[history-v1] block deletion of bucket prefix that is not a valid project prefix (#22889)

Co-authored-by: Brian Gough <brian.gough@overleaf.com>
GitOrigin-RevId: a3aff76a2e299b2e2ed030e34da0631fce51ad4b

services/filestore/test/acceptance/js/FilestoreTests.js

@@ -1305,11 +1305,39 @@ describe('Filestore', function () {
         })
 
         describe('deleteDirectory', function () {
-          let checkGET2
+          let checkGET1, checkGET2
           beforeEach('create files', async function () {
-            await createRandomContent(fileUrl1, '1')
+            checkGET1 = await createRandomContent(fileUrl1, '1')
             checkGET2 = await createRandomContent(fileUrl2, '2')
           })
+          it('should refuse to delete top-level prefix', async function () {
+            await expect(
+              app.persistor.deleteDirectory(
+                Settings.filestore.stores.user_files,
+                projectId.slice(0, 3)
+              )
+            ).to.be.rejectedWith('not a project-folder')
+            expect(
+              await app.persistor.checkIfObjectExists(
+                Settings.filestore.stores.user_files,
+                fileKey1
+              )
+            ).to.equal(true)
+            await checkGET1()
+            expect(
+              await app.persistor.checkIfObjectExists(
+                Settings.filestore.stores.user_files,
+                fileKey2
+              )
+            ).to.equal(true)
+            expect(
+              await app.persistor.getDataEncryptionKeySize(
+                Settings.filestore.stores.user_files,
+                fileKey2
+              )
+            ).to.equal(32)
+            await checkGET2()
+          })
           it('should delete sub-folder and keep DEK', async function () {
             await app.persistor.deleteDirectory(
               Settings.filestore.stores.user_files,

services/filestore/test/acceptance/js/TestConfig.js

@@ -40,7 +40,9 @@ function s3SSECConfig() {
     automaticallyRotateDEKEncryption: true,
     dataEncryptionKeyBucketName: process.env.AWS_S3_USER_FILES_DEK_BUCKET_NAME,
     pathToProjectFolder(_bucketName, path) {
-      const [projectFolder] = path.match(/^[a-f0-9]+\//)
+      const match = path.match(/^[a-f0-9]{24}\//)
+      if (!match) throw new Error('not a project-folder')
+      const [projectFolder] = match
       return projectFolder
     },
     async getRootKeyEncryptionKeys() {