From fc16b859be281aafad550a460403f94ccc13568d Mon Sep 17 00:00:00 2001
From: dimos-flexiana <82208133+dimos-flexiana@users.noreply.github.com>
Date: Tue, 4 May 2021 17:00:36 +0300
Subject: [PATCH] Exchange the POST and PUT http methods (#84)

* exchange the behaviour of PUT and POST

* assert post and put in respect of their privileges

* bump the version number
---
 project.clj                      | 2 +-
 src/framework/acl/core.clj       | 8 ++++----
 test/framework/acl/core_test.clj | 4 ++++
 3 files changed, 9 insertions(+), 5 deletions(-)

diff --git a/project.clj b/project.clj
index c27c675f..1707a182 100644
--- a/project.clj
+++ b/project.clj
@@ -1,4 +1,4 @@
-(defproject com.flexiana/framework "0.2.1"
+(defproject com.flexiana/framework "0.2.2"
   :description "Framework"
   :url "https://github.com/Flexiana/framework"
   :license {:name "FIXME" :url "FIXME"}
diff --git a/src/framework/acl/core.clj b/src/framework/acl/core.clj
index 6e14da4e..032cac14 100644
--- a/src/framework/acl/core.clj
+++ b/src/framework/acl/core.clj
@@ -6,8 +6,8 @@
 
 (def action-mapping
   {:get    :read
-   :post   :update
-   :put    :create
+   :post   :create
+   :put    :update
    :delete :delete})
 
 (defn- ->resource
@@ -35,8 +35,8 @@
   |req:    | action: |
   |------- |---------|
   |:get    | :read   |
-  |:post   | :update |
-  |:put    | :create |
+  |:post   | :create |
+  |:put    | :update |
   |:delete | :delete |"
   ([{{user :user}             :session-data
      roles                    :acl/roles
diff --git a/test/framework/acl/core_test.clj b/test/framework/acl/core_test.clj
index 9ff301aa..17b62559 100644
--- a/test/framework/acl/core_test.clj
+++ b/test/framework/acl/core_test.clj
@@ -115,6 +115,10 @@
          (get-error (is-allowed (state-with-user-request guest "/items/" :post)))))
   (is (= :own
          (get-ok (is-allowed (state-with-user-request member "/addresses/" :post)))))
+  (is (= :own
+         (get-ok (is-allowed (state-with-user-request member "/users/" :put)))))
+  (is (= {:status 401, :body "Authorization error"}
+         (get-error (is-allowed (state-with-user-request member "/users/" :post)))))
   (is (= :all
          (get-ok (is-allowed (state-with-user-request admin "/items/" :get)))))
   (is (= :all