TASK22224: align delete file route hash guards and contracts

pages/api/file/deleteblobcase.js

@@ -9,9 +9,9 @@ const ApiProxy = nextConnect();
 ApiProxy.use(middleware);
 
 ApiProxy.get(async (req, res) => {
-    var containerName = req.query.container;
-    var casefolderID = req.query.casefolderID;
-    var checkHash = req.query.hash;
+    const containerName = req.query.container;
+    const casefolderID = req.query.casefolderID;
+    const checkHash = req.query.hash;
 
     if (
         typeof containerName === "undefined" ||
@@ -28,13 +28,24 @@ ApiProxy.get(async (req, res) => {
         });
     }
 
-    var checkquerypath =
-        "/api/file/deleteblobcase?container=" +
-        containerName +
-        "&casefolderID=" +
-        casefolderID;
+    const casefolderIDTrimmed = casefolderID.trim();
 
-    if (hashAPIPath(checkquerypath) != "&hash=" + checkHash) {
+    const hashCandidatePaths = [
+        "/api/file/deleteblobcase?container=" +
+            containerName +
+            "&casefolderID=" +
+            casefolderIDTrimmed,
+        "/api/file/deleteblobcase?container=" +
+            containerName +
+            "&casefolderID=" +
+            encodeURIComponent(casefolderIDTrimmed)
+    ];
+
+    const isHashValid = hashCandidatePaths.some(
+        (candidatePath) => hashAPIPath(candidatePath) == "&hash=" + checkHash
+    );
+
+    if (!isHashValid) {
         return respondError(res, {
             status: 400,
             code: "INVALID_HASH",
@@ -42,9 +53,16 @@ ApiProxy.get(async (req, res) => {
         });
     }
 
-    await deleteBlobCase(containerName, casefolderID).then((data) => {
+    try {
+        const data = await deleteBlobCase(containerName, casefolderIDTrimmed);
         return respondSuccess(res, { data: data });
-    });
+    } catch (error) {
+        return respondError(res, {
+            status: 400,
+            code: "DELETE_BLOB_CASE_FAILED",
+            message: "Unable to delete blob case"
+        });
+    }
 });
 
 export const config = {