优化

2026-09-18 18:50:40 +08:00
parent 1fb02db516
commit 28d3d6b8b6
10 changed files with 960 additions and 18 deletions
@@ -0,0 +1,112 @@
+import test from 'node:test'
+import assert from 'node:assert/strict'
+import { plan, config, assertCustomer, allowedRequest, client, listAll, preflight, main } from './prod-release-acceptance.mjs'
+
+function environment() {
+  const env = { CHONGCHONG_ENV: 'prod',
+    CHONGCHONG_ADMIN_API_BASE_URL: 'https://acceptance.invalid/api',
+    CHONGCHONG_ADMIN_OVERSEAS_API_BASE_URL: 'https://acceptance.invalid/overseas-api',
+    CHONGCHONG_MERCHANT_API_BASE_URL: 'https://acceptance.invalid/api',
+    CHONGCHONG_ACCEPTANCE_CUSTOMER_ID: '9007199254740993',
+    CHONGCHONG_ACCEPTANCE_CUSTOMER_CODE: 'fixture', CHONGCHONG_ACCEPTANCE_CUSTOMER_NAME: 'fixture',
+    CHONGCHONG_OVERSEAS_LAX_PDA_WAREHOUSE_CODE: 'US-LAX-01' }
+  for (const role of ['ADMIN', 'MERCHANT', 'CN_PDA', 'OVERSEAS_LAX_PDA']) {
+    env[`CHONGCHONG_${role}_USERNAME`] = role
+    env[`CHONGCHONG_${role}_PASSWORD`] = 'fixture-secret'
+  }
+  return env
+}
+const profile = { id: '9007199254740993', tenantCode: 'fixture', tenantName: 'fixture', status: 'ACTIVE', dimensionInitializationStatus: 'READY' }
+
+test('single order scope does not claim implemented or full coverage', () => {
+  const result = plan()
+  assert.equal(result.scope.orders, 1)
+  assert.equal(result.scope.sameOrder, true)
+  assert.equal(result.scope.receiving, 'US-LAX-01')
+  assert.equal(result.fullFlowVerified, false)
+  assert.equal(result.stages.filter(s => s.status === 'IMPLEMENTED_NOT_HTTP_VERIFIED').length, 2)
+  assert.equal(result.stages.filter(s => s.status === 'NOT_IMPLEMENTED').length, 12)
+})
+test('configuration has no development/test fallback', () => {
+  assert.throws(() => config({ ADMIN_TEST_GATEWAY: 'https://acceptance.invalid' }))
+  const env = environment()
+  assert.equal(config(env).customer.id, profile.id)
+  delete env.CHONGCHONG_CN_PDA_PASSWORD
+  assert.throws(() => config(env), /CN_PDA_PASSWORD/)
+})
+test('reject wrong proxy, insecure URL, embedded credentials and cross-host routing', () => {
+  for (const value of ['http://acceptance.invalid/api', 'https://user:password@acceptance.invalid/api',
+    'https://acceptance.invalid/api?token=x', 'https://acceptance.invalid', 'https://other.invalid/api']) {
+    assert.throws(() => config({ ...environment(), CHONGCHONG_ADMIN_API_BASE_URL: value }))
+  }
+})
+test('customer identity and initialized state are exact', () => {
+  const expected = config(environment()).customer
+  assert.doesNotThrow(() => assertCustomer(profile, expected))
+  for (const patch of [{ id: '2' }, { id: Number(profile.id) }, { tenantCode: 'other' },
+    { tenantName: 'other' }, { status: 'PENDING' }, { dimensionInitializationStatus: 'FAILED' }]) {
+    assert.throws(() => assertCustomer({ ...profile, ...patch }, expected))
+  }
+})
+test('business mutations, redirects, arbitrary paths and region confusion are denied before fetch', async () => {
+  let calls = 0
+  const http = client(config(environment()), async () => { calls++; throw new Error('unexpected') })
+  for (const [region, method, path] of [['cn', 'POST', '/platform/v1/pallets'],
+    ['cn', 'DELETE', '/platform/v1/locations/1'], ['cn', 'POST', '/merchant/v1/orders'],
+    ['overseas', 'POST', '/auth/login'], ['cn', 'GET', '//untrusted.invalid'],
+    ['cn', 'GET', '/merchant/v1/iam/tenant/profile?redirect=x']]) {
+    assert.equal(allowedRequest(method, path, region), false)
+    await assert.rejects(http.request(region, method, path))
+  }
+  assert.equal(calls, 0)
+})
+test('errors retain diagnostic codes, never echoed credentials or response body', async () => {
+  const http = client(config(environment()), async (_url, options) => {
+    assert.equal(options.redirect, 'error')
+    return { ok: true, status: 200, json: async () => ({ code: 'A0403', requestId: 'r-1', traceId: 't-1', message: 'fixture-secret', data: { password: 'fixture-secret' } }) }
+  })
+  await assert.rejects(http.request('cn', 'POST', '/auth/login'), error =>
+    error.message.includes('A0403') && error.message.includes('r-1') && !error.message.includes('fixture-secret'))
+})
+test('network failure is not retried', async () => {
+  let count = 0
+  const http = client(config(environment()), async () => { count++; throw new Error('fixture-secret') })
+  await assert.rejects(http.request('cn', 'POST', '/auth/login'), /未自动重试/)
+  assert.equal(count, 1)
+})
+test('pagination continues and refuses incomplete or malformed lists', async () => {
+  const pages = [{ records: [{ id: '1' }], total: '2' }, { records: [{ id: '2' }], total: '2' }]
+  assert.equal((await listAll({ request: async () => pages.shift() }, '/?page={page}', 'token')).length, 2)
+  await assert.rejects(listAll({ request: async () => ({ records: [], total: '1' }) }, '/?page={page}'), /提前结束/)
+  await assert.rejects(listAll({ request: async () => ({}) }, '/?page={page}'), /结构/)
+})
+function fakeHttp(bindingId = '3') {
+  return { requests: 0, async request(region, method, path) {
+    this.requests++
+    assert.equal(allowedRequest(method, path, region), true)
+    if (method === 'POST') return { accessToken: 'fixture-token', overseasAccessToken: 'fixture-overseas-token' }
+    if (path.includes('/iam/')) return profile
+    if (path.includes('/warehouse-profile')) return { warehouseId: bindingId, warehouseCode: 'US-LAX-01' }
+    if (path.endsWith('/pda-loading/warehouses')) return [{ id: '2', warehouseCode: 'CN-YIWU-01' }]
+    if (path.includes('/warehouse-admin?')) {
+      const domestic = path.includes('warehouseType=DOMESTIC')
+      return { total: '1', records: [{ id: domestic ? '2' : '3', warehouseCode: domestic ? 'CN-YIWU-01' : 'US-LAX-01', status: 'ACTIVE' }] }
+    }
+    return { total: '1', records: [{ warehouseId: '2', status: 'AVAILABLE' }] }
+  } }
+}
+test('basic preflight is explicitly not full chain and contains no accounts or tokens', async () => {
+  const result = await preflight(config(environment()), fakeHttp())
+  assert.equal(result.status, 'BASIC_PREFLIGHT_PASSED')
+  assert.equal(result.fullFlowVerified, false)
+  assert.ok(result.pending.length)
+  assert.doesNotMatch(JSON.stringify(result), /fixture|9007199254740993/)
+})
+test('PDA warehouse mismatch blocks preflight', async () => {
+  await assert.rejects(preflight(config(environment()), fakeHttp('4')), /仓库绑定不符/)
+})
+test('execute, resume and unrecognized arguments fail closed', async () => {
+  for (const args of [['execute'], ['resume'], ['preflight', '--execute'], ['plan', '--count', '2']]) {
+    await assert.rejects(main(args, {}), /尚未开放/)
+  }
+})