test(lastleg): derive merchant relabel scope from profile receipt

2026-10-18 19:29:35 +08:00
parent 4bef8577fa
commit 2c330bf9df
2 changed files with 20 additions and 3 deletions
@@ -58,8 +58,11 @@ async function loadProducerResources(context) {
    }
    if (e.method === 'POST' && path === '/api/merchant/v1/last-leg/relabel-applications' && actors.has(e.actor)) {
      const a = data.application
-      must(a && id(a.customerId) === actors.get(e.actor) && id(a.overseasWarehouseId) === id(e.body?.operationWarehouseId), 'Relabel producer scope mismatch')
-      add('relabel', a.relabelNo, a.customerId, a.overseasWarehouseId, e)
+      const customerId = actors.get(e.actor)
+      must(a && (a.customerId === undefined || id(a.customerId) === customerId)
+        && id(a.overseasWarehouseId) === id(e.body?.operationWarehouseId), 'Relabel producer scope mismatch')
+      // Merchant summaries omit customerId; the authenticated profile receipt supplies its scope.
+      add('relabel', a.relabelNo, customerId, a.overseasWarehouseId, e)
    }
    if (e.method === 'POST' && path === '/api/merchant/v1/last-leg/return-orders' && actors.has(e.actor)
      && String(e.body?.remark).includes(context.marker)) add('return', data.order?.returnNo, actors.get(e.actor), data.order?.overseasWarehouseId, e)