fix(M09-REGRESSION): 完成商品逐单对账与权限收口

2026-08-11 08:25:12 +08:00
parent e91b979128
commit 41b9cf7349
21 changed files with 566 additions and 39 deletions
@@ -95,6 +95,17 @@ const forbidden = await app.inject({
 assert.equal(forbidden.statusCode, 403);
 assert.equal(forbidden.json().code, 'INVENTORY_OPERATION_FORBIDDEN');

+currentAccess = {
+  roles: ['STAFF'], capabilities: ['platform.manage'], storeIds: []
+};
+assert.equal((await app.inject({
+  method: 'GET', url: '/admin-api/inventory/stocks?storeId=11', headers
+})).statusCode, 200, 'platform.manage must authorize inventory reads');
+assert.equal((await app.inject({
+  method: 'POST', url: '/admin-api/inventory/stocks/5/inbound', headers,
+  payload: { storeId: '11', requestId: 'platform-inbound', reason: 'platform check', quantity: 1 }
+})).statusCode, 200, 'platform.manage must authorize inventory writes');
+
 currentAccess = {
  roles: ['STAFF'], capabilities: ['inventory.read'], storeIds: ['11']
 };
@@ -105,7 +116,7 @@ const listed = await app.inject({
 });
 assert.equal(listed.statusCode, 200);
 assert.deepEqual(listed.json().data, { items: [], total: 0, page: 2, pageSize: 25 });
-const listCall = calls.find((call) => call.method === 'listStocks');
+const listCall = calls.findLast((call) => call.method === 'listStocks');
 assert.equal(listCall.args[0].tenantId, '7');
 assert.equal(listCall.args[0].traceId, 'm09d1-inventory-route');
 assert.deepEqual(listCall.args[1], {