TASK22028: expand signer coverage for delete flows

memory-bank/activeContext.md

@@ -529,6 +529,18 @@
 - Added focused behavioural test:
     - `tests/phase14/service-behaviour.test.cjs` now includes allow-list coverage for deleteblobcase path.
 
+## Follow-up status (2026-03-13 — additional delete flows)
+
+- Expanded signer allow-list for additional browser delete paths:
+    - `/api/endpoint/deletemyrepresentations_api`
+    - `/api/endpoint/deletewatchedcases_api`
+    - `/api/file/deleteblobrep`
+- Migrated affected direct-service delete calls to signer-based hash retrieval:
+    - `portalDirectService.deleteWatchedCases`
+    - `portalDirectService.deleteMyRepresentations`
+    - `documentDirectService.deleteAwaitingSubmissionsFromBlob`
+    - `documentDirectService.deleteMyRepresentationsFromBlob`
+
 ## Likely next steps
 
 1. Stabilize and simplify breadcrumb/back-link decision logic with focused regression checks.

memory-bank/change-log.md

@@ -1045,3 +1045,40 @@ Validation:
 Follow-ups:
 
 - Keep signer allow-list additions minimal and path-specific.
+
+---
+
+### CL-029: Follow-up fix — signer coverage for additional delete flows
+
+date: 2026-03-13
+author: Cline
+scope: `actions/services/{portalDirectService,documentDirectService}.js`, `pages/api/endpoint/gethash_api.js`, `tests/phase7/service-behaviour.test.cjs`, `tests/phase14/service-behaviour.test.cjs`
+type: change
+rationale: Resolve browser hash-signing gaps for additional delete operations still using direct client hash generation.
+impact: Restores browser-safe signing for delete watched cases, delete my representations, and delete blob representation/awaiting-submission paths while retaining authenticated allow-list signer model.
+status: completed
+
+Summary:
+
+- Updated signer allow-list to include:
+    - `/api/endpoint/deletemyrepresentations_api`
+    - `/api/endpoint/deletewatchedcases_api`
+    - `/api/file/deleteblobrep`
+- Migrated direct service calls to signer-based hash retrieval for:
+    - `portalDirectService.deleteWatchedCases`
+    - `portalDirectService.deleteMyRepresentations`
+    - `documentDirectService.deleteAwaitingSubmissionsFromBlob`
+    - `documentDirectService.deleteMyRepresentationsFromBlob`
+- Extended focused tests:
+    - `tests/phase7/service-behaviour.test.cjs` (service signer usage)
+    - `tests/phase14/service-behaviour.test.cjs` (allow-list coverage)
+
+Validation:
+
+- `node tests/phase7/service-behaviour.test.cjs` -> pass (12/12)
+- `node tests/phase14/service-behaviour.test.cjs` -> pass (9/9)
+- `npm run lint` -> warnings only (pre-existing)
+
+Follow-ups:
+
+- Keep allow-list expansion path-scoped and driven by concrete browser-call requirements only.

memory-bank/refactor-plan-actions-index.md

@@ -551,6 +551,20 @@ Status key: `[x] done`, `[ ] pending`
 
 - Revert commit `49dd990` to undo allow-list/test follow-up.
 
+### Follow-up completion snapshot (2026-03-13 — additional delete flows)
+
+1. `[x]` Expand signer allow-list for required browser delete paths
+2. `[x]` Move remaining delete service calls to signer-based hash retrieval
+3. `[x]` Extend focused service/signer tests
+4. `[x]` Validate
+    - phase7 behaviour tests pass (12/12)
+    - phase14 behaviour tests pass (9/9)
+    - lint warnings only (pre-existing)
+
+### Follow-up rollback notes (additional delete flows)
+
+- Revert the follow-up commit for this slice to restore prior hashing behavior.
+
 ## Safe execution mode for migration chunks (required)
 
 To reduce terminal hangs during bulk migration work, run refactor chunks in **safe stepwise mode** instead of long chained commands.