baiyue-firstleg/lastleg-service/src/test/java/com/baiyue/lastleg/controller/LastlegOrderControllerTest.java

package com.baiyue.lastleg.controller;

import com.baiyue.common.core.api.ApiResponse;
import com.baiyue.common.core.api.PageResult;
import com.baiyue.common.security.AuthenticatedUser;
import com.baiyue.common.event.EventEnvelope;
import com.baiyue.common.event.EventTypes;
import com.baiyue.lastleg.dto.LastlegOrderRequests;
import com.baiyue.lastleg.dto.LastlegOrderSummary;
import com.baiyue.lastleg.security.InternalServiceTokenGuard;
import com.baiyue.lastleg.service.LastlegOrderService;
import com.baiyue.lastleg.service.LoadingCompletedConsumer;
import com.baiyue.lastleg.shipping.service.ContainerShippingNodeConsumer;
import org.junit.jupiter.api.Test;
import org.springframework.test.util.ReflectionTestUtils;
import org.springframework.web.server.ResponseStatusException;

import java.util.Set;

import static org.junit.jupiter.api.Assertions.assertNotNull;
import static org.junit.jupiter.api.Assertions.assertThrows;
import static org.mockito.ArgumentMatchers.eq;
import static org.mockito.ArgumentMatchers.isNull;
import static org.mockito.Mockito.mock;
import static org.mockito.Mockito.verify;
import static org.mockito.Mockito.never;
import static org.mockito.Mockito.when;

class LastlegOrderControllerTest {
    private final LastlegOrderService service = mock(LastlegOrderService.class);
    private final LastlegOrderController controller = controller();
    private final LastlegOrderRequests.Query query = new LastlegOrderRequests.Query(
        1, 20, null, null, null, null, null, null, null, null, null, null, null, null, null);

    @Test
    void platformEndpointRejectsMerchantIdentity() {
        assertThrows(ResponseStatusException.class,
            () -> controller.list(user(100L, "MERCHANT"), "200", query));
    }

    @Test
    void platformOperatorCanQueryAllCustomerTenantsWithoutCustomerId() {
        controller.list(user(0L, "PLATFORM"), null, query);
        verify(service).page(isNull(), eq(query));
    }

    @Test
    void platformOperatorCanQueryExplicitCustomerTenant() {
        controller.list(user(0L, "PLATFORM"), "200", query);
        verify(service).page(eq("200"), eq(query));
    }

    @Test
    void platformOperatorCanQueryCrossCustomerContainerSummaries() {
        var summaryQuery = new LastlegOrderRequests.PendingContainerQuery(1, 20, "CONT-", null, null);

        controller.containerSummaries(user(0L, "PLATFORM"), summaryQuery);

        verify(service).pendingContainerPage(summaryQuery);
    }

    @Test
    void containerSummariesRejectMerchantIdentity() {
        var summaryQuery = new LastlegOrderRequests.PendingContainerQuery(1, 20, null, null, null);

        assertThrows(ResponseStatusException.class,
            () -> controller.containerSummaries(user(100L, "MERCHANT"), summaryQuery));
        verify(service, never()).pendingContainerPage(summaryQuery);
    }

    @Test
    void iamSecurityEventsAreRejectedBeforeLoadingCompletedConsumer() {
        EventEnvelope event = mock(EventEnvelope.class);
        when(event.eventType()).thenReturn(EventTypes.IAM_USER_STATUS_CHANGED);
        LoadingCompletedConsumer loading = (LoadingCompletedConsumer) ReflectionTestUtils.getField(controller, "consumer");

        assertThrows(ResponseStatusException.class, () -> controller.receive("internal-token", event));

        verify(loading, never()).consume(event);
    }

    private static AuthenticatedUser user(long customerId, String appCode) {
        return new AuthenticatedUser(1L, customerId, customerId, 1L, "tester", appCode, "WEB", Set.of());
    }

    private LastlegOrderController controller() {
        LastlegOrderController controller = new LastlegOrderController();
        ReflectionTestUtils.setField(controller, "consumer", mock(LoadingCompletedConsumer.class));
        ReflectionTestUtils.setField(controller, "shippingNodeConsumer", mock(ContainerShippingNodeConsumer.class));
        ReflectionTestUtils.setField(controller, "orderService", service);
        ReflectionTestUtils.setField(controller, "tokenGuard", mock(InternalServiceTokenGuard.class));
        return controller;
    }
}