From 426e735a6ce50b9463870f13523c6dcbf007f3a1 Mon Sep 17 00:00:00 2001
From: David Grudl <david@grudl.com>
Date: Sat, 13 Nov 2021 17:26:35 +0100
Subject: [PATCH] AllowedFor wip

---
 src/Application/Attributes/AllowedFor.php | 21 +++++++++++++++++++++
 src/Application/UI/Component.php          |  7 +++++++
 2 files changed, 28 insertions(+)
 create mode 100644 src/Application/Attributes/AllowedFor.php

diff --git a/src/Application/Attributes/AllowedFor.php b/src/Application/Attributes/AllowedFor.php
new file mode 100644
index 000000000..5779f2c6d
--- /dev/null
+++ b/src/Application/Attributes/AllowedFor.php
@@ -0,0 +1,21 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Nette\Application\Attributes;
+
+use Attribute;
+
+
+#[Attribute(Attribute::TARGET_METHOD | Attribute::TARGET_CLASS)]
+class AllowedFor
+{
+	public function __construct(
+		public ?bool $httpGet = null,
+		public ?bool $httpPost = null,
+		public ?bool $forward = null,
+		public ?array $actions = null,
+		public ?bool $crossOrigin = null,
+	) {
+	}
+}
diff --git a/src/Application/UI/Component.php b/src/Application/UI/Component.php
index eb1242cca..1553aa65d 100644
--- a/src/Application/UI/Component.php
+++ b/src/Application/UI/Component.php
@@ -134,6 +134,13 @@ public function checkRequirements($element): void
 		) {
 			$this->getPresenter()->detectedCsrf();
 		}
+
+		if ($attrs = $element->getAttributes(Nette\Application\Attributes\AllowedFor::class)) {
+			$method = strtolower($this->getPresenter()->getRequest()->getMethod());
+			if (empty($attrs[0]->newInstance()->$method)) {
+				throw new Nette\Application\BadRequestException("Method '$method' is not allowed.");
+			}
+		}
 	}