robbond/pedwfrontend
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

TASK22224: align delete file route hash guards and contracts

Browse Source
This commit is contained in:
robbond
2026-03-23 17:31:25 +00:00
parent bc483c5097
commit 8e0131d1ce
5 changed files with 354 additions and 44 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pages/api/file/deleteblob.js
+54 -17
View File
@@ -9,10 +9,10 @@ const ApiProxy = nextConnect();
ApiProxy.use(middleware);
ApiProxy.get(async (req, res) => {
var containerName = req.query.container;
var casefolderID = req.query.casefolderID;
var blobName = req.query.blobname;
var checkHash = req.query.hash;
const containerName = req.query.container;
const casefolderID = req.query.casefolderID;
const blobName = req.query.blobname;
const checkHash = req.query.hash;
if (
typeof containerName === "undefined" ||
@@ -31,15 +31,41 @@ ApiProxy.get(async (req, res) => {
});
}
var checkquerypath =
"/api/file/deleteblob?container=" +
containerName +
"&casefolderID=" +
encodeURIComponent(casefolderID) +
"&blobname=" +
encodeURIComponent(blobName);
const casefolderIDTrimmed = casefolderID.trim();
const blobNameTrimmed = blobName.trim();
if (hashAPIPath(checkquerypath) != "&hash=" + checkHash) {
const hashCandidatePaths = [
"/api/file/deleteblob?container=" +
containerName +
"&casefolderID=" +
casefolderIDTrimmed +
"&blobname=" +
blobNameTrimmed,
"/api/file/deleteblob?container=" +
containerName +
"&casefolderID=" +
encodeURIComponent(casefolderIDTrimmed) +
"&blobname=" +
blobNameTrimmed,
"/api/file/deleteblob?container=" +
containerName +
"&casefolderID=" +
casefolderIDTrimmed +
"&blobname=" +
encodeURIComponent(blobNameTrimmed),
"/api/file/deleteblob?container=" +
containerName +
"&casefolderID=" +
encodeURIComponent(casefolderIDTrimmed) +
"&blobname=" +
encodeURIComponent(blobNameTrimmed)
];
const isHashValid = hashCandidatePaths.some(
(candidatePath) => hashAPIPath(candidatePath) == "&hash=" + checkHash
);
if (!isHashValid) {
return respondError(res, {
status: 400,
code: "INVALID_HASH",
@@ -47,11 +73,22 @@ ApiProxy.get(async (req, res) => {
});
}
await deleteBlob(containerName, casefolderID + "/files/" + blobName).then(
(data) => {
return respondSuccess(res, { data: data });
}
);
try {
const normalizedBlobName = blobNameTrimmed.startsWith(
casefolderIDTrimmed + "/"
)
? blobNameTrimmed
: casefolderIDTrimmed + "/files/" + blobNameTrimmed;
const data = await deleteBlob(containerName, normalizedBlobName);
return respondSuccess(res, { data: data });
} catch (error) {
return respondError(res, {
status: 400,
code: "DELETE_BLOB_FAILED",
message: "Unable to delete blob"
});
}
});
export const config = {
pages/api/file/deleteblobcase.js
+29 -11
View File
@@ -9,9 +9,9 @@ const ApiProxy = nextConnect();
ApiProxy.use(middleware);
ApiProxy.get(async (req, res) => {
var containerName = req.query.container;
var casefolderID = req.query.casefolderID;
var checkHash = req.query.hash;
const containerName = req.query.container;
const casefolderID = req.query.casefolderID;
const checkHash = req.query.hash;
if (
typeof containerName === "undefined" ||
@@ -28,13 +28,24 @@ ApiProxy.get(async (req, res) => {
});
}
var checkquerypath =
"/api/file/deleteblobcase?container=" +
containerName +
"&casefolderID=" +
casefolderID;
const casefolderIDTrimmed = casefolderID.trim();
if (hashAPIPath(checkquerypath) != "&hash=" + checkHash) {
const hashCandidatePaths = [
"/api/file/deleteblobcase?container=" +
containerName +
"&casefolderID=" +
casefolderIDTrimmed,
"/api/file/deleteblobcase?container=" +
containerName +
"&casefolderID=" +
encodeURIComponent(casefolderIDTrimmed)
];
const isHashValid = hashCandidatePaths.some(
(candidatePath) => hashAPIPath(candidatePath) == "&hash=" + checkHash
);
if (!isHashValid) {
return respondError(res, {
status: 400,
code: "INVALID_HASH",
@@ -42,9 +53,16 @@ ApiProxy.get(async (req, res) => {
});
}
await deleteBlobCase(containerName, casefolderID).then((data) => {
try {
const data = await deleteBlobCase(containerName, casefolderIDTrimmed);
return respondSuccess(res, { data: data });
});
} catch (error) {
return respondError(res, {
status: 400,
code: "DELETE_BLOB_CASE_FAILED",
message: "Unable to delete blob case"
});
}
});
export const config = {
pages/api/file/deleteblobrep.js
+48 -16
View File
@@ -9,10 +9,10 @@ const ApiProxy = nextConnect();
ApiProxy.use(middleware);
ApiProxy.get(async (req, res) => {
var containerName = req.query.container;
var casefolderID = req.query.casefolderID;
var repfile = req.query.repfile;
var checkHash = req.query.hash;
const containerName = req.query.container;
const casefolderID = req.query.casefolderID;
const repfile = req.query.repfile;
const checkHash = req.query.hash;
if (
typeof containerName === "undefined" ||
@@ -31,15 +31,41 @@ ApiProxy.get(async (req, res) => {
});
}
var checkquerypath =
"/api/file/deleteblobrep?container=" +
containerName +
"&casefolderID=" +
casefolderID +
"&repfile=" +
repfile;
const casefolderIDTrimmed = casefolderID.trim();
const repfileTrimmed = repfile.trim();
if (hashAPIPath(checkquerypath) != "&hash=" + checkHash) {
const hashCandidatePaths = [
"/api/file/deleteblobrep?container=" +
containerName +
"&casefolderID=" +
casefolderIDTrimmed +
"&repfile=" +
repfileTrimmed,
"/api/file/deleteblobrep?container=" +
containerName +
"&casefolderID=" +
encodeURIComponent(casefolderIDTrimmed) +
"&repfile=" +
repfileTrimmed,
"/api/file/deleteblobrep?container=" +
containerName +
"&casefolderID=" +
casefolderIDTrimmed +
"&repfile=" +
encodeURIComponent(repfileTrimmed),
"/api/file/deleteblobrep?container=" +
containerName +
"&casefolderID=" +
encodeURIComponent(casefolderIDTrimmed) +
"&repfile=" +
encodeURIComponent(repfileTrimmed)
];
const isHashValid = hashCandidatePaths.some(
(candidatePath) => hashAPIPath(candidatePath) == "&hash=" + checkHash
);
if (!isHashValid) {
return respondError(res, {
status: 400,
code: "INVALID_HASH",
@@ -47,11 +73,17 @@ ApiProxy.get(async (req, res) => {
});
}
casefolderID = casefolderID + "/" + repfile;
await deleteBlobRep(containerName, casefolderID).then((data) => {
try {
const normalizedRepPath = casefolderIDTrimmed + "/" + repfileTrimmed;
const data = await deleteBlobRep(containerName, normalizedRepPath);
return respondSuccess(res, { data: data });
});
} catch (error) {
return respondError(res, {
status: 400,
code: "DELETE_BLOB_REP_FAILED",
message: "Unable to delete blob representation"
});
}
});
export const config = {