TASK22028: phase 15 hash guard consistency hardening slice
This commit is contained in:
@@ -458,6 +458,48 @@
|
||||
- Response-shape contract stability preserved for touched handlers/services.
|
||||
- Remaining risk is primarily external dependency behavior on valid-hash happy paths in local environments (relay/storage), not hash-bypass behavior.
|
||||
|
||||
## Phase 15 hardening status (2026-03-13)
|
||||
|
||||
- Working branch created from `origin/SIPS-Development`:
|
||||
- `TASK22028-phase15-hardening-slice`
|
||||
- Delivered consistency-only hardening across 4 additional sensitive file handlers:
|
||||
- `pages/api/file/upload.js`
|
||||
- `pages/api/file/uploadsinglefile.js`
|
||||
- `pages/api/file/createappealcompletemessage_api.js`
|
||||
- `pages/api/file/setupcontainer.js`
|
||||
- Hardening posture updates:
|
||||
- standardized explicit early 400 on missing hash where validation was already required
|
||||
- standardized early hash-mismatch return path style in `setupcontainer`
|
||||
- preserved response-shape/signature contracts (no intended contract changes)
|
||||
- Added focused phase-15 tests:
|
||||
- `tests/phase15/service-behaviour.test.cjs`
|
||||
- negative-path checks for missing/invalid hash across all selected handlers
|
||||
- required-input negative-path checks where applicable
|
||||
- one valid-hash mocked happy-path check (`setupcontainer` response shape)
|
||||
|
||||
### Phase 15 validation evidence snapshot
|
||||
|
||||
- `node tests/phase6/service-parity.test.cjs` -> pass
|
||||
- `node tests/phase6/service-behaviour.test.cjs` -> pass (8/8)
|
||||
- `node tests/phase7/service-behaviour.test.cjs` -> pass (10/10)
|
||||
- `node tests/phase8/service-behaviour.test.cjs` -> pass (5/5)
|
||||
- `node tests/phase9/service-behaviour.test.cjs` -> pass (5/5)
|
||||
- `node tests/phase10/service-behaviour.test.cjs` -> pass (5/5)
|
||||
- `node tests/phase11/service-behaviour.test.cjs` -> pass (4/4)
|
||||
- `node tests/phase12/service-behaviour.test.cjs` -> pass (4/4)
|
||||
- `node tests/phase13/service-behaviour.test.cjs` -> pass (7/7)
|
||||
- `node tests/phase14/service-behaviour.test.cjs` -> pass (5/5)
|
||||
- `node tests/phase15/service-behaviour.test.cjs` -> pass (5/5)
|
||||
- `npm run lint` -> warnings only (pre-existing `react-hooks/exhaustive-deps` warnings)
|
||||
|
||||
### Phase 15 manual HTTP snapshot
|
||||
|
||||
- Dev server run on `http://localhost:3002`.
|
||||
- Missing/invalid hash negative-path checks for selected handlers -> **400**.
|
||||
- Missing required params where applicable -> **400**.
|
||||
- Valid-hash spot-check:
|
||||
- `GET /api/file/setupcontainer?ident=c1&hash=<valid>` -> **200**.
|
||||
|
||||
## Likely next steps
|
||||
|
||||
1. Stabilize and simplify breadcrumb/back-link decision logic with focused regression checks.
|
||||
|
||||
@@ -929,3 +929,52 @@ Follow-ups:
|
||||
- Keep signer allow-list expansion minimal and task-driven.
|
||||
- Continue replacing remaining browser-side direct hash assumptions only where flows require it.
|
||||
- Confirm work-item/branch naming alignment for any subsequent phase slices if strict tracker continuity is required.
|
||||
|
||||
---
|
||||
|
||||
### CL-026: Phase 15 hardening — consistency guards for additional hash-sensitive file handlers
|
||||
|
||||
date: 2026-03-13
|
||||
author: Cline
|
||||
scope: `pages/api/file/{upload,uploadsinglefile,createappealcompletemessage_api,setupcontainer}.js`, `tests/phase15/service-behaviour.test.cjs`, `memory-bank/*`
|
||||
type: change
|
||||
rationale: Deliver a small reversible consistency-only hardening slice by standardizing missing/invalid hash negative paths and required input handling in additional sensitive file handlers.
|
||||
impact: Consistent early 400 behavior for missing/invalid hash and missing required params while preserving existing response shapes/signatures.
|
||||
status: completed
|
||||
|
||||
Summary:
|
||||
|
||||
- Started new branch from `origin/SIPS-Development`: `TASK22028-phase15-hardening-slice`.
|
||||
- Applied minimal hardening updates:
|
||||
- `upload.js`: explicit missing-hash guard before hash comparison.
|
||||
- `uploadsinglefile.js`: explicit missing-hash guard before hash comparison.
|
||||
- `createappealcompletemessage_api.js`: added missing-hash guard to existing required-input guard block.
|
||||
- `setupcontainer.js`: standardized to early-return on hash mismatch; contract and status behavior preserved.
|
||||
- Added focused tests:
|
||||
- `tests/phase15/service-behaviour.test.cjs`
|
||||
- covers missing-hash negative paths for all selected handlers
|
||||
- includes required-input negative paths and one valid-hash happy-path shape check.
|
||||
|
||||
Validation:
|
||||
|
||||
- `node tests/phase6/service-parity.test.cjs` -> pass
|
||||
- `node tests/phase6/service-behaviour.test.cjs` -> pass (8/8)
|
||||
- `node tests/phase7/service-behaviour.test.cjs` -> pass (10/10)
|
||||
- `node tests/phase8/service-behaviour.test.cjs` -> pass (5/5)
|
||||
- `node tests/phase9/service-behaviour.test.cjs` -> pass (5/5)
|
||||
- `node tests/phase10/service-behaviour.test.cjs` -> pass (5/5)
|
||||
- `node tests/phase11/service-behaviour.test.cjs` -> pass (4/4)
|
||||
- `node tests/phase12/service-behaviour.test.cjs` -> pass (4/4)
|
||||
- `node tests/phase13/service-behaviour.test.cjs` -> pass (7/7)
|
||||
- `node tests/phase14/service-behaviour.test.cjs` -> pass (5/5)
|
||||
- `node tests/phase15/service-behaviour.test.cjs` -> pass (5/5)
|
||||
- `npm run lint` -> warnings only (pre-existing hook dependency warnings)
|
||||
- Manual checks on `localhost:3002`:
|
||||
- invalid/missing hash for each selected handler -> 400
|
||||
- missing required params where applicable -> 400
|
||||
- valid-hash spot-check (`setupcontainer`) -> 200
|
||||
|
||||
Follow-ups:
|
||||
|
||||
- Continue small-batch consistency hardening for remaining sensitive handlers where guard patterns are still inconsistent.
|
||||
- Keep manual happy-path checks constrained to feasible local dependencies; document downstream/environment-caused failures separately.
|
||||
|
||||
@@ -588,6 +588,68 @@
|
||||
3. Remove `tests/phase8/service-behaviour.test.cjs` if full slice rollback required.
|
||||
4. Re-run phase6/7 baseline tests + lint after rollback.
|
||||
|
||||
## Latest update (2026-03-13 — Phase 15 hardening slice)
|
||||
|
||||
- New branch created from `origin/SIPS-Development` with confirmed work item prefix:
|
||||
- `TASK22028-phase15-hardening-slice`
|
||||
- Delivered a small consistency-only hardening slice across 4 additional sensitive file handlers:
|
||||
- `pages/api/file/upload.js`
|
||||
- `pages/api/file/uploadsinglefile.js`
|
||||
- `pages/api/file/createappealcompletemessage_api.js`
|
||||
- `pages/api/file/setupcontainer.js`
|
||||
- Scope delivered:
|
||||
- standardized explicit early 400 handling for missing hash in handlers where hash validation was present but missing-hash guard was inconsistent
|
||||
- standardized guard style in `setupcontainer` to early-return on hash mismatch (same status/contract)
|
||||
- standardized missing required hash handling in `createappealcompletemessage_api`
|
||||
- preserved response shapes and signatures (no contract changes)
|
||||
- Added focused phase-15 tests:
|
||||
- `tests/phase15/service-behaviour.test.cjs`
|
||||
- negative-path coverage for missing hash across all 4 handlers
|
||||
- additional required-input checks where applicable
|
||||
- one valid-hash happy-path contract check (`setupcontainer` -> 200 with existing response shape)
|
||||
|
||||
### Validation snapshot (Phase 15)
|
||||
|
||||
- `node tests/phase6/service-parity.test.cjs` -> **pass**
|
||||
- `node tests/phase6/service-behaviour.test.cjs` -> **pass** (8/8)
|
||||
- `node tests/phase7/service-behaviour.test.cjs` -> **pass** (10/10)
|
||||
- `node tests/phase8/service-behaviour.test.cjs` -> **pass** (5/5)
|
||||
- `node tests/phase9/service-behaviour.test.cjs` -> **pass** (5/5)
|
||||
- `node tests/phase10/service-behaviour.test.cjs` -> **pass** (5/5)
|
||||
- `node tests/phase11/service-behaviour.test.cjs` -> **pass** (4/4)
|
||||
- `node tests/phase12/service-behaviour.test.cjs` -> **pass** (4/4)
|
||||
- `node tests/phase13/service-behaviour.test.cjs` -> **pass** (7/7)
|
||||
- `node tests/phase14/service-behaviour.test.cjs` -> **pass** (5/5)
|
||||
- `node tests/phase15/service-behaviour.test.cjs` -> **pass** (5/5)
|
||||
- `npm run lint` -> **warnings only** (pre-existing `react-hooks/exhaustive-deps` warnings)
|
||||
|
||||
### Manual HTTP snapshot (Phase 15)
|
||||
|
||||
- Dev server run on `http://localhost:3002`.
|
||||
- Negative-path checks:
|
||||
- `POST /api/file/upload` missing hash -> **400**
|
||||
- `POST /api/file/upload?hash=wrong` -> **400**
|
||||
- `POST /api/file/uploadsinglefile` missing hash -> **400**
|
||||
- `POST /api/file/uploadsinglefile?hash=wrong` -> **400**
|
||||
- `GET /api/file/createappealcompletemessage_api?container=c1&tempcaseref=t1` missing hash -> **400**
|
||||
- `GET /api/file/createappealcompletemessage_api?container=c1&tempcaseref=t1&hash=wrong` -> **400**
|
||||
- `GET /api/file/createappealcompletemessage_api?container=c1` missing required params/hash -> **400**
|
||||
- `GET /api/file/setupcontainer?ident=c1` missing hash -> **400**
|
||||
- `GET /api/file/setupcontainer?ident=c1&hash=wrong` -> **400**
|
||||
- `GET /api/file/setupcontainer?hash=<valid>` missing required `ident` -> **400**
|
||||
- Valid-hash spot-check:
|
||||
- `GET /api/file/setupcontainer?ident=c1&hash=<valid>` -> **200**
|
||||
|
||||
### Rollback plan (Phase 15)
|
||||
|
||||
1. Revert these files:
|
||||
- `pages/api/file/upload.js`
|
||||
- `pages/api/file/uploadsinglefile.js`
|
||||
- `pages/api/file/createappealcompletemessage_api.js`
|
||||
- `pages/api/file/setupcontainer.js`
|
||||
- `tests/phase15/service-behaviour.test.cjs`
|
||||
2. Re-run phase6–phase15 tests and lint to confirm parity.
|
||||
|
||||
## Outstanding risks / gaps
|
||||
|
||||
- Navigation regressions across EN/CY + route query combinations.
|
||||
|
||||
@@ -467,6 +467,44 @@ Status key: `[x] done`, `[ ] pending`
|
||||
- Revert `b8fa514` to remove getrepsblob contract-alignment + Quill import fix.
|
||||
- Re-run phase6–phase14 tests and lint after rollback.
|
||||
|
||||
### Phase 15 completion snapshot (2026-03-13)
|
||||
|
||||
Status key: `[x] done`, `[ ] pending`
|
||||
|
||||
1. `[x]` Create new branch from `origin/SIPS-Development` with required work item prefix
|
||||
- branch: `TASK22028-phase15-hardening-slice`
|
||||
2. `[x]` Apply minimal consistency-only hardening in 4 additional sensitive handlers
|
||||
- `pages/api/file/upload.js`
|
||||
- `pages/api/file/uploadsinglefile.js`
|
||||
- `pages/api/file/createappealcompletemessage_api.js`
|
||||
- `pages/api/file/setupcontainer.js`
|
||||
3. `[x]` Standardize negative-path behavior
|
||||
- explicit early 400 for missing/invalid hash in selected handlers
|
||||
- explicit missing required-input checks where route contract requires them
|
||||
- preserved response-shape contracts and function signatures
|
||||
4. `[x]` Add focused Phase 15 tests
|
||||
- added `tests/phase15/service-behaviour.test.cjs`
|
||||
- includes negative-path tests for missing/invalid hash + required-input checks
|
||||
- includes one valid-hash mocked happy-path response-shape check
|
||||
5. `[x]` Execute required validation bundle
|
||||
- phase6 parity + phase6–phase14 behaviour tests -> pass
|
||||
- phase15 behaviour tests -> pass
|
||||
- lint -> warnings only (pre-existing)
|
||||
6. `[x]` Execute targeted manual checks
|
||||
- missing/invalid hash across selected handlers -> 400
|
||||
- missing required params where applicable -> 400
|
||||
- valid-hash `setupcontainer` spot-check -> 200
|
||||
|
||||
### Phase 15 rollback notes
|
||||
|
||||
- Revert these files to rollback the full hardening slice:
|
||||
- `pages/api/file/upload.js`
|
||||
- `pages/api/file/uploadsinglefile.js`
|
||||
- `pages/api/file/createappealcompletemessage_api.js`
|
||||
- `pages/api/file/setupcontainer.js`
|
||||
- `tests/phase15/service-behaviour.test.cjs`
|
||||
- Re-run phase6–phase15 baseline tests and lint after rollback to confirm parity.
|
||||
|
||||
## Safe execution mode for migration chunks (required)
|
||||
|
||||
To reduce terminal hangs during bulk migration work, run refactor chunks in **safe stepwise mode** instead of long chained commands.
|
||||
|
||||
Reference in New Issue
Block a user