feat: gate overseas receiving and harden phase4 workflows

2026-08-25 10:31:04 +08:00
parent cb78bc6b41
commit 52b9fc382f
93 changed files with 2779 additions and 201 deletions
@@ -0,0 +1,39 @@
+import test from 'node:test'
+import assert from 'node:assert/strict'
+import { readFileSync } from 'node:fs'
+
+const acceptance = readFileSync(new URL('./phase3-warehouse-rbac.mjs', import.meta.url), 'utf8')
+const iamSql = readFileSync(new URL('../../iam/src/main/resources/db/lastleg-permissions.sql', import.meta.url), 'utf8')
+
+const listCodes = [
+  'platform:overseas-warehouse:last-mile-order:list',
+  'platform:overseas-warehouse:inbound-order:list',
+  'platform:overseas-warehouse:relabel-order:list',
+  'platform:overseas-warehouse:inventory:list',
+  'platform:overseas-warehouse:warehouse:list',
+  'platform:overseas-warehouse:location:list',
+  'platform:overseas-warehouse:pallet:list',
+  'platform:overseas-business:purchase:list',
+  'platform:overseas-business:truck:list',
+  'platform:overseas-business:looseboard:list',
+]
+
+test('warehouse operator and tally use the exact phase-four list/detail permission set', () => {
+  for (const code of listCodes) {
+    assert.match(acceptance, new RegExp(code.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')))
+    assert.match(iamSql, new RegExp(`'WAREHOUSE_OPERATOR','${code}'`))
+    assert.match(iamSql, new RegExp(`'WAREHOUSE_TALLY','${code}'`))
+  }
+  assert.match(acceptance, /operatorCodes\.size === 15/)
+  assert.match(acceptance, /tallyCodes\.size === 22/)
+  assert.match(acceptance, /PHASE4_WRITE_SUFFIXES/)
+  assert.match(iamSql, /assert_phase4_warehouse_role_minimum/)
+  assert.match(iamSql, /permission_code REGEXP ':\(create\|edit\|status\|export\|adjust\|delete\|review\)\$'/)
+})
+
+test('picker stays isolated to the dedicated overseas PDA authority', () => {
+  assert.match(acceptance, /pickerCodes\.size === 3/)
+  assert.match(acceptance, /pickerCodes\.has\('lastleg:pda:operate'\)/)
+  assert.match(iamSql, /role\.role_code='WAREHOUSE_PICKER'/)
+  assert.match(iamSql, /permission\.permission_code='lastleg:pda:operate'/)
+})