller.searchFuzzily

routes/since.js

@@ -2,12 +2,12 @@ import express from 'express'
 const router = express.Router()
 //This controller will handle all MongoDB interactions.
 import controller from '../db-controller.js'
+import rest from '../rest.js'
 
 router.route('/:_id')
     .get(controller.since)
     .all((req, res, next) => {
-        res.statusMessage = 'Improper request method, please use GET.'
-        res.status(405).end()
+        rest.sendMethodNotAllowed(res, 'Improper request method, please use GET.', 'GET,HEAD')
     })
 
 export default router

utils.js

@@ -133,7 +133,6 @@ const configureWebAnnoHeadersFor = function(obj){
     else{
         headers["Link"] = "<http://www.w3.org/ns/ldp#Resource>; rel=\"type\""
     }
-    headers["Allow"] = "GET,OPTIONS,HEAD,PUT,PATCH,DELETE,POST"
     return headers
 }
 
@@ -158,7 +157,6 @@ const configureLDHeadersFor = function(obj){
         headers["Content-Type"] = "application/json;charset=utf-8;"
     }
     */
-    headers["Allow"] = "GET,OPTIONS,HEAD,PUT,PATCH,DELETE,POST"
     headers["Content-Type"] = 'application/ld+json;charset=utf-8;profile="http://www.w3.org/ns/anno.jsonld"'
     headers["Link"] = '<http://store.rerum.io/v1/context.json>; rel="http://www.w3.org/ns/json-ld#context"; type="application/ld+json"'
     return headers