# HG changeset patch
# User Matthew Wild <mwild1@gmail.com>
# Date 1602854813 -3600
# Node ID 35b678609b79088a62010cc2b60d2b0830a79efe
# Parent  86f8ece24029e07a7f4a0b60eb8ef05e90f7623a
mod_invites_api: Allow restricting HTTP methods per key (once implemented)

diff -r 86f8ece24029 -r 35b678609b79 mod_invites_api/mod_invites_api.lua
--- a/mod_invites_api/mod_invites_api.lua	Fri Oct 16 14:25:44 2020 +0100
+++ b/mod_invites_api/mod_invites_api.lua	Fri Oct 16 14:26:53 2020 +0100
@@ -54,6 +54,10 @@
 		return 403;
 	end
 
+	if api_user.allowed_methods and not api_user.allowed_methods[event.request.method] then
+		return 405;
+	end
+
 	local invite = invites.create_account(nil, { source = "api/token/"..api_user.id });
 	if not invite then
 		return 500;
@@ -104,6 +108,7 @@
 			token = token;
 			name = arg[1];
 			created_at = os.time();
+			allowed_methods = { GET = true, POST = true };
 		});
 		print(id.."/"..token);
 	elseif command == "delete" then