robbond
0daeb783b9
Also repairs two stale Phase 21 fixtures: - Supplies a valid PDF to exercise the upload dependency-failure path. - Injects getPersonalAccount into the representation-involvement VM fixture.
78 lines
2.0 KiB
JavaScript
78 lines
2.0 KiB
JavaScript
import { deleteBlobRep } from "../../../actions/azurestorage";
|
|
import {
|
|
hasTrustedSameOrigin,
|
|
readAdminSessionCookie,
|
|
setAdminAuthNoStore,
|
|
validateAdminSession
|
|
} from "../../../lib/admin/adminAuth";
|
|
import { respondError, respondSuccess } from "../middleware/apiResponse";
|
|
|
|
const forbidden = (res) =>
|
|
respondError(res, {
|
|
status: 403,
|
|
code: "FORBIDDEN",
|
|
message: "Request not permitted"
|
|
});
|
|
|
|
const isValidContainer = (value) =>
|
|
typeof value === "string" &&
|
|
value.length >= 3 &&
|
|
value.length <= 63 &&
|
|
/^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$/.test(value);
|
|
|
|
const isValidPathSegment = (value) =>
|
|
typeof value === "string" &&
|
|
value.length > 0 &&
|
|
value.length <= 255 &&
|
|
value === value.trim() &&
|
|
value !== "." &&
|
|
value !== ".." &&
|
|
!/[\\/\u0000-\u001f\u007f]/.test(value);
|
|
|
|
export default async function handler(req, res) {
|
|
setAdminAuthNoStore(res);
|
|
res.setHeader("Allow", "POST");
|
|
|
|
if (req.method !== "POST") {
|
|
return respondError(res, {
|
|
status: 405,
|
|
code: "METHOD_NOT_ALLOWED",
|
|
message: "Method not allowed"
|
|
});
|
|
}
|
|
|
|
const adminSession = readAdminSessionCookie(req);
|
|
if (
|
|
!validateAdminSession(adminSession) ||
|
|
!hasTrustedSameOrigin(req)
|
|
) {
|
|
return forbidden(res);
|
|
}
|
|
|
|
const { container, casefolderID, repfile } = req.body ?? {};
|
|
if (
|
|
!isValidContainer(container) ||
|
|
!isValidPathSegment(casefolderID) ||
|
|
!isValidPathSegment(repfile)
|
|
) {
|
|
return respondError(res, {
|
|
status: 400,
|
|
code: "INVALID_REQUEST",
|
|
message: "Invalid request"
|
|
});
|
|
}
|
|
|
|
try {
|
|
const data = await deleteBlobRep(
|
|
container,
|
|
`${casefolderID}/${repfile}`
|
|
);
|
|
return respondSuccess(res, { data });
|
|
} catch (_error) {
|
|
return respondError(res, {
|
|
status: 400,
|
|
code: "DELETE_BLOB_REP_FAILED",
|
|
message: "Unable to delete blob representation"
|
|
});
|
|
}
|
|
} |