Make logic for testing delete permissions less confusing

Author: rubensworks

lib/handlers/allow.js

@@ -8,7 +8,7 @@ const fs = require('fs')
 const { promisify } = require('util')
 const HTTPError = require('../http-error')
 
-function allow (mode, relativePath = '') {
+function allow (mode, testDirectory) {
   return async function allowHandler (req, res, next) {
     const ldp = req.app.locals.ldp || {}
     if (!ldp.webid) {
@@ -25,8 +25,8 @@ function allow (mode, relativePath = '') {
       : req.path
 
     // If a relativePath has been provided, check permissions based on that
-    if (relativePath) {
-      reqPath = path.join(reqPath, relativePath)
+    if (testDirectory) {
+      reqPath = path.dirname(reqPath)
     }
 
     // Check whether the resource exists

lib/ldp-middleware.js

@@ -26,7 +26,7 @@ function LdpMiddleware (corsSettings) {
   router.post('/*', allow('Append'), post)
   router.patch('/*', allow('Append'), patch)
   router.put('/*', allow('Write'), put)
-  router.delete('/*', allow('Write', '..'), del)
+  router.delete('/*', allow('Write', true), del)
 
   return router
 }