feat(M08-C): 补管理员订单处置与代下单

backend/tests/pricing.test.mjs

@@ -20,6 +20,7 @@ const token = signAccessToken({
   rv: 1
 }, secret, 900);
 let reserveInput;
+let accessProfile = { roles: ['CUSTOMER'], capabilities: [], storeIds: [] };
 const app = await buildApp({
   pricing: {
     jwtSecret: secret,
@@ -45,7 +46,7 @@ const app = await buildApp({
     },
     accessControl: {
       async getAccessProfile() {
-        return { roles: ['CUSTOMER'], capabilities: [], storeIds: [] };
+        return accessProfile;
       }
     },
     repository: {
@@ -98,6 +99,41 @@ assert.deepEqual(reserveInput.benefits, {
   clientRequestId: 'benefit-route-0001'
 });
 
+const forbiddenOnBehalf = await app.inject({
+  method: 'POST',
+  url: '/app-api/management/orders/reserve-on-behalf',
+  headers: { authorization: `Bearer ${token}` },
+  payload: {
+    userId: '88', roomId: '11',
+    startAt: startAt.toISOString(), endAt: endAt.toISOString(), pricingMode: 'HOURLY'
+  }
+});
+assert.equal(forbiddenOnBehalf.statusCode, 403);
+
+accessProfile = {
+  roles: ['STORE_ADMIN'],
+  capabilities: ['store.operation.write'],
+  storeIds: ['18']
+};
+const reservedOnBehalf = await app.inject({
+  method: 'POST',
+  url: '/app-api/management/orders/reserve-on-behalf',
+  headers: { authorization: `Bearer ${token}` },
+  payload: {
+    userId: '88', roomId: '11',
+    startAt: startAt.toISOString(), endAt: endAt.toISOString(), pricingMode: 'HOURLY'
+  }
+});
+assert.equal(reservedOnBehalf.statusCode, 201);
+assert.equal(reserveInput.userId, '88');
+assert.deepEqual(reserveInput.allowedStoreIds, ['18']);
+assert.equal('benefits' in reserveInput, false);
+assert.equal(reserveInput.actor.userId, '21');
+assert.equal(reserveInput.actor.source, 'ADMIN');
+assert.ok(reserveInput.actor.traceId);
+assert.match(pricingSource, /tenant_id = \? AND id = \? AND status = 'ACTIVE'/);
+assert.match(pricingSource, /ORDER_CREATED_ON_BEHALF/);
+
 const unauthenticated = await app.inject({
   method: 'POST',
   url: '/app-api/pricing/quote',