// 已读取AGENTS.md
import * as fs from 'fs';
import * as path from 'path';

/**
 * 第二十八批回归闸门：组局详情不得泄露他人核销码
 */
describe('第二十八批组局详情核销码隐私闸门', () => {
  const rootDir = path.resolve(__dirname, '../../');
  const indexCode = fs.readFileSync(path.join(rootDir, 'server/src/index.ts'), 'utf-8');
  const apiCode = fs.readFileSync(path.join(rootDir, 'pwuniapp/common/api.js'), 'utf-8');

  it('活动详情路由必须剥离非本人核销码', () => {
    const start = indexCode.indexOf("app.get('/api/activities/:id',");
    expect(start).toBeGreaterThan(-1);
    const block = indexCode.slice(start, start + 1200);
    expect(block).toContain('严禁向他人泄露');
    expect(block).toContain('Number(p.userId) === callerId');
    expect(block).toContain('const { verifyCode, ...rest } = p;');
    expect(block).toContain('isVerifiedAdminRequest(req)');
  });

  it('小程序请求详情携带当前用户身份', () => {
    const start = apiCode.indexOf('export async function getActivityDetail(');
    const block = apiCode.slice(start, start + 300);
    expect(block).toContain('/activities/${id}?userId=${normalizeUserId()}');
  });

  it('数据适配器不得为缺失核销码伪造 8392', () => {
    expect(apiCode).not.toContain("verifyCode: p.verifyCode || '8392'");
  });
});