baiyue-firstleg/scripts/prod-release-acceptance.test.mjs

import test from 'node:test'
import assert from 'node:assert/strict'
import { plan, config, assertCustomer, allowedRequest, client, listAll, preflight, main, DOMESTIC_WAREHOUSE_CODES } from './prod-release-acceptance.mjs'

function environment() {
  const env = { CHONGCHONG_ENV: 'gray',
    CHONGCHONG_ADMIN_API_BASE_URL: 'https://acceptance.invalid/api',
    CHONGCHONG_MERCHANT_API_BASE_URL: 'https://acceptance.invalid/api',
    CHONGCHONG_ACCEPTANCE_CUSTOMER_ID: '9007199254740993',
    CHONGCHONG_ACCEPTANCE_CUSTOMER_CODE: 'fixture', CHONGCHONG_ACCEPTANCE_CUSTOMER_NAME: 'fixture',
    CHONGCHONG_OVERSEAS_LAX_PDA_WAREHOUSE_CODE: 'US-LAX-01' }
  for (const role of ['ADMIN', 'MERCHANT', 'CN_PDA', 'OVERSEAS_LAX_PDA']) {
    env[`CHONGCHONG_${role}_USERNAME`] = role
    env[`CHONGCHONG_${role}_PASSWORD`] = 'fixture-secret'
  }
  return env
}
const profile = { id: '9007199254740993', tenantCode: 'fixture', tenantName: 'fixture', status: 'ACTIVE', dimensionInitializationStatus: 'READY' }

test('single order scope does not claim implemented or full coverage', () => {
  const result = plan()
  assert.equal(result.scope.orders, 1)
  assert.equal(result.scope.sameOrder, true)
  assert.deepEqual(result.scope.origins, [...DOMESTIC_WAREHOUSE_CODES])
  assert.equal(result.scope.receiving, 'US-LAX-01')
  assert.equal(result.fullFlowVerified, false)
  assert.equal(result.stages.filter(s => s.status === 'IMPLEMENTED_NOT_HTTP_VERIFIED').length, 14)
  assert.equal(result.stages.filter(s => s.status === 'NOT_IMPLEMENTED').length, 0)
})
test('configuration has no development/test fallback', () => {
  assert.throws(() => config({ ADMIN_TEST_GATEWAY: 'https://acceptance.invalid' }))
  const env = environment()
  assert.equal(config(env).customer.id, profile.id)
  delete env.CHONGCHONG_CN_PDA_PASSWORD
  assert.throws(() => config(env), /CN_PDA_PASSWORD/)
})
test('reject wrong proxy, insecure URL, embedded credentials and cross-host routing', () => {
  for (const value of ['http://acceptance.invalid/api', 'https://user:password@acceptance.invalid/api',
    'https://acceptance.invalid/api?token=x', 'https://acceptance.invalid', 'https://other.invalid/api']) {
    assert.throws(() => config({ ...environment(), CHONGCHONG_ADMIN_API_BASE_URL: value }))
  }
})
test('customer identity and initialized state are exact', () => {
  const expected = config(environment()).customer
  assert.doesNotThrow(() => assertCustomer(profile, expected))
  for (const patch of [{ id: '2' }, { id: Number(profile.id) }, { tenantCode: 'other' },
    { tenantName: 'other' }, { status: 'PENDING' }, { dimensionInitializationStatus: 'FAILED' }]) {
    assert.throws(() => assertCustomer({ ...profile, ...patch }, expected))
  }
})
test('business mutations, redirects, arbitrary paths and region confusion are denied before fetch', async () => {
  let calls = 0
  const http = client(config(environment()), async () => { calls++; throw new Error('unexpected') })
  for (const [region, method, path] of [['cn', 'POST', '/platform/v1/pallets'],
    ['cn', 'DELETE', '/platform/v1/locations/1'], ['cn', 'POST', '/merchant/v1/orders'],
    ['overseas', 'POST', '/auth/login'], ['cn', 'GET', '//untrusted.invalid'],
    ['cn', 'GET', '/merchant/v1/iam/tenant/profile?redirect=x']]) {
    assert.equal(allowedRequest(method, path, region), false)
    await assert.rejects(http.request(region, method, path))
  }
  assert.equal(calls, 0)
})
test('errors retain diagnostic codes, never echoed credentials or response body', async () => {
  const http = client(config(environment()), async (_url, options) => {
    assert.equal(options.redirect, 'error')
    return { ok: true, status: 200, json: async () => ({ code: 'A0403', requestId: 'r-1', traceId: 't-1', message: 'fixture-secret', data: { password: 'fixture-secret' } }) }
  })
  await assert.rejects(http.request('cn', 'POST', '/auth/login'), error =>
    error.message.includes('A0403') && error.message.includes('r-1') && !error.message.includes('fixture-secret'))
})
test('network failure is not retried', async () => {
  let count = 0
  const http = client(config(environment()), async () => { count++; throw new Error('fixture-secret') })
  await assert.rejects(http.request('cn', 'POST', '/auth/login'), /未自动重试/)
  assert.equal(count, 1)
})
test('pagination continues and refuses incomplete or malformed lists', async () => {
  const pages = [{ records: [{ id: '1' }], total: '2' }, { records: [{ id: '2' }], total: '2' }]
  assert.equal((await listAll({ request: async () => pages.shift() }, '/?page={page}', 'token')).length, 2)
  await assert.rejects(listAll({ request: async () => ({ records: [], total: '1' }) }, '/?page={page}'), /提前结束/)
  await assert.rejects(listAll({ request: async () => ({}) }, '/?page={page}'), /结构/)
})
function fakeHttp(bindingId = '3') {
  return { requests: 0, async request(region, method, path) {
    this.requests++
    assert.equal(allowedRequest(method, path, region), true)
    if (method === 'POST') return { accessToken: 'fixture-token' }
    if (path.includes('/iam/')) return profile
    if (path.includes('/warehouse-profile')) return { warehouseId: bindingId, warehouseCode: 'US-LAX-01' }
    if (path.endsWith('/pda-loading/warehouses')) return [{ id: '2', warehouseCode: 'CN-YIWU-01' }, { id: '4', warehouseCode: 'CN-DONGGUAN-01' }]
    if (path.includes('/warehouse-admin?')) {
      const domestic = path.includes('warehouseType=DOMESTIC')
      return domestic
        ? { total: '2', records: [{ id: '2', warehouseCode: 'CN-YIWU-01', status: 'ACTIVE' }, { id: '4', warehouseCode: 'CN-DONGGUAN-01', status: 'ACTIVE' }] }
        : { total: '1', records: [{ id: '3', warehouseCode: 'US-LAX-01', status: 'ACTIVE' }] }
    }
    return { total: '1', records: [{ warehouseId: '2', status: 'AVAILABLE' }] }
  } }
}
test('basic preflight is explicitly not full chain and contains no accounts or tokens', async () => {
  const result = await preflight(config(environment()), fakeHttp())
  assert.equal(result.status, 'BASIC_PREFLIGHT_PASSED')
  assert.equal(result.fullFlowVerified, false)
  assert.ok(result.pending.length)
  assert.doesNotMatch(JSON.stringify(result), /fixture|9007199254740993/)
})
test('PDA warehouse mismatch blocks preflight', async () => {
  await assert.rejects(preflight(config(environment()), fakeHttp('4')), /仓库绑定不符/)
})
test('execute, resume and unrecognized arguments fail closed', async () => {
  for (const args of [['execute'], ['resume'], ['preflight', '--execute'], ['plan', '--count', '2']]) {
    await assert.rejects(main(args, {}), /完整链使用/)
  }
})


test('explicit gray/test mode shares one API base and rejects retired environment keys', () => {
  for (const mode of ['gray', 'test']) {
    const settings = config({ ...environment(), CHONGCHONG_ENV: mode })
    assert.equal(settings.environment, mode)
    assert.equal(settings.apiBase, 'https://acceptance.invalid/api')
    assert.equal(settings.overseas, undefined)
  }
  for (const mode of ['prod', 'dev', '', undefined]) {
    assert.throws(() => config({ ...environment(), CHONGCHONG_ENV: mode }), /显式配置/)
  }
  for (const key of ['CHONGCHONG_ADMIN_OVERSEAS_API_BASE_URL', 'CHONGCHONG_MERCHANT_OVERSEAS_API_BASE_URL']) {
    assert.throws(() => config({ ...environment(), [key]: 'https://acceptance.invalid/api' }), /旧海外网关/)
  }
})

test('overseas PDA calls the unified gateway using its ordinary access token', async () => {
  const calls = []
  const http = client(config(environment()), async (url, options) => {
    calls.push({ url, token: options.headers.Authorization })
    return { ok: true, status: 200, json: async () => ({ code: '200', data: {} }) }
  })
  await http.request('overseas', 'GET', '/pda/v1/last-leg/receiving-containers/warehouse-profile', 'ordinary-access')
  assert.deepEqual(calls, [{ url: 'https://acceptance.invalid/api/pda/v1/last-leg/receiving-containers/warehouse-profile', token: 'Bearer ordinary-access' }])
})

test('unapproved customer blocks preflight before any business stage', async () => {
  const http = fakeHttp(), original = http.request.bind(http)
  http.request = async (...args) => args[2].includes('/iam/')
    ? { ...profile, status: 'PROFILE_REQUIRED' } : original(...args)
  await assert.rejects(preflight(config(environment()), http), /审核状态/)
})