优化

scripts/admin-test-env-modules/domestic-container-contract.test.mjs

@@ -3,6 +3,30 @@ import assert from 'node:assert/strict'
 import fs from 'node:fs'
 import path from 'node:path'
 import { fileURLToPath } from 'node:url'
+import { verifyPermissionDenial } from './domestic-container.mjs'
+
+test('fixed denial actor never creates, resets or disables accounts and always logs out', async () => {
+  for (const deniedCode of ['A0403', '200']) {
+    const calls = []
+    const actor = { membershipId: '123', username: 'deny-fixture', password: 'fixture-password' }
+    const context = { options: { fixedCustomerId: '456', fixedDomesticDenyActor: actor },
+      async request(method, path) {
+        calls.push({ method, path })
+        const data = path.includes('/iam/users?') ? { total: 1, records: [{ ...actor, tenantId: '0', status: 'ACTIVE' }] }
+          : path === '/api/auth/login' ? { accessToken: 'fixture-token', refreshToken: 'fixture-refresh' } : {}
+        return { http: 200, body: { code: path.includes('/inventories?') ? deniedCode : '200', data }, requestId: 'test', traceId: 'test' }
+      }, apiSuccess(_module, _label, response) { return response.body.data }, assert() {},
+    }
+    if (deniedCode === 'A0403') await verifyPermissionDenial(context, 'RUN', '789', 'CONTAINER')
+    else await assert.rejects(verifyPermissionDenial(context, 'RUN', '789', 'CONTAINER'), /实际权限不符/)
+    assert.equal(calls.at(-1).path, '/api/auth/logout')
+    assert.ok(calls.every(call => call.method === 'GET' || ['/api/auth/login', '/api/auth/logout'].includes(call.path)))
+  }
+})
+
+test('missing fixed denial account blocks without requesting a phone or making HTTP calls', async () => {
+  await assert.rejects(verifyPermissionDenial({ options: { fixedCustomerId: '123' } }, 'RUN', '789', 'CONTAINER'), /禁止自动创建/)
+})
 
 const here = path.dirname(fileURLToPath(import.meta.url))
 const moduleSource = fs.readFileSync(path.join(here, 'domestic-container.mjs'), 'utf8')