feat(M09-D4): 完成商品选购与运营工作台

backend/tests/product-route.test.mjs

@@ -24,6 +24,9 @@ const record = (method, result) => async (...args) => {
   return typeof result === 'function' ? result(...args) : result;
 };
 const repository = {
+  listStoreCatalog: record('listStoreCatalog', {
+    storeId: '11', salesOpen: true, categories: []
+  }),
   listCategories: record('listCategories', []),
   createCategory: record('createCategory', { categoryId: '31', version: 1 }),
   updateCategory: record('updateCategory', { categoryId: '31', version: 2 }),
@@ -79,6 +82,18 @@ const unauthorized = await app.inject({
 assert.equal(unauthorized.statusCode, 401);
 assert.equal(unauthorized.json().code, 'AUTH_SESSION_INVALID');
 
+assert.equal((await app.inject({
+  method: 'GET', url: '/app-api/stores/11/product-catalog'
+})).statusCode, 401);
+const customerCatalog = await app.inject({
+  method: 'GET', url: '/app-api/stores/11/product-catalog',
+  headers: { authorization: `Bearer ${token}` }
+});
+assert.equal(customerCatalog.statusCode, 200);
+assert.deepEqual(calls.find((call) => call.method === 'listStoreCatalog').args[0], {
+  tenantId: '7', storeId: '11'
+});
+
 currentAccess = { roles: ['STAFF'], capabilities: [], storeIds: ['11'] };
 const forbidden = await app.inject({
   method: 'GET', url: '/admin-api/products', headers: { authorization: `Bearer ${token}` }