baiyue-firstleg/scripts/admin-test-env-modules/merchant-qualification-fixture-contract.test.mjs

import assert from 'node:assert/strict'
import { readFileSync } from 'node:fs'
import test from 'node:test'
import vm from 'node:vm'
import { normalizeFixedCustomerId, run } from './merchant-qualification-fixture.mjs'
import { AcceptanceRun } from '../admin-test-env-acceptance.mjs'

function fixedContext(profileId = '2100000000000000001') {
  const calls = []
  return {
    calls, marker: 'FIXED-CUSTOMER-TEST', context: {}, createdResources: {},
    options: { fixedCustomerId: 'TEN2100000000000000001', merchantUsername: 'fixture-user', merchantPassword: 'fixture-password' },
    async request(method, path, body) {
      calls.push({ method, path, body })
      const data = path.endsWith('/login') ? { accessToken: 'fixture-token', refreshToken: 'fixture-refresh' }
        : path.endsWith('/profile') ? { id: profileId, status: 'ACTIVE', tenantName: 'Fixture' }
          : { status: 'READY' }
      return { http: 200, body: { code: 200, data } }
    },
    apiSuccess(_module, _label, response) { return response.body.data },
    assert() {},
  }
}

test('fixed customer accepts business number without losing integer precision', () => {
  assert.equal(normalizeFixedCustomerId('TEN2100000000000000001'), '2100000000000000001')
  assert.throws(() => normalizeFixedCustomerId('TENinvalid'))
})

test('fixed customer preparation only authenticates and reads existing customer', async () => {
  const context = fixedContext()
  await run(context, { publishEnvironment: false, requireDistinctCustomer: false })
  assert.equal(context.context.merchantQualificationFixture.reused, true)
  assert.equal(context.context.merchantQualificationFixture.tenantId, '2100000000000000001')
  assert.equal(context.context.customerId, '2100000000000000001')
  assert.deepEqual(context.calls.filter(call => call.method !== 'GET').map(call => call.path), ['/api/auth/login', '/api/auth/logout'])
  assert.equal(context.createdResources.merchantQualificationFixture.password, undefined)
})

test('wrong customer identity stops preparation and logs out', async () => {
  const context = fixedContext('2100000000000000002')
  await assert.rejects(run(context, { publishEnvironment: false, requireDistinctCustomer: false }), /归属或状态不匹配/)
  assert.equal(context.context.merchantQualificationFixture, undefined)
  assert.equal(context.calls.at(-1).path, '/api/auth/logout')
  assert.equal(context.calls.length, 3)
})

test('second customer fixture cannot silently reuse the first customer', async () => {
  const context = fixedContext()
  await assert.rejects(run(context, { publishEnvironment: false }), /跨客户场景阻断/)
  assert.equal(context.calls.length, 0)
})

test('second fixed customer validates its own credentials and profile without creating a customer or publishing primary credentials', async () => {
  const context = fixedContext('2100000000000000002')
  context.options.fixedSecondaryCustomer = { customerId: 'TEN2100000000000000002', username: 'second-test', password: 'second-password' }
  const primaryOptions = structuredClone(context.options)
  const before = { username: process.env.MERCHANT_TEST_USERNAME, password: process.env.MERCHANT_TEST_PASSWORD }
  await run(context, { publishEnvironment: false })
  assert.equal(context.context.merchantQualificationFixture.tenantId, '2100000000000000002')
  assert.equal(context.context.merchantQualificationFixture.username, 'second-test')
  assert.deepEqual(context.calls[0].body, { loginId: 'second-test', password: 'second-password' })
  assert.equal(context.createdResources.merchantQualificationFixture.password, undefined)
  assert.deepEqual(context.options, primaryOptions)
  assert.deepEqual({ username: process.env.MERCHANT_TEST_USERNAME, password: process.env.MERCHANT_TEST_PASSWORD }, before)
  assert.deepEqual(context.calls.filter(call => call.method !== 'GET').map(call => call.path), ['/api/auth/login', '/api/auth/logout'])
})

for (const fault of ['same customer', 'wrong profile', 'missing credentials']) test(`second fixed customer rejects ${fault}`, async () => {
  const context = fixedContext()
  context.options.fixedSecondaryCustomer = { customerId: fault === 'same customer' ? context.options.fixedCustomerId : '2100000000000000002',
    username: 'second-test', password: fault === 'missing credentials' ? '' : 'second-password' }
  await assert.rejects(run(context, { publishEnvironment: false }), /第二个客户|第二个固定客户|归属或状态不匹配/)
  assert.ok(context.calls.every(call => call.method === 'GET' || ['/api/auth/login', '/api/auth/logout'].includes(call.path)))
  if (fault !== 'wrong profile') assert.equal(context.calls.length, 0)
  else assert.equal(context.calls.at(-1).path, '/api/auth/logout')
})

for (const environment of ['test', 'gray']) test(`${environment} fixture without fixed customer fails before any request`, async () => {
  const context = fixedContext()
  context.options = { environment }
  await assert.rejects(run(context), /必须配置固定客户/)
  assert.equal(context.calls.length, 0)
})

test('GRAY fixed customer reuses its credentials and does not publish them into TEST variables', async () => {
  const context = fixedContext(); context.options.environment = 'gray'
  const before = Object.fromEntries(['MERCHANT_TEST_USERNAME', 'MERCHANT_TEST_PASSWORD', 'MERCHANT_GRAY_USERNAME', 'MERCHANT_GRAY_PASSWORD'].map(key => [key, process.env[key]]))
  try {
    await run(context)
    assert.equal(context.createdResources.merchantQualificationFixture.reused, true)
    assert.equal(process.env.MERCHANT_TEST_USERNAME, before.MERCHANT_TEST_USERNAME)
    assert.equal(process.env.MERCHANT_TEST_PASSWORD, before.MERCHANT_TEST_PASSWORD)
    assert.equal(process.env.MERCHANT_GRAY_USERNAME, context.options.merchantUsername)
    assert.equal(context.calls.some(call => call.path === '/api/platform/v1/iam/tenants'), false)
  } finally { for (const [key, value] of Object.entries(before)) { if (value === undefined) delete process.env[key]; else process.env[key] = value } }
})

test('cross-customer financial helpers stop before provisioning or writing', async () => {
  for (const [file, name, end] of [
    ['finance-direct-paid-isolation.mjs', 'createSecondCustomer', 'async function verifyCustomerIsolation'],
    ['firstleg-container-fee-allocation.mjs', 'provisionCrossCustomerPlan', 'export async function run'],
  ]) {
    const source = readFileSync(new URL(file, import.meta.url), 'utf8')
    const helper = source.slice(source.indexOf(`async function ${name}(`), source.indexOf(end))
    const scope = vm.createContext({})
    vm.runInContext(helper.replaceAll('import.meta.url', "'file:///unused-test-module.mjs'"), scope)
    await assert.rejects(scope[name]({ options: { fixedCustomerId: '123' } }), /缺少第二个固定客户/)
  }
})

test('fixed resource runner excludes lifecycle handlers without marking them passed', async () => {
  const runner = new AcceptanceRun({ environment: 'test', fixedCustomerId: '123', quiet: true })
  let calls = 0
  for (const name of ['customers', 'supplemental-boundaries', 'system', 'master-data', 'notifications', 'pricing',
    'phase4-overseas-master-data']) {
    await runner.executeModule(name, async () => { calls++ })
  }
  assert.equal(calls, 0)
  assert.equal(runner.modules.length, 7)
  assert.ok(runner.modules.every(module => module.skipped && !module.success))
})

test('both request entrypoints reject customer creation before network access', async () => {
  const runner = new AcceptanceRun({ environment: 'test' })
  for (const method of ['request', 'requestWithBody']) {
    for (const path of ['/api/auth/register', '/api/auth/register/?source=test', '/api/platform/v1/iam/tenants', '/api/platform/v1/iam/tenants/123/archive', '/api/platform/v1/iam/tenants/123/submit-review']) {
      await assert.rejects(runner[method]('POST', path, {}), /禁止创建、归档客户/)
    }
  }
})

test('report security rejects the secondary password even under an ordinary evidence field', async () => {
  for (const leak of [false, true]) {
    const password = 'secondary-private-test-credential'
    const runner = new AcceptanceRun({ environment: 'test', fixedCustomerId: '123', quiet: true, modules: [],
      fixedSecondaryCustomer: { customerId: '456', username: 'second-test', password } })
    runner.request = async () => ({ http: 200, body: { code: 'A0401' } })
    runner.createdResources.note = leak ? `unexpected detail: ${password}` : 'ordinary diagnostic evidence'
    const report = await runner.run()
    assert.equal(report.steps.find(step => step.module === 'report-security').passed, !leak)
  }
})

const acceptance = readFileSync(new URL('../admin-test-env-acceptance.mjs', import.meta.url), 'utf8')
const fixture = readFileSync(new URL('./merchant-qualification-fixture.mjs', import.meta.url), 'utf8')
const orders = readFileSync(new URL('./orders.mjs', import.meta.url), 'utf8')

for (const environment of [undefined, 'dev', 'prod']) test(`unconfigured customer fixture never provisions even outside normal entry: ${environment}`, async () => {
  const context = fixedContext(); context.options = { environment }
  await assert.rejects(run(context), /必须配置固定客户/)
  assert.equal(context.calls.length, 0)
  const runner = new AcceptanceRun({ environment })
  for (const entry of ['request', 'requestWithBody', 'requestMultipart']) {
    for (const path of ['/api/platform/v1/iam/tenants/', '/api/auth/register', '/api/platform/v1/iam/tenants/123/archive'])
      await assert.rejects(runner[entry]('POST', path, new FormData()), /固定客户模式禁止/)
  }
})

test('默认全量验收先准备已审核商户再运行订单链路', () => {
  const modules = acceptance.match(/const CONFIGURED_MODULES = \[([^\n]+)\]/)?.[1] || ''
  assert.match(modules, /^'merchant-qualification-fixture', 'customers'/)
  assert.ok(modules.indexOf("'merchant-qualification-fixture'") < modules.indexOf("'orders'"))
  assert.match(acceptance, /DEFAULT_MODULES\s*=\s*normalizeModuleOrder\(CONFIGURED_MODULES\)/)
})

test('商户夹具只核验现有客户，不包含建客、上传资质和审核实现', () => {
  assert.match(fixture, /dimension-initialization/)
  assert.match(fixture, /status === 'READY'/)
  assert.match(fixture, /environment === 'gray' \? 'MERCHANT_GRAY' : 'MERCHANT_TEST'/)
  for (const removed of ['required-package', 'submit-review', '/approve', 'administratorUsername', 'temporaryPassword'])
    assert.ok(!fixture.includes(removed), removed)
  assert.doesNotMatch(fixture, /internal\/iam|UPDATE\s+iam_|INSERT\s+INTO\s+iam_/i)
})

test('批量待分柜参数固定同一客户并限制为订单测量链', () => {
  assert.match(acceptance, /--customer-name <name>/)
  assert.match(acceptance, /--merchant-username <name>/)
  assert.match(acceptance, /--origin-warehouse-name <name>/)
  assert.match(acceptance, /--channel-name <name>/)
  assert.match(acceptance, /--wait-split-count <n>/)
  assert.match(acceptance, /--order-profile-mode <mode>/)
  assert.match(acceptance, /merchant-username和merchant-password必须同时提供/)
  assert.match(acceptance, /modules\.splice\(fixtureIndex, 1\)/)
  assert.match(acceptance, /wait-split-count必须是1-100的整数/)
  assert.match(acceptance, /fixtureModules = new Set\(\['merchant-qualification-fixture', 'orders', 'inbound-measurement',[\s\S]{0,180}'coload-groups'[\s\S]{0,180}'firstleg-container-fee-allocation'/)
  assert.match(acceptance, /批量WAIT_SPLIT只允许执行WAIT_SPLIT造数、同柜组与柜次跨客户分摊模块/)
  assert.match(acceptance, /createAdditionalWaitSplitFixtures/)
  assert.match(acceptance, /orderBlockingFailure[\s\S]*step\.deploymentBlocker/)
  assert.match(acceptance, /measurementBlockingFailure[\s\S]*step\.deploymentBlocker/)
  assert.doesNotMatch(acceptance, /this\.modules\.at\(-1\)\?\.success !== true/)
  assert.match(acceptance, /measurement\.processStatus === expectedProcessStatus/)
  assert.match(acceptance, /prepareDropshipManualCount \? 'WAIT_PALLETIZE' : 'WAIT_SPLIT'/)
  assert.match(acceptance, /measurement\.finalStatus === 'APPROVED'/)
  assert.match(acceptance, /waitSplitVariant\(sequence\)/)
  assert.match(acceptance, /packageCountPerSku/)
  assert.match(acceptance, /grossWeightPerPalletKg/)
  assert.match(acceptance, /randomizedOrderProfile\(sequence\)/)
  assert.match(acceptance, /\['PRIVATE', 'STANDARD'\]/)
  assert.match(acceptance, /ONE_CLICK_DROPSHIP/)
  assert.match(acceptance, /destinationWarehouseCode: order\.destinationWarehouseCode/)
  assert.match(acceptance, /channelName: order\.channelName/)
  assert.match(acceptance, /pricingTaxMode: order\.pricingTaxMode/)
  assert.match(orders, /customerId: profile\.id/)
  assert.match(orders, /customerName: companyName/)
  assert.match(orders, /\['FBA', 'OVERSEAS', 'PRIVATE'\]\.includes/)
  assert.match(orders, /destinationType === 'PRIVATE'/)
  assert.match(orders, /PRIVATE_ADDRESS/)
  assert.match(orders, /eligible\.length < 1/)
  assert.match(orders, /Client 查询发货客户候选', partnerResponse, '', CONTRACT_OPTIONS/)
  assert.doesNotMatch(orders, /customerName: master\.partner\?\.partnerName/)
})