Codex
76 lines
2.5 KiB
JavaScript
76 lines
2.5 KiB
JavaScript
import assert from 'node:assert/strict';
|
|
import { buildApp } from '../dist/app.js';
|
|
import { signAccessToken } from '../dist/auth/jwt.js';
|
|
|
|
const secret = 'test-only-order-state-jwt-secret-32-chars';
|
|
const token = signAccessToken({
|
|
sub: '21', sid: '5c4d3af8-c63c-4edb-bf95-b84127bb3f6e',
|
|
tid: '7', aid: '9', rv: 1
|
|
}, secret, 900);
|
|
let transitionInput;
|
|
const options = {
|
|
jwtSecret: secret,
|
|
authRepository: {
|
|
async validateSession() {
|
|
return {
|
|
id: '5c4d3af8-c63c-4edb-bf95-b84127bb3f6e',
|
|
tenantId: '7', platformAppId: '9',
|
|
expiresAt: new Date(Date.now() + 60000),
|
|
user: {
|
|
id: '21', tenantId: '7', userType: 'ADMIN', status: 'ACTIVE',
|
|
roleVersion: 1, nickname: '', avatarUrl: '', phone: ''
|
|
}
|
|
};
|
|
}
|
|
},
|
|
accessControl: {
|
|
async getAccessProfile() {
|
|
return { roles: ['TENANT_ADMIN'], capabilities: ['tenant.manage'], storeIds: [] };
|
|
}
|
|
},
|
|
repository: {
|
|
async transition(actor, orderId, action, reason) {
|
|
transitionInput = { actor, orderId, action, reason };
|
|
return { orderId, status: action === 'CANCEL' ? 'CANCELLED' : 'PAID' };
|
|
},
|
|
async history() { return []; }
|
|
}
|
|
};
|
|
const app = await buildApp({ orderState: options });
|
|
|
|
const rejectedTarget = await app.inject({
|
|
method: 'POST',
|
|
url: '/admin-api/orders/31/actions',
|
|
headers: { authorization: `Bearer ${token}` },
|
|
payload: { action: 'CONFIRM_PAYMENT', targetStatus: 'FINISHED' }
|
|
});
|
|
assert.equal(rejectedTarget.statusCode, 400);
|
|
|
|
const transitioned = await app.inject({
|
|
method: 'POST',
|
|
url: '/admin-api/orders/31/actions',
|
|
headers: {
|
|
authorization: `Bearer ${token}`,
|
|
'x-trace-id': 'm04b-route-transition'
|
|
},
|
|
payload: { action: 'CONFIRM_PAYMENT', reason: 'sanitized callback rehearsal' }
|
|
});
|
|
assert.equal(transitioned.statusCode, 200);
|
|
assert.equal(transitionInput.orderId, '31');
|
|
assert.equal(transitionInput.action, 'CONFIRM_PAYMENT');
|
|
assert.equal(transitionInput.actor.source, 'ADMIN');
|
|
assert.equal(transitionInput.actor.traceId, 'm04b-route-transition');
|
|
|
|
const cancelled = await app.inject({
|
|
method: 'POST',
|
|
url: '/app-api/orders/31/cancel',
|
|
headers: { authorization: `Bearer ${token}` },
|
|
payload: { reason: 'customer changed plans' }
|
|
});
|
|
assert.equal(cancelled.statusCode, 200);
|
|
assert.equal(transitionInput.action, 'CANCEL');
|
|
assert.equal(transitionInput.actor.source, 'APP');
|
|
|
|
await app.close();
|
|
console.log('PASS: M04-B routes accept business actions and reject direct target statuses.');
|