qipai/backend/tests/order-management.test.mjs

import assert from 'node:assert/strict';
import { buildApp } from '../dist/app.js';
import { signAccessToken } from '../dist/auth/jwt.js';

const secret = 'test-only-order-management-secret-32-chars';
const token = signAccessToken({
  sub: '21', sid: '5c4d3af8-c63c-4edb-bf95-b84127bb3f6e',
  tid: '7', aid: '9', rv: 1
}, secret, 900);
let called;
let customerCalled;
const authRepository = {
  async validateSession() {
    return {
      id: '5c4d3af8-c63c-4edb-bf95-b84127bb3f6e',
      tenantId: '7', platformAppId: '9', expiresAt: new Date(Date.now() + 60000),
      user: {
        id: '21', tenantId: '7', userType: 'ADMIN', status: 'ACTIVE',
        roleVersion: 1, nickname: '', avatarUrl: '', phone: ''
      }
    };
  }
};
const accessControl = {
  async getAccessProfile() {
    return { roles: ['TENANT_ADMIN'], capabilities: ['tenant.manage'], storeIds: [] };
  }
};
const app = await buildApp({
  orderManagement: {
    jwtSecret: secret, authRepository, accessControl,
    repository: {
      async renew(actor, orderId, body) {
        called = { actor, orderId, body };
        return { orderId, adjustmentType: 'RENEW', amountDeltaCents: 1200 };
      },
      async customerRenew(actor, orderId, body) {
        customerCalled = { action: 'renew', actor, orderId, body };
        return { orderId, adjustmentType: 'RENEW', amountDeltaCents: 1800 };
      },
      async changeRoom() { throw new Error('not called'); },
      async customerChangeRoom(actor, orderId, body) {
        customerCalled = { action: 'changeRoom', actor, orderId, body };
        return { orderId, adjustmentType: 'CHANGE_ROOM', amountDeltaCents: -500 };
      },
      async adjustTime() { throw new Error('not called'); },
      async note() { throw new Error('not called'); },
      async cancellationQuote() {
        return { allowed: true, feeCents: 0, refundableCents: 3000 };
      }
    }
  }
});

const rejectedAmount = await app.inject({
  method: 'POST',
  url: '/admin-api/orders/31/renew',
  headers: { authorization: `Bearer ${token}` },
  payload: {
    endAt: new Date(Date.now() + 7200000).toISOString(),
    pricingPolicy: 'LOCKED',
    reason: 'extend',
    amountDeltaCents: 1
  }
});
assert.equal(rejectedAmount.statusCode, 400);

const renewed = await app.inject({
  method: 'POST',
  url: '/admin-api/orders/31/renew',
  headers: { authorization: `Bearer ${token}`, 'x-trace-id': 'm04c-renew-route' },
  payload: {
    endAt: new Date(Date.now() + 7200000).toISOString(),
    pricingPolicy: 'LOCKED',
    reason: 'customer requested extension'
  }
});
assert.equal(renewed.statusCode, 200);
assert.equal(called.orderId, '31');
assert.equal(called.actor.traceId, 'm04c-renew-route');
assert.equal(called.body.pricingPolicy, 'LOCKED');

const customerRenewed = await app.inject({
  method: 'POST',
  url: '/app-api/orders/31/renew',
  headers: { authorization: `Bearer ${token}`, 'x-trace-id': 'm08a-customer-renew' },
  payload: {
    endAt: new Date(Date.now() + 10800000).toISOString(),
    pricingPolicy: 'CURRENT',
    reason: 'miniapp renew'
  }
});
assert.equal(customerRenewed.statusCode, 200);
assert.equal(customerCalled.action, 'renew');
assert.equal(customerCalled.actor.source, 'APP');
assert.equal(customerCalled.actor.traceId, 'm08a-customer-renew');
assert.equal(customerCalled.body.pricingPolicy, 'CURRENT');

const customerChanged = await app.inject({
  method: 'POST',
  url: '/app-api/orders/31/change-room',
  headers: { authorization: `Bearer ${token}`, 'x-trace-id': 'm08a-customer-change-room' },
  payload: {
    roomId: '32',
    reason: 'miniapp change room'
  }
});
assert.equal(customerChanged.statusCode, 200);
assert.equal(customerCalled.action, 'changeRoom');
assert.equal(customerCalled.actor.source, 'APP');
assert.equal(customerCalled.orderId, '31');
assert.equal(customerCalled.body.roomId, '32');

const quote = await app.inject({
  method: 'GET',
  url: '/app-api/orders/31/cancellation-quote',
  headers: { authorization: `Bearer ${token}` }
});
assert.equal(quote.statusCode, 200);
assert.equal(quote.json().data.refundableCents, 3000);

await app.close();
console.log('PASS: M04-C routes reject client amounts and expose controlled adjustments.');