Codex
84 lines
2.6 KiB
JavaScript
84 lines
2.6 KiB
JavaScript
import assert from 'node:assert/strict';
|
|
import { buildApp } from '../dist/app.js';
|
|
import { signAccessToken } from '../dist/auth/jwt.js';
|
|
|
|
const secret = 'test-only-order-management-secret-32-chars';
|
|
const token = signAccessToken({
|
|
sub: '21', sid: '5c4d3af8-c63c-4edb-bf95-b84127bb3f6e',
|
|
tid: '7', aid: '9', rv: 1
|
|
}, secret, 900);
|
|
let called;
|
|
const authRepository = {
|
|
async validateSession() {
|
|
return {
|
|
id: '5c4d3af8-c63c-4edb-bf95-b84127bb3f6e',
|
|
tenantId: '7', platformAppId: '9', expiresAt: new Date(Date.now() + 60000),
|
|
user: {
|
|
id: '21', tenantId: '7', userType: 'ADMIN', status: 'ACTIVE',
|
|
roleVersion: 1, nickname: '', avatarUrl: '', phone: ''
|
|
}
|
|
};
|
|
}
|
|
};
|
|
const accessControl = {
|
|
async getAccessProfile() {
|
|
return { roles: ['TENANT_ADMIN'], capabilities: ['tenant.manage'], storeIds: [] };
|
|
}
|
|
};
|
|
const app = await buildApp({
|
|
orderManagement: {
|
|
jwtSecret: secret, authRepository, accessControl,
|
|
repository: {
|
|
async renew(actor, orderId, body) {
|
|
called = { actor, orderId, body };
|
|
return { orderId, adjustmentType: 'RENEW', amountDeltaCents: 1200 };
|
|
},
|
|
async changeRoom() { throw new Error('not called'); },
|
|
async adjustTime() { throw new Error('not called'); },
|
|
async note() { throw new Error('not called'); },
|
|
async cancellationQuote() {
|
|
return { allowed: true, feeCents: 0, refundableCents: 3000 };
|
|
}
|
|
}
|
|
}
|
|
});
|
|
|
|
const rejectedAmount = await app.inject({
|
|
method: 'POST',
|
|
url: '/admin-api/orders/31/renew',
|
|
headers: { authorization: `Bearer ${token}` },
|
|
payload: {
|
|
endAt: new Date(Date.now() + 7200000).toISOString(),
|
|
pricingPolicy: 'LOCKED',
|
|
reason: 'extend',
|
|
amountDeltaCents: 1
|
|
}
|
|
});
|
|
assert.equal(rejectedAmount.statusCode, 400);
|
|
|
|
const renewed = await app.inject({
|
|
method: 'POST',
|
|
url: '/admin-api/orders/31/renew',
|
|
headers: { authorization: `Bearer ${token}`, 'x-trace-id': 'm04c-renew-route' },
|
|
payload: {
|
|
endAt: new Date(Date.now() + 7200000).toISOString(),
|
|
pricingPolicy: 'LOCKED',
|
|
reason: 'customer requested extension'
|
|
}
|
|
});
|
|
assert.equal(renewed.statusCode, 200);
|
|
assert.equal(called.orderId, '31');
|
|
assert.equal(called.actor.traceId, 'm04c-renew-route');
|
|
assert.equal(called.body.pricingPolicy, 'LOCKED');
|
|
|
|
const quote = await app.inject({
|
|
method: 'GET',
|
|
url: '/app-api/orders/31/cancellation-quote',
|
|
headers: { authorization: `Bearer ${token}` }
|
|
});
|
|
assert.equal(quote.statusCode, 200);
|
|
assert.equal(quote.json().data.refundableCents, 3000);
|
|
|
|
await app.close();
|
|
console.log('PASS: M04-C routes reject client amounts and expose controlled adjustments.');
|