Decorating req.private, updating README.md

README.md

@@ -51,7 +51,7 @@ Unprotected routes are routes that do not require authorization for access, and
 The `/assets/*` route is reserved for the HTML browsable interface assets; please do not try to reuse this for data.
 
 ### Request Helpers
-Tenso decorates `req` with "helpers" such as `req.ip`, & `req.parsed`. `PATCH`, `PUT`, & `POST` payloads are available as `req.body`. Sessions are available as `req.session` when using `local` authentication.
+Tenso decorates `req` with "helpers" such as `req.allow`, `req.csrf`, `req.ip`, `req.parsed`, & `req.private`. `PATCH`, `PUT`, & `POST` payloads are available as `req.body`. Sessions are available as `req.session` when using `local` authentication.
 
 Tenso decorates `res` with "helpers" such as `res.send()`, `res.status()`, & `res.json()`.
 

lib/tenso.js

@@ -156,6 +156,7 @@ class Tenso extends Base {
 
 	connect (req, res) {
 		req.csrf = this.canModify(req.method) === false && this.canModify(req.allow) && this.config.security.csrf === true;
+		req.private = false;
 		req.hypermedia = true;
 		req.protect = false;
 		req.protectAsync = false;
@@ -193,7 +194,7 @@ class Tenso extends Base {
 		const key = "cache-control",
 			cache = res.getHeader(key) || "";
 
-		if (req.protect || req.csrf && cache.includes("private") === false) {
+		if ((req.protect || req.csrf || req.private) && cache.includes("private") === false) {
 			const lcache = cache.replace(/(private|public)(,\s)?/g, "");
 
 			res.removeHeader(key);

package.json

@@ -1,7 +1,7 @@
 {
   "name": "tenso",
   "description": "Tenso is an HTTP REST API framework",
-  "version": "16.1.0",
+  "version": "16.2.0",
   "homepage": "https://github.com/avoidwork/tenso",
   "author": "Jason Mulligan <[email protected]>",
   "repository": {