From 946d361a67c71ac7eb81be6d5818e02637f7878a Mon Sep 17 00:00:00 2001
From: robbond <rob@rdbsolutions.co.uk>
Date: Fri, 6 Nov 2026 13:02:49 +0000
Subject: [PATCH] test: cover ITHC cross-user blob deletion protection

---
 tests/phase21/file-handler-contract.test.cjs | 69 ++++++++++++++++++++
 1 file changed, 69 insertions(+)

diff --git a/tests/phase21/file-handler-contract.test.cjs b/tests/phase21/file-handler-contract.test.cjs
index a1ae3d79..3ecf8f68 100644
--- a/tests/phase21/file-handler-contract.test.cjs
+++ b/tests/phase21/file-handler-contract.test.cjs
@@ -5591,6 +5591,75 @@ test("createcase_api preserves the existing propagated token dependency failure
     assert.strictEqual(loaded.calls.appealBlob.length, 0);
 });
 
+const loadRepresentationDeletion = (route, operationName, session) => {
+    const calls = [];
+    const mod = loadModule(route, {
+        nextConnect: createNextConnectMock(),
+        middleware: () => {},
+        getServerSession: async () => session,
+        authOptions: () => ({}),
+        hashAPIPath: () => "&hash=expected",
+        respondError: respondErrorMock,
+        respondSuccess: respondSuccessMock,
+        [operationName]: async (...args) => {
+            calls.push(args);
+            return { deleted: true };
+        }
+    });
+
+    return { mod, calls };
+};
+
+test("whole-representation deletion remains cross-user protected with zero Azure operations", async () => {
+    const loaded = loadRepresentationDeletion(
+        "pages/api/file/deleteblobrep.js",
+        "deleteBlobRep",
+        { user: { id: "different-container" } }
+    );
+    const res = createRes();
+
+    await loaded.mod.default.handler(
+        {
+            query: {
+                container: "organisation-container",
+                casefolderID: "CASE-1",
+                repfile: "REP-1",
+                hash: "expected"
+            }
+        },
+        res
+    );
+
+    assert.strictEqual(res.state.statusCode, 403);
+    assert.strictEqual(res.state.jsonBody.error.code, "FORBIDDEN");
+    assert.strictEqual(loaded.calls.length, 0);
+});
+
+test("representation supporting-file deletion remains cross-user protected with zero Azure operations", async () => {
+    const loaded = loadRepresentationDeletion(
+        "pages/api/file/deleteblob.js",
+        "deleteBlob",
+        { user: { id: "different-container" } }
+    );
+    const res = createRes();
+
+    await loaded.mod.default.handler(
+        {
+            query: {
+                container: "organisation-container",
+                casefolderID: "CASE-1/REP-1",
+                blobname: "evidence.pdf",
+                hash: "expected"
+            }
+        },
+        res
+    );
+
+    assert.strictEqual(res.state.statusCode, 403);
+    assert.strictEqual(res.state.jsonBody.error.code, "FORBIDDEN");
+    assert.strictEqual(loaded.calls.length, 0);
+});
+
 const run = async () => {
     let passed = 0;
     for (const currentTest of tests) {