test(events): add cross-region HTTP acceptance gates

scripts/admin-test-env-modules/system.mjs

@@ -146,6 +146,21 @@ export async function run(context) {
   const resetLoginResponse = await context.request('POST', '/api/auth/login', { username, password: resetPassword }, '')
   const resetLoginPassed = resetLoginResponse.http === 200 && String(resetLoginResponse.body?.code) === '200' && Boolean(resetLoginResponse.body?.data?.accessToken)
   context.addStep(module, '内部用户使用重置密码登录', resetLoginResponse, resetLoginPassed, `username=${username}`)
+  if (context.options.modules.includes('phase4-cross-region-events')) {
+    const restrictedOverseasToken = resetLoginResponse.body?.data?.overseasAccessToken || ''
+    context.assert(module, '受限角色登录同时签发海外Token', resetLoginResponse,
+      Boolean(restrictedOverseasToken), `tokenPresent=${Boolean(restrictedOverseasToken)}`,
+      { scenario: 'canonical-overseas-permission-denial', deploymentBlocker: true })
+    if (restrictedOverseasToken) {
+      const denied = await context.requestOverseas('GET', '/api/platform/v1/last-leg/orders?page=1&size=1',
+        undefined, {}, restrictedOverseasToken)
+      context.assert(module, '缺少canonical海外订单权限必须403', denied,
+        (denied.http === 403 || ['403', 'A0403'].includes(String(denied.body?.code)))
+          && Boolean(denied.requestId) && Boolean(denied.traceId),
+        `HTTP=${denied.http}, code=${denied.body?.code ?? 'missing'}, requestId=${denied.requestId || 'missing'}, traceId=${denied.traceId || 'missing'}`,
+        { scenario: 'canonical-overseas-permission-denial', deploymentBlocker: true })
+    }
+  }
 
   const disableUserResponse = await context.request('PUT', `/api/platform/v1/iam/users/${membershipId}/status`, { status: 'DISABLED' })
   const disabledUser = context.apiSuccess(module, '停用平台内部用户', disableUserResponse)