test: honor runtime inbound code policy in HTTP order fixtures

scripts/admin-test-env-modules/orders.mjs

@@ -1,3 +1,5 @@
+import { createHash } from 'node:crypto'
+
 const MODULE = 'orders'
 const CONTRACT_OPTIONS = { scenario: 'isolated-order-chain', deploymentBlocker: true }
 const MERCHANT_USERNAME = process.env.MERCHANT_TEST_USERNAME || ''
@@ -25,6 +27,14 @@ function rotate(values, offset) {
   return [...values.slice(shift), ...values.slice(0, shift)]
 }
 function key(context, operation) { return `${context.marker}-${operation}`.slice(0, 128) }
+export function fixtureInboundCode(policy, marker) {
+  if (policy?.mode === 'AUTO' && policy.manualEntryRequired === false) return {}
+  if (policy?.mode !== 'LEGACY_MANUAL' || policy.manualEntryRequired !== true || !marker) {
+    throw new Error('入仓码策略缺失或不一致，停止创建测试订单')
+  }
+  // Short enough for the 34-character carton QR limit; stable within this fresh fixture.
+  return { inboundCode: `AT${createHash('sha256').update(marker).digest('hex').slice(0, 20).toUpperCase()}` }
+}
 function declarationCargo(source, index) {
   const number = (value) => Number.isFinite(Number(value)) ? Number(value) : 0
   const optionalNumber = (value) => value === null || value === undefined || value === '' ? null : number(value)
@@ -574,8 +584,11 @@ export async function run(context) {
     privateDestinationAddressId: master.destinationType === 'PRIVATE'
       ? await ensureCustomerAddress(context, merchantToken, profile, 'PRIVATE_DESTINATION') : null,
   }
-  const payload = buildPayload(context, profile, master, productImageFileId, customerAddresses)
   const createPath = '/api/merchant/v1/orders/first-leg'
+  const policyResponse = await request(context, 'GET', `${createPath}/inbound-code-policy`, undefined, merchantToken)
+  const policy = context.apiSuccess(MODULE, 'Client 读取入仓码录入策略', policyResponse, '', CONTRACT_OPTIONS)
+  const payload = { ...buildPayload(context, profile, master, productImageFileId, customerAddresses),
+    ...fixtureInboundCode(policy, context.marker) }
   const createResponse = await request(context, 'POST', createPath, payload, merchantToken,
     { 'Idempotency-Key': key(context, 'client-create') })
   const orderId = id(context.apiSuccess(MODULE, 'Client 创建四箱型隔离订单', createResponse,