feat(M08-C): 建立管理员房态运营入口

backend/tests/store-room.test.mjs

@@ -23,6 +23,10 @@ const repository = new StoreRoomRepository({
   }
 });
 assert.equal((await repository.listStores(storeActor))[0].id, '11');
+assert.deepEqual(await repository.listRooms({
+  ...storeActor,
+  access: { roles: ['STAFF'], capabilities: ['store.operation.read'], storeIds: ['11'] }
+}, '11'), []);
 await assert.rejects(
   () => repository.listRooms({ ...storeActor, access: { ...storeActor.access, storeIds: ['12'] } }, '11'),
   (error) => error instanceof StoreRoomError && error.code === 'STORE_SCOPE_FORBIDDEN'
@@ -34,6 +38,8 @@ const token = signAccessToken({
   tid: '7', aid: '9', rv: 1
 }, secret, 900);
 let roomInput;
+let roomStatusInput;
+let currentAccess = tenantActor.access;
 const app = await buildApp({
   storeRoom: {
     jwtSecret: secret,
@@ -49,7 +55,7 @@ const app = await buildApp({
         };
       }
     },
-    accessControl: { async getAccessProfile() { return tenantActor.access; } },
+    accessControl: { async getAccessProfile() { return currentAccess; } },
     repository: {
       async listStores() { return []; },
       async createStore() { return { storeId: '11' }; },
@@ -58,6 +64,14 @@ const app = await buildApp({
       async listRooms() { return []; },
       async createRoom(_actor, input) { roomInput = input; return { roomId: '31' }; },
       async updateRoom() { return { roomId: '31' }; },
+      async updateRoomStatus(actor, _roomId, input) {
+        if (!actor.access.capabilities.includes('store.operation.write')
+            && !actor.access.capabilities.includes('tenant.manage')) {
+          throw new StoreRoomError('STORE_SCOPE_FORBIDDEN');
+        }
+        roomStatusInput = input;
+        return { roomId: '31', ...input };
+      },
       async archiveRoom() { return { roomId: '31', archived: true }; },
       async addDisabledPeriod() { return { disabledPeriodId: '41' }; }
     }
@@ -78,6 +92,30 @@ const created = await app.inject({
 assert.equal(created.statusCode, 201);
 assert.equal(created.json().data.roomId, '31');
 assert.equal(roomInput.weekdayPriceCents, 2800);
+const managementStores = await app.inject({
+  method: 'GET', url: '/app-api/management/stores',
+  headers: { authorization: `Bearer ${token}` }
+});
+assert.equal(managementStores.statusCode, 200);
+const statusUpdated = await app.inject({
+  method: 'PATCH', url: '/app-api/management/rooms/31/status',
+  headers: { authorization: `Bearer ${token}` },
+  payload: { storeId: '11', operationalStatus: 'MAINTENANCE', reason: '现场维护' }
+});
+assert.equal(statusUpdated.statusCode, 200);
+assert.equal(roomStatusInput.operationalStatus, 'MAINTENANCE');
+currentAccess = { roles: ['STAFF'], capabilities: ['store.operation.read'], storeIds: ['11'] };
+const staffRooms = await app.inject({
+  method: 'GET', url: '/app-api/management/stores/11/rooms',
+  headers: { authorization: `Bearer ${token}` }
+});
+assert.equal(staffRooms.statusCode, 200);
+const staffWrite = await app.inject({
+  method: 'PATCH', url: '/app-api/management/rooms/31/status',
+  headers: { authorization: `Bearer ${token}` },
+  payload: { storeId: '11', operationalStatus: 'AVAILABLE', reason: '越权尝试' }
+});
+assert.equal(staffWrite.statusCode, 403);
 const invalid = await app.inject({
   method: 'POST', url: '/admin-api/rooms/31/disabled-periods',
   headers: { authorization: `Bearer ${token}` },