Stage 3: enforce blob deletion ownership and add admin representation deletion

Also repairs two stale Phase 21 fixtures: - Supplies a valid PDF to exercise the upload dependency-failure path. - Injects getPersonalAccount into the representation-involvement VM fixture.
2026-10-26 14:39:22 +00:00
parent 848728584e
commit 0daeb783b9
6 changed files with 458 additions and 14 deletions
@@ -0,0 +1,78 @@
+import { deleteBlobRep } from "../../../actions/azurestorage";
+import {
+    hasTrustedSameOrigin,
+    readAdminSessionCookie,
+    setAdminAuthNoStore,
+    validateAdminSession
+} from "../../../lib/admin/adminAuth";
+import { respondError, respondSuccess } from "../middleware/apiResponse";
+
+const forbidden = (res) =>
+    respondError(res, {
+        status: 403,
+        code: "FORBIDDEN",
+        message: "Request not permitted"
+    });
+
+const isValidContainer = (value) =>
+    typeof value === "string" &&
+    value.length >= 3 &&
+    value.length <= 63 &&
+    /^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$/.test(value);
+
+const isValidPathSegment = (value) =>
+    typeof value === "string" &&
+    value.length > 0 &&
+    value.length <= 255 &&
+    value === value.trim() &&
+    value !== "." &&
+    value !== ".." &&
+    !/[\\/\u0000-\u001f\u007f]/.test(value);
+
+export default async function handler(req, res) {
+    setAdminAuthNoStore(res);
+    res.setHeader("Allow", "POST");
+
+    if (req.method !== "POST") {
+        return respondError(res, {
+            status: 405,
+            code: "METHOD_NOT_ALLOWED",
+            message: "Method not allowed"
+        });
+    }
+
+    const adminSession = readAdminSessionCookie(req);
+    if (
+        !validateAdminSession(adminSession) ||
+        !hasTrustedSameOrigin(req)
+    ) {
+        return forbidden(res);
+    }
+
+    const { container, casefolderID, repfile } = req.body ?? {};
+    if (
+        !isValidContainer(container) ||
+        !isValidPathSegment(casefolderID) ||
+        !isValidPathSegment(repfile)
+    ) {
+        return respondError(res, {
+            status: 400,
+            code: "INVALID_REQUEST",
+            message: "Invalid request"
+        });
+    }
+
+    try {
+        const data = await deleteBlobRep(
+            container,
+            `${casefolderID}/${repfile}`
+        );
+        return respondSuccess(res, { data });
+    } catch (_error) {
+        return respondError(res, {
+            status: 400,
+            code: "DELETE_BLOB_REP_FAILED",
+            message: "Unable to delete blob representation"
+        });
+    }
+}