test: cover ITHC cross-user blob deletion protection

2026-11-06 13:02:49 +00:00
parent c49b491698
commit 946d361a67
1 changed files with 69 additions and 0 deletions
@@ -5591,6 +5591,75 @@ test("createcase_api preserves the existing propagated token dependency failure
    assert.strictEqual(loaded.calls.appealBlob.length, 0);
 });

+const loadRepresentationDeletion = (route, operationName, session) => {
+    const calls = [];
+    const mod = loadModule(route, {
+        nextConnect: createNextConnectMock(),
+        middleware: () => {},
+        getServerSession: async () => session,
+        authOptions: () => ({}),
+        hashAPIPath: () => "&hash=expected",
+        respondError: respondErrorMock,
+        respondSuccess: respondSuccessMock,
+        [operationName]: async (...args) => {
+            calls.push(args);
+            return { deleted: true };
+        }
+    });
+
+    return { mod, calls };
+};
+
+test("whole-representation deletion remains cross-user protected with zero Azure operations", async () => {
+    const loaded = loadRepresentationDeletion(
+        "pages/api/file/deleteblobrep.js",
+        "deleteBlobRep",
+        { user: { id: "different-container" } }
+    );
+    const res = createRes();
+
+    await loaded.mod.default.handler(
+        {
+            query: {
+                container: "organisation-container",
+                casefolderID: "CASE-1",
+                repfile: "REP-1",
+                hash: "expected"
+            }
+        },
+        res
+    );
+
+    assert.strictEqual(res.state.statusCode, 403);
+    assert.strictEqual(res.state.jsonBody.error.code, "FORBIDDEN");
+    assert.strictEqual(loaded.calls.length, 0);
+});
+
+test("representation supporting-file deletion remains cross-user protected with zero Azure operations", async () => {
+    const loaded = loadRepresentationDeletion(
+        "pages/api/file/deleteblob.js",
+        "deleteBlob",
+        { user: { id: "different-container" } }
+    );
+    const res = createRes();
+
+    await loaded.mod.default.handler(
+        {
+            query: {
+                container: "organisation-container",
+                casefolderID: "CASE-1/REP-1",
+                blobname: "evidence.pdf",
+                hash: "expected"
+            }
+        },
+        res
+    );
+
+    assert.strictEqual(res.state.statusCode, 403);
+    assert.strictEqual(res.state.jsonBody.error.code, "FORBIDDEN");
+    assert.strictEqual(loaded.calls.length, 0);
+});
+
 const run = async () => {
    let passed = 0;
    for (const currentTest of tests) {