TASK22028: expand signer coverage for delete flows

tests/phase14/service-behaviour.test.cjs

@@ -152,6 +152,72 @@ test("gethash_api returns hash for allow-listed deleteblobcase path", async () =
     });
 });
 
+test("gethash_api returns hash for allow-listed deleteblobrep path", async () => {
+    const mod = loadModule("pages/api/endpoint/gethash_api.js", {
+        hashAPIPath: () => "&hash=deleterep",
+        getSession: async () => ({ user: { id: "u1" } }),
+        nextConnect: createNextConnectMock(),
+        middleware: () => {}
+    });
+
+    const req = {
+        query: {
+            path: "/api/file/deleteblobrep?container=c1&casefolderID=r1&repfile=f1"
+        }
+    };
+    const res = createRes();
+    await mod.default.handler(req, res);
+
+    assert.strictEqual(res.state.statusCode, 200);
+    assert.deepStrictEqual(JSON.parse(JSON.stringify(res.state.jsonBody)), {
+        hash: "&hash=deleterep"
+    });
+});
+
+test("gethash_api returns hash for allow-listed deletewatchedcases path", async () => {
+    const mod = loadModule("pages/api/endpoint/gethash_api.js", {
+        hashAPIPath: () => "&hash=watch",
+        getSession: async () => ({ user: { id: "u1" } }),
+        nextConnect: createNextConnectMock(),
+        middleware: () => {}
+    });
+
+    const req = {
+        query: {
+            path: "/api/endpoint/deletewatchedcases_api?watchedCaseID=123"
+        }
+    };
+    const res = createRes();
+    await mod.default.handler(req, res);
+
+    assert.strictEqual(res.state.statusCode, 200);
+    assert.deepStrictEqual(JSON.parse(JSON.stringify(res.state.jsonBody)), {
+        hash: "&hash=watch"
+    });
+});
+
+test("gethash_api returns hash for allow-listed deletemyrepresentations path", async () => {
+    const mod = loadModule("pages/api/endpoint/gethash_api.js", {
+        hashAPIPath: () => "&hash=delrep",
+        getSession: async () => ({ user: { id: "u1" } }),
+        nextConnect: createNextConnectMock(),
+        middleware: () => {}
+    });
+
+    const req = {
+        query: {
+            path: "/api/endpoint/deletemyrepresentations_api?myRepresentationsID=abc"
+        }
+    };
+    const res = createRes();
+    await mod.default.handler(req, res);
+
+    assert.strictEqual(res.state.statusCode, 200);
+    assert.deepStrictEqual(JSON.parse(JSON.stringify(res.state.jsonBody)), {
+        hash: "&hash=delrep"
+    });
+});
+
 test("gethash_api rejects unauthenticated requests with 401", async () => {
     const mod = loadModule("pages/api/endpoint/gethash_api.js", {
         hashAPIPath: () => "&hash=expected",

tests/phase7/service-behaviour.test.cjs

@@ -155,10 +155,15 @@ test("document/getAwaitingSubmissionFromBlob logs and returns undefined on failu
 test("portal/deleteMyRepresentations appends hash and returns data", async () => {
     const axios = createAxiosMock();
     const logger = createLoggerMock();
-    const hashCalls = [];
-    const hashAPIPath = (queryPath) => {
-        hashCalls.push(queryPath);
-        return "&hash=portal123";
+    const signCalls = [];
+
+    axios.getHandler = async (url) => {
+        if (url.startsWith("/api/endpoint/gethash_api?path=")) {
+            signCalls.push(url);
+            return { data: { hash: "&hash=portal123" } };
+        }
+
+        throw new Error("Unexpected get url: " + url);
     };
 
     axios.requestHandler = async () => ({ data: { removed: true } });
@@ -167,28 +172,39 @@ test("portal/deleteMyRepresentations appends hash and returns data", async () =>
         axios,
         BASE_URL: "",
         consoleLogger: logger.consoleLogger,
-        hashAPIPath
+        hashAPIPath: () => "&hash=fallback"
     });
 
     const result = await portal.deleteMyRepresentations("rep-1");
 
     assert.deepStrictEqual(normalize(result), { removed: true });
-    assert.strictEqual(hashCalls.length, 1);
     assert.strictEqual(
-        hashCalls[0],
-        "/api/endpoint/deletemyrepresentations_api?myRepresentationsID=rep-1"
+        signCalls[0],
+        "/api/endpoint/gethash_api?path=%2Fapi%2Fendpoint%2Fdeletemyrepresentations_api%3FmyRepresentationsID%3Drep-1"
     );
     assert.strictEqual(
-        axios.calls[0].config.url,
+        axios.calls[0].url,
+        "/api/endpoint/gethash_api?path=%2Fapi%2Fendpoint%2Fdeletemyrepresentations_api%3FmyRepresentationsID%3Drep-1"
+    );
+    assert.strictEqual(
+        axios.calls[1].config.url,
         "/api/endpoint/deletemyrepresentations_api?myRepresentationsID=rep-1&hash=portal123"
     );
-    assert.strictEqual(axios.calls[0].config.method, "delete");
+    assert.strictEqual(axios.calls[1].config.method, "delete");
 });
 
 test("portal/deleteMyRepresentations logs and returns undefined on failure", async () => {
     const axios = createAxiosMock();
     const logger = createLoggerMock();
 
+    axios.getHandler = async (url) => {
+        if (url.startsWith("/api/endpoint/gethash_api?path=")) {
+            return { data: { hash: "&hash=portal-fail" } };
+        }
+
+        throw new Error("Unexpected get url: " + url);
+    };
+
     axios.requestHandler = async () =>
         Promise.reject(createAxiosError(401, "Unauthorized"));
 
@@ -196,7 +212,7 @@ test("portal/deleteMyRepresentations logs and returns undefined on failure", asy
         axios,
         BASE_URL: "",
         consoleLogger: logger.consoleLogger,
-        hashAPIPath: () => "&hash=portal-fail"
+        hashAPIPath: () => "&hash=fallback"
     });
 
     const result = await portal.deleteMyRepresentations("rep-2");
@@ -205,6 +221,87 @@ test("portal/deleteMyRepresentations logs and returns undefined on failure", asy
     assert.strictEqual(logger.calls.length, 1);
 });
 
+test("portal/deleteWatchedCases uses signer hash and returns data", async () => {
+    const axios = createAxiosMock();
+    const logger = createLoggerMock();
+    const signCalls = [];
+
+    axios.getHandler = async (url) => {
+        if (url.startsWith("/api/endpoint/gethash_api?path=")) {
+            signCalls.push(url);
+            return { data: { hash: "&hash=watch123" } };
+        }
+
+        throw new Error("Unexpected get url: " + url);
+    };
+
+    axios.requestHandler = async () => ({ data: { removed: true } });
+
+    const portal = loadServiceModule("portalDirectService.js", {
+        axios,
+        BASE_URL: "",
+        consoleLogger: logger.consoleLogger,
+        hashAPIPath: () => "&hash=fallback"
+    });
+
+    const result = await portal.deleteWatchedCases("watch-1");
+
+    assert.deepStrictEqual(normalize(result), { removed: true });
+    assert.strictEqual(
+        signCalls[0],
+        "/api/endpoint/gethash_api?path=%2Fapi%2Fendpoint%2Fdeletewatchedcases_api%3FwatchedCaseID%3Dwatch-1"
+    );
+    assert.strictEqual(
+        axios.calls[1].config.url,
+        "/api/endpoint/deletewatchedcases_api?watchedCaseID=watch-1&hash=watch123"
+    );
+});
+
+test("document delete blob flows use signer hash", async () => {
+    const axios = createAxiosMock();
+    const logger = createLoggerMock();
+    const signCalls = [];
+
+    axios.getHandler = async (url) => {
+        if (url.startsWith("/api/endpoint/gethash_api?path=")) {
+            signCalls.push(url);
+            return { data: { hash: "&hash=doc123" } };
+        }
+
+        throw new Error("Unexpected get url: " + url);
+    };
+
+    axios.requestHandler = async () => ({ data: { ok: true } });
+
+    const document = loadServiceModule("documentDirectService.js", {
+        axios,
+        BASE_URL: "",
+        consoleLogger: logger.consoleLogger,
+        hashAPIPath: () => "&hash=fallback"
+    });
+
+    const one = await document.deleteAwaitingSubmissionsFromBlob(
+        "c1",
+        "case-1"
+    );
+    const two = await document.deleteMyRepresentationsFromBlob(
+        "c1",
+        "case-1",
+        "rep-a"
+    );
+
+    assert.deepStrictEqual(normalize(one), { ok: true });
+    assert.deepStrictEqual(normalize(two), { ok: true });
+    assert.strictEqual(
+        signCalls[0],
+        "/api/endpoint/gethash_api?path=%2Fapi%2Ffile%2Fdeleteblobcase%3Fcontainer%3Dc1%26casefolderID%3Dcase-1"
+    );
+    assert.strictEqual(
+        signCalls[1],
+        "/api/endpoint/gethash_api?path=%2Fapi%2Ffile%2Fdeleteblobrep%3Fcontainer%3Dc1%26casefolderID%3Dcase-1%26repfile%3Drep-a"
+    );
+});
+
 test("account/getPortalLogin appends hash and returns res.data", async () => {
     const axios = createAxiosMock();
     const logger = createLoggerMock();