baiyue-firstleg/scripts/admin-test-env-modules/phase3-order-splitting.mjs

const MODULE = 'phase3-order-splitting'
const SCENARIO = 'parent-child-multi-container-consolidation'
const OPTIONS = { scenario: SCENARIO, deploymentBlocker: true }
const MERCHANT_USERNAME = process.env.MERCHANT_TEST_USERNAME || 'merchant_admin'
const MERCHANT_PASSWORD = process.env.MERCHANT_TEST_PASSWORD || 'ChangeMe123!'

function id(value) { return value == null ? '' : String(value) }
function codeOf(response) { return response?.body?.code == null ? 'missing' : String(response.body.code) }
function failure(response) {
  return [400, 401, 403, 404, 409, 503].includes(response?.http)
    || (response?.http === 200 && codeOf(response) !== '200')
}

function isPositiveId(value) { return /^[1-9][0-9]*$/.test(id(value)) }

function treeShape(tree, orderId) {
  if (!tree || !isPositiveId(tree.parentOrderId) || id(tree.parentOrderId) !== orderId
      || typeof tree.parentOrderNo !== 'string' || !Number.isInteger(Number(tree.parentVersion))
      || !Array.isArray(tree.children) || !Number.isInteger(Number(tree.allocatedPackageCount))
      || !Number.isInteger(Number(tree.remainingPackageCount))) return false
  return tree.children.every((child) => isPositiveId(child.orderId)
    && typeof child.orderNo === 'string'
    && Number.isInteger(Number(child.splitSequence))
    && ['LOADED', 'REMAINDER'].includes(child.splitRole)
    && Number.isInteger(Number(child.packageCount)) && Number(child.packageCount) >= 0
    && isPositiveId(child.sourceOrderId) && isPositiveId(child.loadingPlanId)
    && isPositiveId(child.containerBookingId))
}

function sliceShape(row, containerBookingId, tenantId) {
  return row && isPositiveId(row.containerBookingId) && id(row.containerBookingId) === containerBookingId
    && isPositiveId(row.tenantId) && id(row.tenantId) === tenantId
    && isPositiveId(row.parentOrderId) && typeof row.parentOrderNo === 'string'
    && isPositiveId(row.childOrderId) && typeof row.childOrderNo === 'string'
    && isPositiveId(row.sourceOrderId) && typeof row.sourceOrderNo === 'string'
    && ['LOADED', 'REMAINDER'].includes(row.splitRole)
    && Number.isInteger(Number(row.packageCount)) && Number(row.packageCount) >= 0
    && isPositiveId(row.loadingPlanId)
}

export async function run(context) {
  const fixture = context.createdResources?.phase3Loading
    || context.createdResources?.phase3ContainerLoading
  const tenantId = id(fixture?.tenantId)
  const inboundId = id(fixture?.inboundId)
  const containerBookingId = id(fixture?.containerBookingId)
  if (!tenantId || !inboundId || !containerBookingId || fixture?.marker !== context.marker) {
    context.addCoverageGap(MODULE, SCENARIO, '父子订单与柜次聚合真实验收 fixture',
      '本轮未取得 marker 隔离的 phase3Loading 入库单和柜次，未使用历史资源；需要先运行 phase3-loading 生成真实 fixture',
      'fixture', { fixture: { available: false, marker: fixture?.marker || null, inboundId: inboundId || null, containerBookingId: containerBookingId || null } })
    return
  }

  const inboundPath = `/api/platform/inbounds/${encodeURIComponent(inboundId)}?tenantId=${encodeURIComponent(tenantId)}`
  const inboundResponse = await context.request('GET', inboundPath)
  const inbound = context.apiSuccess(MODULE, '读取本轮入库单以解析来源订单', inboundResponse,
    `tenantId=${tenantId}, inboundId=${inboundId}`, OPTIONS)
  const orderId = id(inbound?.summary?.orderId)
  context.assert(MODULE, '入库单返回可查询的来源订单 ID', inboundResponse,
    isPositiveId(orderId) && id(inbound?.summary?.tenantId) === tenantId,
    `orderId=${orderId || 'missing'}, tenantId=${id(inbound?.summary?.tenantId) || 'missing'}`, OPTIONS)
  if (!orderId) return

  const treePath = `/api/platform/v1/orders/${encodeURIComponent(orderId)}/fulfillment-tree?tenantId=${encodeURIComponent(tenantId)}`
  const treeResponse = await context.request('GET', treePath)
  const tree = context.apiSuccess(MODULE, '平台查询真实父子订单履约树', treeResponse,
    `orderId=${orderId}, tenantId=${tenantId}`, OPTIONS)
  context.assert(MODULE, '父子订单履约树字段和客户归属完整', treeResponse,
    treeShape(tree, orderId),
    `parent=${id(tree?.parentOrderId) || 'missing'}, children=${tree?.children?.length ?? 'n/a'}, allocated=${tree?.allocatedPackageCount ?? 'n/a'}, remaining=${tree?.remainingPackageCount ?? 'n/a'}`, OPTIONS)
  if (!tree) return

  // Re-query through the real merchant contract as well. The customer scope is
  // taken from the token; no tenant/customer id is accepted by this endpoint.
  const merchantLogin = await context.request('POST', '/api/auth/login', {
    username: MERCHANT_USERNAME, password: MERCHANT_PASSWORD,
  }, '')
  const merchantAuth = context.apiSuccess(MODULE, '客户账号登录以验证履约树隔离', merchantLogin, '', OPTIONS)
  const merchantToken = merchantAuth?.accessToken
  if (merchantToken) {
    const merchantTree = await context.request('GET',
      `/api/merchant/v1/orders/${encodeURIComponent(orderId)}/fulfillment-tree`, undefined, merchantToken)
    const merchantTreeData = context.apiSuccess(MODULE, '客户查询本客户父子履约树', merchantTree,
      `orderId=${orderId}`, OPTIONS)
    context.assert(MODULE, '客户履约树不返回平台内部字段且归属当前客户', merchantTree,
      treeShape(merchantTreeData, orderId),
      `parent=${id(merchantTreeData?.parentOrderId) || 'missing'}, children=${merchantTreeData?.children?.length ?? 'n/a'}`, OPTIONS)
  }

  const slicesPath = `/api/platform/v1/orders/container-bookings/${encodeURIComponent(containerBookingId)}/fulfillment-slices?tenantId=${encodeURIComponent(tenantId)}`
  const slicesResponse = await context.request('GET', slicesPath)
  const slices = context.apiSuccess(MODULE, '平台按柜次查询真实履约分片聚合', slicesResponse,
    `containerBookingId=${containerBookingId}, tenantId=${tenantId}`, OPTIONS)
  context.assert(MODULE, '柜次分片响应为客户隔离数组且字段完整', slicesResponse,
    Array.isArray(slices) && slices.every((row) => sliceShape(row, containerBookingId, tenantId)),
    `rows=${Array.isArray(slices) ? slices.length : 'n/a'}`, OPTIONS)

  if (Array.isArray(slices) && slices.length > 0) {
    const loaded = slices.filter((row) => row.splitRole === 'LOADED')
      .reduce((sum, row) => sum + Number(row.packageCount), 0)
    const remainder = slices.filter((row) => row.splitRole === 'REMAINDER')
      .reduce((sum, row) => sum + Number(row.packageCount), 0)
    context.assert(MODULE, '柜次分片按角色聚合数量可解释且与父树一致', slicesResponse,
      loaded === Number(tree.allocatedPackageCount)
        && remainder >= 0 && Number(tree.remainingPackageCount) >= remainder,
      `loaded=${loaded}, treeAllocated=${tree.allocatedPackageCount}, remainder=${remainder}, treeRemaining=${tree.remainingPackageCount}`, OPTIONS)
  } else {
    context.addCoverageGap(MODULE, SCENARIO, '一单多柜与多单拼柜数量守恒',
      '真实柜次分片查询端点已公开并完成字段/客户隔离验证，但本轮 phase3Loading 仅生成单来源订单且未通过公开接口生成跨订单分片，无法伪造一单多柜或一柜多单数量守恒 fixture',
      'fixture', { fixture: { available: true, marker: context.marker, inboundId, containerBookingId, orderId } })
  }

  const wrongTenant = (BigInt(tenantId) + 1n).toString()
  const wrongTreePath = `/api/platform/v1/orders/${encodeURIComponent(orderId)}/fulfillment-tree?tenantId=${encodeURIComponent(wrongTenant)}`
  const wrongTree = await context.request('GET', wrongTreePath)
  context.addStep(MODULE, '父子履约树跨客户归属拒绝', wrongTree,
    failure(wrongTree), `HTTP=${wrongTree.http}, code=${codeOf(wrongTree)}, tenantId=${wrongTenant}`, OPTIONS)

  const wrongSlicesPath = `/api/platform/v1/orders/container-bookings/${encodeURIComponent(containerBookingId)}/fulfillment-slices?tenantId=${encodeURIComponent(wrongTenant)}`
  const wrongSlices = await context.request('GET', wrongSlicesPath)
  const wrongSlicesData = context.apiSuccess(MODULE, '柜次分片跨客户查询返回隔离结果', wrongSlices,
    `containerBookingId=${containerBookingId}, tenantId=${wrongTenant}`, OPTIONS)
  context.assert(MODULE, '柜次分片不泄露其他客户数据', wrongSlices,
    Array.isArray(wrongSlicesData) && wrongSlicesData.length === 0,
    `rows=${Array.isArray(wrongSlicesData) ? wrongSlicesData.length : 'n/a'}`, OPTIONS)

  if (merchantToken) {
    const merchantSlices = await context.request('GET',
      `/api/merchant/v1/orders/container-bookings/${encodeURIComponent(containerBookingId)}/fulfillment-slices`,
      undefined, merchantToken)
    const merchantSlicesData = context.apiSuccess(MODULE, '客户查询本客户柜次履约分片', merchantSlices, '', OPTIONS)
    context.assert(MODULE, '客户柜次分片仅返回当前客户数据', merchantSlices,
      Array.isArray(merchantSlicesData) && merchantSlicesData.every((row) => sliceShape(row, containerBookingId, tenantId)),
      `rows=${Array.isArray(merchantSlicesData) ? merchantSlicesData.length : 'n/a'}`, OPTIONS)
  }

  context.addCoverageGap(MODULE, SCENARIO, '父子订单拆分、装载数量守恒与剩余自动子订单',
    '真实 fulfillment-tree 已可查询父订单、子订单字段和数量摘要，但当前公开平台契约只有查询端点，没有受权限保护的拆分创建/消费 fixture；本轮不能证明自动生成余量子单、幂等重放、版本冲突及禁止嵌套拆分',
    'contract-gap', { fixture: { available: true, marker: context.marker, inboundId, containerBookingId, orderId } })
}