fix(order): enforce versioned platform commands and submissions

2026-10-02 23:14:24 +08:00
parent 25580dab86
commit c55ecabbfb
27 changed files with 540 additions and 74 deletions
@@ -2,7 +2,36 @@ import assert from 'node:assert/strict'
 import { readFileSync } from 'node:fs'
 import test from 'node:test'

-import { fixtureInboundCode, orderPersistenceFacts, requestedOrderDestinationType } from './orders.mjs'
+import { fixtureInboundCode, orderPersistenceFacts, requestedOrderDestinationType, freezeOrderCommand, verifyPlatformDraftEdit } from './orders.mjs'
+
+test('order command freezes original detail version/key and never accepts an absent version',()=>{
+  const detail={order:{version:3}},draft={customerRemark:'original'}
+  const command=freezeOrderCommand(detail,'key',{draft})
+  detail.order.version=8;draft.customerRemark='changed'
+  assert.deepEqual(command,{body:{draft:{customerRemark:'original'},expectedVersion:3},headers:{'Idempotency-Key':'key'}})
+  assert.ok(Object.isFrozen(command.body.draft))
+  for(const version of [undefined,null,'3',-1])assert.throws(()=>freezeOrderCommand({order:{version}},'key'))
+})
+
+test('Platform edit uses exact customer and admin identity; replay/stale/foreign writes preserve full facts',async()=>{
+  let detail={order:{id:'10',tenantId:'20',status:'DRAFT',version:3,customerRemark:'marker'},cargoes:[],parties:[],internalNotes:[],statusHistory:[]}
+  let saved
+  const writes=[]
+  const context={marker:'marker',token:'admin',createdResources:{orders:{}},apiSuccess(_m,_n,r){assert.equal(r.body.code,'200');return r.body.data},
+    assert(_m,name,_r,ok){assert.ok(ok,name)},async request(method,path,body,token,headers){
+      assert.equal(path,'/api/platform/v1/orders/first-leg/10?tenantId=20')
+      if(method==='GET')return {http:200,body:{code:'200',data:structuredClone(detail)}}
+      writes.push({body,token,headers})
+      let code='200'
+      if(token!=='admin')code='A0403'
+      else if(saved)code=saved.key===headers['Idempotency-Key']&&saved.payload===JSON.stringify(body)?'200':'A0409'
+      else {assert.equal(body.expectedVersion,3);saved={key:headers['Idempotency-Key'],payload:JSON.stringify(body)};detail.order.version++;detail.order.customerRemark=body.draft.customerRemark;detail.statusHistory.push({action:'UPDATE'})}
+      return {http:200,body:{code}}
+    }}
+  const result=await verifyPlatformDraftEdit(context,'20','10','merchant',{customerRemark:'marker'})
+  assert.equal(result.order.version,4);assert.equal(writes.length,5)
+  assert.deepEqual(writes[1],writes[2]);assert.equal(writes[0].token,'merchant')
+})

 const source = readFileSync(new URL('orders.mjs', import.meta.url), 'utf8')