Delete statement

Steps

1. An internal updater confirms deletion in the delete form. The form declares the handler on its submit button but no method="post" (TD-APP-007), so the browser submits it as a GET. The only delete handler is OnPostDeleteStatement; there is no OnGetDeleteStatement. The observed confirmation form therefore cannot invoke the POST delete handler, and the delete does not work through the screen UI. The HTTP result of the unmatched GET is not specified here**. The separate DeleteStatement() AJAX function in the page script is not called by this form.
2. The handler can run only if a POST to ?handler=DeleteStatement is issued separately (not by the observed form). In that case it checks no role (TD-APP-003) and runs with no anti-forgery token (BR-APP-006).
3. For such a separately issued POST, the handler calls the statement delete of NDReimbursementAPI.Client (known from the call site; the package internals are unknown**), then repopulates the model with the user checks (BR-APP-002, BR-APP-003). If the delete throws, the handler logs the error, sets an error message and rethrows.

Process flow

The diagram shows that the observed form submits a GET that cannot invoke the POST handler, and that the delete runs only for a separately issued POST.

flowchart TD
    A["Confirm delete (form without method=post)"] --> B["Browser submits as GET"]
    B --> C["No GET delete handler; OnPostDeleteStatement not invoked"]
    C --> D["HTTP result unspecified **"]
    P["Separately issued POST ?handler=DeleteStatement"] --> E["DeleteStatement via API client"]
    E --> F["Repopulate and render"]
    E -- "Exception" --> G["Log, set error message, rethrow"]

Note: Statements marked with ** could not be confirmed; treat as unknown until verified.

Related documentation

• Application index
• Operations and processes
• Business rules
• Tech debt

Sources

• src/NDReimbursementWebApp/Pages/NDReimbursement.cshtml.cs
• src/NDReimbursementWebApp/Pages/NDReimbursement.cshtml