TASK22224: align delete file route hash guards and contracts

2026-03-23 17:31:25 +00:00
parent bc483c5097
commit 8e0131d1ce
5 changed files with 354 additions and 44 deletions
@@ -9,10 +9,10 @@ const ApiProxy = nextConnect();
 ApiProxy.use(middleware);

 ApiProxy.get(async (req, res) => {
-    var containerName = req.query.container;
-    var casefolderID = req.query.casefolderID;
-    var repfile = req.query.repfile;
-    var checkHash = req.query.hash;
+    const containerName = req.query.container;
+    const casefolderID = req.query.casefolderID;
+    const repfile = req.query.repfile;
+    const checkHash = req.query.hash;

    if (
        typeof containerName === "undefined" ||
@@ -31,15 +31,41 @@ ApiProxy.get(async (req, res) => {
        });
    }

-    var checkquerypath =
-        "/api/file/deleteblobrep?container=" +
-        containerName +
-        "&casefolderID=" +
-        casefolderID +
-        "&repfile=" +
-        repfile;
+    const casefolderIDTrimmed = casefolderID.trim();
+    const repfileTrimmed = repfile.trim();

-    if (hashAPIPath(checkquerypath) != "&hash=" + checkHash) {
+    const hashCandidatePaths = [
+        "/api/file/deleteblobrep?container=" +
+            containerName +
+            "&casefolderID=" +
+            casefolderIDTrimmed +
+            "&repfile=" +
+            repfileTrimmed,
+        "/api/file/deleteblobrep?container=" +
+            containerName +
+            "&casefolderID=" +
+            encodeURIComponent(casefolderIDTrimmed) +
+            "&repfile=" +
+            repfileTrimmed,
+        "/api/file/deleteblobrep?container=" +
+            containerName +
+            "&casefolderID=" +
+            casefolderIDTrimmed +
+            "&repfile=" +
+            encodeURIComponent(repfileTrimmed),
+        "/api/file/deleteblobrep?container=" +
+            containerName +
+            "&casefolderID=" +
+            encodeURIComponent(casefolderIDTrimmed) +
+            "&repfile=" +
+            encodeURIComponent(repfileTrimmed)
+    ];
+
+    const isHashValid = hashCandidatePaths.some(
+        (candidatePath) => hashAPIPath(candidatePath) == "&hash=" + checkHash
+    );
+
+    if (!isHashValid) {
        return respondError(res, {
            status: 400,
            code: "INVALID_HASH",
@@ -47,11 +73,17 @@ ApiProxy.get(async (req, res) => {
        });
    }

-    casefolderID = casefolderID + "/" + repfile;
-
-    await deleteBlobRep(containerName, casefolderID).then((data) => {
+    try {
+        const normalizedRepPath = casefolderIDTrimmed + "/" + repfileTrimmed;
+        const data = await deleteBlobRep(containerName, normalizedRepPath);
        return respondSuccess(res, { data: data });
-    });
+    } catch (error) {
+        return respondError(res, {
+            status: 400,
+            code: "DELETE_BLOB_REP_FAILED",
+            message: "Unable to delete blob representation"
+        });
+    }
 });

 export const config = {