feat(M08-A): 接入顾客端订单查询

backend/tests/order-query.test.mjs

@@ -0,0 +1,113 @@
+import assert from 'node:assert/strict';
+import { buildApp } from '../dist/app.js';
+import { signAccessToken } from '../dist/auth/jwt.js';
+
+const secret = 'test-only-order-query-jwt-secret-32';
+const token = signAccessToken({
+  sub: '21',
+  sid: '5c4d3af8-c63c-4edb-bf95-b84127bb3f6e',
+  tid: '7',
+  aid: '9',
+  rv: 1
+}, secret, 900);
+const authRepository = {
+  async validateSession() {
+    return {
+      id: '5c4d3af8-c63c-4edb-bf95-b84127bb3f6e',
+      tenantId: '7',
+      platformAppId: '9',
+      expiresAt: new Date(Date.now() + 60000),
+      user: {
+        id: '21',
+        tenantId: '7',
+        userType: 'CUSTOMER',
+        status: 'ACTIVE',
+        roleVersion: 1,
+        nickname: '',
+        avatarUrl: '',
+        phone: ''
+      }
+    };
+  }
+};
+let listInput;
+let detailInput;
+const app = await buildApp({
+  orderQuery: {
+    jwtSecret: secret,
+    authRepository,
+    accessControl: {
+      async getAccessProfile() {
+        return { roles: ['CUSTOMER'], capabilities: [], storeIds: [] };
+      }
+    },
+    repository: {
+      async listMine(input) {
+        listInput = input;
+        return {
+          items: [{
+            id: '31',
+            orderNo: 'QP202606240001',
+            storeName: '近店',
+            roomName: '青竹房',
+            status: 'PENDING_PAYMENT',
+            totalAmountCents: 3600,
+            latestPayment: null
+          }],
+          total: 1,
+          page: input.page,
+          pageSize: input.pageSize
+        };
+      },
+      async getMine(input) {
+        detailInput = input;
+        return {
+          id: input.orderId,
+          orderNo: 'QP202606240001',
+          storeName: '近店',
+          roomName: '青竹房',
+          status: 'PENDING_PAYMENT',
+          totalAmountCents: 3600,
+          latestPayment: null
+        };
+      }
+    }
+  }
+});
+
+const listed = await app.inject({
+  method: 'GET',
+  url: '/app-api/orders?page=2&pageSize=5&status=PENDING_PAYMENT',
+  headers: { authorization: `Bearer ${token}` }
+});
+assert.equal(listed.statusCode, 200);
+assert.equal(listed.json().data.items[0].id, '31');
+assert.equal(listInput.tenantId, '7');
+assert.equal(listInput.userId, '21');
+assert.equal(listInput.page, 2);
+assert.equal(listInput.pageSize, 5);
+assert.equal(listInput.status, 'PENDING_PAYMENT');
+
+const detail = await app.inject({
+  method: 'GET',
+  url: '/app-api/orders/31',
+  headers: { authorization: `Bearer ${token}` }
+});
+assert.equal(detail.statusCode, 200);
+assert.equal(detailInput.orderId, '31');
+
+const unauthenticated = await app.inject({
+  method: 'GET',
+  url: '/app-api/orders'
+});
+assert.equal(unauthenticated.statusCode, 401);
+
+const invalid = await app.inject({
+  method: 'GET',
+  url: '/app-api/orders?pageSize=999',
+  headers: { authorization: `Bearer ${token}` }
+});
+assert.equal(invalid.statusCode, 400);
+
+await app.close();
+console.log('PASS: M08-A customer order query routes expose scoped list and detail.');