chore: add put_can_create? method to base resource

lib/pact_broker/api/resources/base_resource.rb

@@ -313,6 +313,12 @@ def content_type_is_json_but_invalid_json_provided?
         def content_type_json?
           request.content_type&.include?("json")
         end
+
+        # Not a Webmachine method. This is used by security policy code to identify whether
+        # a PUT to a non existing resource can create a new object.
+        def put_can_create?
+          false
+        end
       end
     end
   end

lib/pact_broker/api/resources/branch_version.rb

@@ -17,6 +17,10 @@ def allowed_methods
           ["GET", "PUT", "DELETE", "OPTIONS"]
         end
 
+        def put_can_create?
+          true
+        end
+
         def resource_exists?
           !!branch_version
         end

lib/pact_broker/api/resources/environment.rb

@@ -17,6 +17,10 @@ def allowed_methods
           ["GET", "PUT", "DELETE", "OPTIONS"]
         end
 
+        def put_can_create?
+          false
+        end
+
         def resource_exists?
           !!environment
         end

lib/pact_broker/api/resources/label.rb

@@ -17,6 +17,10 @@ def allowed_methods
           ["GET", "PUT", "DELETE", "OPTIONS"]
         end
 
+        def put_can_create?
+          true
+        end
+
         def from_json
           unless label
             @label = label_service.create(identifier_from_path)

lib/pact_broker/api/resources/pact.rb

@@ -36,6 +36,10 @@ def allowed_methods
           ["GET", "PUT", "DELETE", "PATCH", "OPTIONS"]
         end
 
+        def put_can_create?
+          true
+        end
+
         def is_conflict?
           merge_conflict = request.patch? && resource_exists? && Pacts::Merger.conflict?(pact.json_content, pact_params.json_content)
 

lib/pact_broker/api/resources/pacticipant.rb

@@ -21,6 +21,10 @@ def allowed_methods
           ["GET", "PUT", "PATCH", "DELETE", "OPTIONS"]
         end
 
+        def put_can_create?
+          false
+        end
+
         def known_methods
           super + ["PATCH"]
         end
@@ -29,6 +33,7 @@ def malformed_request?
           super || ((request.patch? || request.really_put?) && validation_errors_for_schema?)
         end
 
+        # PUT or PATCH with content-type application/json
         def from_json
           if pacticipant
             @pacticipant = update_existing_pacticipant

lib/pact_broker/api/resources/tag.rb

@@ -17,6 +17,10 @@ def allowed_methods
           ["GET","PUT","DELETE", "OPTIONS"]
         end
 
+        def put_can_create?
+          true
+        end
+
         def from_json
           unless tag
             @tag = tag_service.create(identifier_from_path)

lib/pact_broker/api/resources/version.rb

@@ -21,6 +21,10 @@ def allowed_methods
           ["GET", "PUT", "PATCH", "DELETE", "OPTIONS"]
         end
 
+        def put_can_create?
+          true
+        end
+
         def resource_exists?
           !!version
         end

lib/pact_broker/api/resources/webhook.rb

@@ -22,6 +22,10 @@ def allowed_methods
           ["GET", "PUT", "DELETE", "OPTIONS"]
         end
 
+        def put_can_create?
+          true
+        end
+
         def resource_exists?
           !!webhook
         end