TASK22224: harden file/static endpoint contracts and phase21 coverage

memory-bank/change-log.md

@@ -129,3 +129,49 @@ Follow-ups:
 
 - Continue with remaining non-standard API outlier(s), notably `pages/api/file/generateappealpdfcopy.js`.
 - Keep future slices logged in this file at commit-time now that memory-bank is versioned.
+
+---
+
+### CL-004: TASK22224 file + static endpoint contract hardening bundle (phase21)
+
+date: 2026-03-23  
+author: Cline  
+scope: `pages/api/file/{downloadblob,generateappealpdfcopy}.js`, `pages/api/endpoint/{getsipsmedia_api,getappealtypesfornewappeal_api}.js`, `tests/phase21/{file-handler-contract,endpoint-handler-contract}.test.cjs`  
+type: change  
+rationale: Deliver the agreed larger bounded slice for remaining non-standard file/static handlers, improving negative-path consistency while preserving current success payload behavior.  
+impact: Standardized error envelopes/codes for download and generated PDF copy flows, method guard parity for static endpoints, and expanded phase21 contract coverage for both file and endpoint handlers.  
+status: completed
+
+Summary:
+
+- `downloadblob.js`:
+    - added explicit catch-path response via `respondError` with `DOWNLOAD_BLOB_FAILED`
+    - kept success behavior intact (attachment header + raw file body)
+    - removed dead internal helper (`streamToBuffer`) and tightened local declarations
+- `generateappealpdfcopy.js`:
+    - removed unused imports/noisy console warnings
+    - standardized required-input and negative-path contracts:
+        - `INCIDENT_ID_REQUIRED` (400)
+        - `CASE_NOT_FOUND` (404)
+        - `FORM_COLLECTION_NOT_FOUND` (400)
+        - `APPEAL_PDF_COPY_GENERATION_FAILED` (400)
+    - preserved success output contract (PDF content headers + buffer body)
+- `getsipsmedia_api.js` and `getappealtypesfornewappeal_api.js`:
+    - added method guard for non-GET requests using `METHOD_NOT_ALLOWED` (405)
+    - preserved existing GET success payloads
+- Expanded phase21 tests:
+    - `file-handler-contract.test.cjs`: added coverage for download failure + full generated PDF copy contract/negative paths
+    - `endpoint-handler-contract.test.cjs`: added method guard tests for both static endpoints
+
+Validation:
+
+- `node tests/phase21/api-contract-slice1.test.cjs` -> pass
+    - helper: 4/4
+    - file-handler: 17/17
+    - email-handler: 12/12
+    - endpoint-handler: 149/149
+- `npm run lint` -> warnings only (pre-existing `react-hooks/exhaustive-deps`; no new lint errors)
+
+Follow-ups:
+
+- If desired, next slice can target remaining file-route parity candidates outside this bundle, but this closes the planned TASK22224 scope.