Codex
86 lines
2.6 KiB
JavaScript
86 lines
2.6 KiB
JavaScript
import assert from 'node:assert/strict';
|
|
import { buildApp } from '../dist/app.js';
|
|
import { signAccessToken } from '../dist/auth/jwt.js';
|
|
|
|
const secret = 'test-only-order-share-jwt-secret-32-chars';
|
|
const token = signAccessToken({
|
|
sub: '21', sid: '5c4d3af8-c63c-4edb-bf95-b84127bb3f6e',
|
|
tid: '7', aid: '9', rv: 1
|
|
}, secret, 900);
|
|
let createInput;
|
|
let resolveInput;
|
|
const shareToken = 'a'.repeat(43);
|
|
const app = await buildApp({
|
|
orderShare: {
|
|
jwtSecret: secret,
|
|
authRepository: {
|
|
async validateSession() {
|
|
return {
|
|
id: '5c4d3af8-c63c-4edb-bf95-b84127bb3f6e',
|
|
tenantId: '7', platformAppId: '9', expiresAt: new Date(Date.now() + 60000),
|
|
user: {
|
|
id: '21', tenantId: '7', userType: 'CUSTOMER', status: 'ACTIVE',
|
|
roleVersion: 1, nickname: '', avatarUrl: '', phone: ''
|
|
}
|
|
};
|
|
}
|
|
},
|
|
accessControl: {
|
|
async getAccessProfile() {
|
|
return { roles: ['CUSTOMER'], capabilities: ['order.self.read'], storeIds: [] };
|
|
}
|
|
},
|
|
repository: {
|
|
async create(input) {
|
|
createInput = input;
|
|
return {
|
|
shareId: '41', token: shareToken,
|
|
permissions: input.permissions ?? ['VIEW_ROOM', 'OPEN_DOOR']
|
|
};
|
|
},
|
|
async revoke() { return { shareId: '41', revoked: true }; },
|
|
async resolve(tokenValue, permission) {
|
|
resolveInput = { tokenValue, permission };
|
|
return {
|
|
shareId: '41',
|
|
order: {
|
|
orderId: '31', orderNo: 'QP-SAFE', status: 'PAID',
|
|
startAt: new Date(), endAt: new Date()
|
|
},
|
|
grantedPermission: permission
|
|
};
|
|
}
|
|
}
|
|
}
|
|
});
|
|
|
|
const created = await app.inject({
|
|
method: 'POST',
|
|
url: '/app-api/orders/31/shares',
|
|
headers: { authorization: `Bearer ${token}` },
|
|
payload: {}
|
|
});
|
|
assert.equal(created.statusCode, 201);
|
|
assert.equal(createInput.orderId, '31');
|
|
assert.deepEqual(created.json().data.permissions, ['VIEW_ROOM', 'OPEN_DOOR']);
|
|
|
|
const resolved = await app.inject({
|
|
method: 'POST',
|
|
url: `/app-api/order-shares/${shareToken}/resolve`,
|
|
payload: { permission: 'OPEN_DOOR' }
|
|
});
|
|
assert.equal(resolved.statusCode, 200);
|
|
assert.deepEqual(resolveInput, { tokenValue: shareToken, permission: 'OPEN_DOOR' });
|
|
const response = JSON.stringify(resolved.json());
|
|
assert.doesNotMatch(response, /phone|balance|payment/i);
|
|
|
|
const invalidPermission = await app.inject({
|
|
method: 'POST',
|
|
url: `/app-api/order-shares/${shareToken}/resolve`,
|
|
payload: { permission: 'ADMIN' }
|
|
});
|
|
assert.equal(invalidPermission.statusCode, 400);
|
|
|
|
await app.close();
|
|
console.log('PASS: M04-D routes provide minimal share permissions without private fields.');
|