feat(M04-D): 完成最小权限订单分享

2026-06-20 14:20:37 +08:00
parent 3c5cf071b9
commit 91801fe6a7
17 changed files with 694 additions and 14 deletions
@@ -0,0 +1,85 @@
+import assert from 'node:assert/strict';
+import { buildApp } from '../dist/app.js';
+import { signAccessToken } from '../dist/auth/jwt.js';
+
+const secret = 'test-only-order-share-jwt-secret-32-chars';
+const token = signAccessToken({
+  sub: '21', sid: '5c4d3af8-c63c-4edb-bf95-b84127bb3f6e',
+  tid: '7', aid: '9', rv: 1
+}, secret, 900);
+let createInput;
+let resolveInput;
+const shareToken = 'a'.repeat(43);
+const app = await buildApp({
+  orderShare: {
+    jwtSecret: secret,
+    authRepository: {
+      async validateSession() {
+        return {
+          id: '5c4d3af8-c63c-4edb-bf95-b84127bb3f6e',
+          tenantId: '7', platformAppId: '9', expiresAt: new Date(Date.now() + 60000),
+          user: {
+            id: '21', tenantId: '7', userType: 'CUSTOMER', status: 'ACTIVE',
+            roleVersion: 1, nickname: '', avatarUrl: '', phone: ''
+          }
+        };
+      }
+    },
+    accessControl: {
+      async getAccessProfile() {
+        return { roles: ['CUSTOMER'], capabilities: ['order.self.read'], storeIds: [] };
+      }
+    },
+    repository: {
+      async create(input) {
+        createInput = input;
+        return {
+          shareId: '41', token: shareToken,
+          permissions: input.permissions ?? ['VIEW_ROOM', 'OPEN_DOOR']
+        };
+      },
+      async revoke() { return { shareId: '41', revoked: true }; },
+      async resolve(tokenValue, permission) {
+        resolveInput = { tokenValue, permission };
+        return {
+          shareId: '41',
+          order: {
+            orderId: '31', orderNo: 'QP-SAFE', status: 'PAID',
+            startAt: new Date(), endAt: new Date()
+          },
+          grantedPermission: permission
+        };
+      }
+    }
+  }
+});
+
+const created = await app.inject({
+  method: 'POST',
+  url: '/app-api/orders/31/shares',
+  headers: { authorization: `Bearer ${token}` },
+  payload: {}
+});
+assert.equal(created.statusCode, 201);
+assert.equal(createInput.orderId, '31');
+assert.deepEqual(created.json().data.permissions, ['VIEW_ROOM', 'OPEN_DOOR']);
+
+const resolved = await app.inject({
+  method: 'POST',
+  url: `/app-api/order-shares/${shareToken}/resolve`,
+  payload: { permission: 'OPEN_DOOR' }
+});
+assert.equal(resolved.statusCode, 200);
+assert.deepEqual(resolveInput, { tokenValue: shareToken, permission: 'OPEN_DOOR' });
+const response = JSON.stringify(resolved.json());
+assert.doesNotMatch(response, /phone|balance|payment/i);
+
+const invalidPermission = await app.inject({
+  method: 'POST',
+  url: `/app-api/order-shares/${shareToken}/resolve`,
+  payload: { permission: 'ADMIN' }
+});
+assert.equal(invalidPermission.statusCode, 400);
+
+await app.close();
+console.log('PASS: M04-D routes provide minimal share permissions without private fields.');