robbond/pedwfrontend
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

TASK22028: phase 15 hash guard consistency hardening slice

Browse Source
This commit is contained in:
robbond
2026-03-13 16:04:31 +00:00
parent 0ca6cd94cc
commit 1a95cf1098
9 changed files with 458 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files
memory-bank/progress.md
+62
View File
@@ -588,6 +588,68 @@
3. Remove `tests/phase8/service-behaviour.test.cjs` if full slice rollback required.
4. Re-run phase6/7 baseline tests + lint after rollback.
## Latest update (2026-03-13 — Phase 15 hardening slice)
- New branch created from `origin/SIPS-Development` with confirmed work item prefix:
- `TASK22028-phase15-hardening-slice`
- Delivered a small consistency-only hardening slice across 4 additional sensitive file handlers:
- `pages/api/file/upload.js`
- `pages/api/file/uploadsinglefile.js`
- `pages/api/file/createappealcompletemessage_api.js`
- `pages/api/file/setupcontainer.js`
- Scope delivered:
- standardized explicit early 400 handling for missing hash in handlers where hash validation was present but missing-hash guard was inconsistent
- standardized guard style in `setupcontainer` to early-return on hash mismatch (same status/contract)
- standardized missing required hash handling in `createappealcompletemessage_api`
- preserved response shapes and signatures (no contract changes)
- Added focused phase-15 tests:
- `tests/phase15/service-behaviour.test.cjs`
- negative-path coverage for missing hash across all 4 handlers
- additional required-input checks where applicable
- one valid-hash happy-path contract check (`setupcontainer` -> 200 with existing response shape)
### Validation snapshot (Phase 15)
- `node tests/phase6/service-parity.test.cjs` -> **pass**
- `node tests/phase6/service-behaviour.test.cjs` -> **pass** (8/8)
- `node tests/phase7/service-behaviour.test.cjs` -> **pass** (10/10)
- `node tests/phase8/service-behaviour.test.cjs` -> **pass** (5/5)
- `node tests/phase9/service-behaviour.test.cjs` -> **pass** (5/5)
- `node tests/phase10/service-behaviour.test.cjs` -> **pass** (5/5)
- `node tests/phase11/service-behaviour.test.cjs` -> **pass** (4/4)
- `node tests/phase12/service-behaviour.test.cjs` -> **pass** (4/4)
- `node tests/phase13/service-behaviour.test.cjs` -> **pass** (7/7)
- `node tests/phase14/service-behaviour.test.cjs` -> **pass** (5/5)
- `node tests/phase15/service-behaviour.test.cjs` -> **pass** (5/5)
- `npm run lint` -> **warnings only** (pre-existing `react-hooks/exhaustive-deps` warnings)
### Manual HTTP snapshot (Phase 15)
- Dev server run on `http://localhost:3002`.
- Negative-path checks:
- `POST /api/file/upload` missing hash -> **400**
- `POST /api/file/upload?hash=wrong` -> **400**
- `POST /api/file/uploadsinglefile` missing hash -> **400**
- `POST /api/file/uploadsinglefile?hash=wrong` -> **400**
- `GET /api/file/createappealcompletemessage_api?container=c1&tempcaseref=t1` missing hash -> **400**
- `GET /api/file/createappealcompletemessage_api?container=c1&tempcaseref=t1&hash=wrong` -> **400**
- `GET /api/file/createappealcompletemessage_api?container=c1` missing required params/hash -> **400**
- `GET /api/file/setupcontainer?ident=c1` missing hash -> **400**
- `GET /api/file/setupcontainer?ident=c1&hash=wrong` -> **400**
- `GET /api/file/setupcontainer?hash=<valid>` missing required `ident` -> **400**
- Valid-hash spot-check:
- `GET /api/file/setupcontainer?ident=c1&hash=<valid>` -> **200**
### Rollback plan (Phase 15)
1. Revert these files:
- `pages/api/file/upload.js`
- `pages/api/file/uploadsinglefile.js`
- `pages/api/file/createappealcompletemessage_api.js`
- `pages/api/file/setupcontainer.js`
- `tests/phase15/service-behaviour.test.cjs`
2. Re-run phase6–phase15 tests and lint to confirm parity.
## Outstanding risks / gaps
- Navigation regressions across EN/CY + route query combinations.