fix: close phase4 overseas acceptance gaps

scripts/admin-test-env-modules/phase4-overseas-pda-contract.test.mjs

@@ -29,6 +29,9 @@ test('PDA module covers the container-number receiving contract and excludes out
   assert.match(source, /同键同载荷重放/)
   assert.match(source, /同键异载荷冲突/)
   assert.match(source, /跨柜切换锁返回409/)
+  assert.match(source, /第二仓库操作员抢占同柜返回409/)
+  assert.match(source, /WAREHOUSE_PICKER/)
+  assert.match(source, /lastleg:pda:operate/)
   assert.match(source, /超收被拒绝/)
   assert.match(source, /重复箱新键被拒绝/)
   assert.match(source, /模式硬拒绝/)
@@ -37,43 +40,60 @@ test('PDA module covers the container-number receiving contract and excludes out
   assert.match(source, /retained as acceptance evidence/)
 })
 
-test('missing customer fixture is a deployment blocker and performs no HTTP request', async () => {
+test('missing WAREHOUSE_PICKER overseas authority is a deployment blocker', async () => {
   const calls = []; const gaps = []; const steps = []
   const context = {
     marker: 'PDA-CONTRACT', context: {}, createdResources: {},
-    async request(...args) { calls.push(args); throw new Error('must not request without credentials') },
+    async request(method, requestPath) {
+      calls.push({ method, requestPath })
+      return { method, path: requestPath, http: 200, body: { code: '200', data: [] },
+        requestId: 'request-contract-1', traceId: 'trace-contract-0001' }
+    },
     async requestOverseas(...args) { calls.push(args); throw new Error('must not request without credentials') },
     async requestOverseasMultipart(...args) { calls.push(args); throw new Error('must not request without credentials') },
+    apiSuccess(module, name, response) { return response.body.data },
     addStep(...args) { steps.push(args) },
     assert(module, name, response, passed, evidence, options) { steps.push({ module, name, passed, evidence, options }) },
     addCoverageGap(...args) { gaps.push(args) },
   }
   await run(context)
-  assert.equal(calls.length, 0)
-  assert.equal(gaps.length, 1)
-  assert.equal(gaps[0][5].deploymentBlocker, true)
-  assert.equal(steps.length, 1)
-  assert.equal(steps[0].passed, false)
-  assert.equal(steps[0].options.deploymentBlocker, true)
+  assert.ok(calls.some((call) => call.requestPath === '/api/platform/v1/iam/roles'))
+  assert.ok(calls.some((call) => call.requestPath === '/api/platform/v1/iam/permissions'))
+  assert.ok(gaps.some((gap) => gap[2] === '海外PDA仓库操作员权限'))
+  assert.ok(steps.some((step) => step?.passed === false && step?.options?.deploymentBlocker))
 })
 
 test('empty candidate response cannot become a zero-business-request pass', async () => {
   const calls = []; const gaps = []; const steps = []
   const response = (data, requestPath, method = 'GET') => ({ method, path: requestPath, http: 200,
     body: { code: '200', data }, requestId: 'req-contract', traceId: 'trace-contract' })
+  let userSequence = 0
+  const roleId = '4000005'; const permissionId = '5107015'
   const context = {
-    marker: 'PDA-CONTRACT', overseasToken: '', createdResources: {},
-    context: { merchantQualificationFixture: { tenantId: '9', username: 'merchant', password: 'generated' } },
-    async request(method, requestPath) {
+    marker: 'PDA-CONTRACT', overseasToken: '', createdResources: {}, context: {},
+    async findAvailablePhone() { userSequence += 1; return `1750000000${userSequence}` },
+    async request(method, requestPath, body) {
       calls.push({ channel: 'domestic', method, requestPath })
-      return response({ overseasAccessToken: 'pda-token' }, requestPath, method)
+      if (method === 'GET' && requestPath.endsWith('/roles')) return response([
+        { id: roleId, roleCode: 'WAREHOUSE_PICKER', status: 'ACTIVE', permissionIds: [permissionId] },
+      ], requestPath, method)
+      if (method === 'GET' && requestPath.endsWith('/permissions')) return response([
+        { id: permissionId, permissionCode: 'lastleg:pda:operate' },
+      ], requestPath, method)
+      if (method === 'POST' && requestPath.endsWith('/users')) return response({
+        membershipId: String(9000 + userSequence), username: body.username, tenantId: '0', roleIds: [roleId], status: 'ACTIVE',
+      }, requestPath, method)
+      if (method === 'POST' && requestPath === '/api/auth/login') return response({ overseasAccessToken: `pda-token-${userSequence}` }, requestPath, method)
+      if (method === 'PUT' && /\/users\/\d+\/status$/.test(requestPath)) return response({ status: 'DISABLED' }, requestPath, method)
+      throw new Error(`unexpected domestic request ${method} ${requestPath}`)
     },
-    async requestOverseas(method, requestPath) {
+    async requestOverseas(method, requestPath, body, headers, token) {
       calls.push({ channel: 'overseas', method, requestPath })
       if (requestPath.endsWith('/current')) return { method, path: requestPath, http: 200,
         body: { code: 'A0404', message: 'not found' }, requestId: 'req-current', traceId: 'trace-current' }
       return response([], requestPath, method)
     },
+    apiSuccess(module, name, result) { return result.body.data },
     addStep(module, name, result, passed, evidence, options) { steps.push({ module, name, result, passed, evidence, options }) },
     assert(module, name, result, passed, evidence, options) { steps.push({ module, name, result, passed, evidence, options }) },
     addCoverageGap(...args) { gaps.push(args) },
@@ -84,4 +104,6 @@ test('empty candidate response cannot become a zero-business-request pass', asyn
   assert.ok(steps.some((step) => step.name.includes('PDA柜号候选覆盖前置') && !step.passed && step.options.deploymentBlocker))
   assert.equal(gaps.length, 1)
   assert.equal(context.createdResources.phase4OverseasPda.finalStatus, null)
+  assert.equal(context.createdResources.phase4OverseasPda.pickerMembershipIds.length, 2)
+  assert.equal(calls.filter((call) => /\/users\/\d+\/status$/.test(call.requestPath)).length, 2)
 })