feat(M08-A): 接入顾客端订单查询

backend/src/routes/order-query.ts

@@ -0,0 +1,103 @@
+import type { FastifyInstance, FastifyReply } from 'fastify';
+import { z } from 'zod';
+import type { AuthRepository } from '../auth/auth-repository.js';
+import { authenticateAccessToken } from '../auth/authenticate.js';
+import type { AccessProfile } from '../auth/rbac-repository.js';
+import {
+  OrderQueryError,
+  type OrderQueryRepository
+} from '../orders/order-query-repository.js';
+import { type OrderStatus } from '../orders/order-state-repository.js';
+
+const orderStatuses = [
+  'DRAFT', 'PENDING_PAYMENT', 'PAID', 'RESERVED', 'IN_PROGRESS',
+  'FINISHED', 'CANCELLED', 'REFUNDING', 'REFUNDED', 'CLOSED'
+] as const satisfies readonly OrderStatus[];
+const listSchema = z.object({
+  page: z.coerce.number().int().min(1).default(1),
+  pageSize: z.coerce.number().int().min(1).max(50).default(20),
+  status: z.enum(orderStatuses).optional()
+});
+const paramsSchema = z.object({ orderId: z.string().regex(/^[1-9]\d{0,19}$/) });
+
+export interface OrderQueryRouteOptions {
+  repository: Pick<OrderQueryRepository, 'listMine' | 'getMine'>;
+  authRepository: Pick<AuthRepository, 'validateSession'>;
+  accessControl: { getAccessProfile(tenantId: string, userId: string): Promise<AccessProfile> };
+  jwtSecret: string;
+}
+
+export async function registerOrderQueryRoutes(
+  app: FastifyInstance,
+  options: OrderQueryRouteOptions
+) {
+  app.get('/app-api/orders', async (request, reply) => {
+    const auth = await authenticate(request.headers.authorization, options);
+    const query = listSchema.safeParse(request.query);
+    if (!auth) return unauthorized(reply, request.traceId);
+    if (!query.success) return invalid(reply, request.traceId);
+    return {
+      code: 0,
+      data: await options.repository.listMine({ ...auth, ...query.data }),
+      traceId: request.traceId
+    };
+  });
+
+  app.get('/app-api/orders/:orderId', async (request, reply) => {
+    const auth = await authenticate(request.headers.authorization, options);
+    const params = paramsSchema.safeParse(request.params);
+    if (!auth) return unauthorized(reply, request.traceId);
+    if (!params.success) return invalid(reply, request.traceId);
+    return handle(reply, request.traceId, async () => ({
+      code: 0,
+      data: await options.repository.getMine({ ...auth, orderId: params.data.orderId }),
+      traceId: request.traceId
+    }));
+  });
+}
+
+async function authenticate(
+  authorization: string | undefined,
+  options: OrderQueryRouteOptions
+) {
+  const result = await authenticateAccessToken(
+    authorization, options.authRepository, options.jwtSecret
+  );
+  if (!result) return null;
+  const tenantId = result.session.tenantId;
+  const userId = result.session.user.id;
+  return {
+    tenantId,
+    userId,
+    access: await options.accessControl.getAccessProfile(tenantId, userId)
+  };
+}
+
+async function handle(reply: FastifyReply, traceId: string, work: () => Promise<unknown>) {
+  try {
+    return await work();
+  } catch (error) {
+    if (!(error instanceof OrderQueryError)) throw error;
+    return reply.status(404).send({
+      code: error.code,
+      message: 'The requested order is not available.',
+      traceId
+    });
+  }
+}
+
+function unauthorized(reply: FastifyReply, traceId: string) {
+  return reply.status(401).send({
+    code: 'AUTH_SESSION_INVALID',
+    message: 'Authentication required.',
+    traceId
+  });
+}
+
+function invalid(reply: FastifyReply, traceId: string) {
+  return reply.status(400).send({
+    code: 'INVALID_ORDER_QUERY',
+    message: 'The order query is invalid.',
+    traceId
+  });
+}