robbond/pedwfrontend
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

TASK22224: align delete file route hash guards and contracts

Browse Source
This commit is contained in:
robbond
2026-03-23 17:31:25 +00:00
parent bc483c5097
commit 8e0131d1ce
5 changed files with 354 additions and 44 deletions
Download Patch File Download Diff File Expand all files Collapse all files
memory-bank/change-log.md
+41
View File
@@ -215,3 +215,44 @@ Follow-ups:
- Next recommended slice on this branch: complete file-route guard parity for `deleteblob.js`, `deleteblobcase.js`, and `deleteblobrep.js` by aligning hash validation canonicalization and explicit `respondError` contracts (`MISSING_REQUIRED_QUERY`, `INVALID_HASH`, operation-specific `*_FAILED`).
- Extend `tests/phase21/file-handler-contract.test.cjs` for the above routes with mixed encoded/raw hash cases to lock compatibility.
---
### CL-006: TASK22224 file delete-route guard parity slice
date: 2026-03-23
author: Cline
scope: `pages/api/file/{deleteblob,deleteblobcase,deleteblobrep}.js`, `tests/phase21/file-handler-contract.test.cjs`
type: change
rationale: Execute the next planned slice to align hash/canonicalization behavior and negative-path contracts across high-risk file delete routes, matching the compatibility posture established for `downloadblob`.
impact: Reduces false `INVALID_HASH` failures for legitimate encoded/raw caller variants while preserving strict hash enforcement and improving resilience via explicit catch-path contracts.
status: completed
Summary:
- `deleteblob.js`
- added bounded hash candidate validation for encoded/raw combinations of `casefolderID` and `blobname`
- normalized delete path handling for both filename-only and already-prefixed blob paths
- added explicit catch-path contract: `DELETE_BLOB_FAILED`
- `deleteblobcase.js`
- added hash candidate validation for raw/encoded `casefolderID`
- added explicit catch-path contract: `DELETE_BLOB_CASE_FAILED`
- `deleteblobrep.js`
- added hash candidate validation for encoded/raw `casefolderID` + `repfile`
- added explicit catch-path contract: `DELETE_BLOB_REP_FAILED`
- Phase21 tests expanded (`file-handler-contract.test.cjs`):
- encoded hash-variant acceptance cases for all three delete routes
- explicit dependency-failure contract assertions for all three delete routes
Validation:
- `node tests/phase21/file-handler-contract.test.cjs` -> pass (23/23)
- `node tests/phase21/api-contract-slice1.test.cjs` -> pass
- helper: 4/4
- file-handler: 23/23
- email-handler: 12/12
- endpoint-handler: 149/149
Follow-ups:
- Optional next slice: apply same bounded hash-canonicalization parity to remaining high-sensitivity file routes where mixed encoded/raw callers may exist (`getbloblist`, `getprogressobjblob`) and add regression cases to phase21.