// 已读取AGENTS.md
import * as fs from 'fs';
import * as path from 'path';

/**
 * 第五批高危项回归闸门：订单生命周期越权 / 结算状态闸门 / 组局核销改价身份
 * 以「源码契约断言」锁定边界，防止后续重构悄然后退。
 */
describe('第五批安全加固闸门 (订单越权结算 / 订单身份收口 / 组局核销改价)', () => {
  const rootDir = path.resolve(__dirname, '../../');
  const serverRepoPath = path.join(rootDir, 'server/src/db/repository.ts');
  const serverIndexPath = path.join(rootDir, 'server/src/index.ts');
  const apiPath = path.join(rootDir, 'pwuniapp/common/api.js');

  const indexCode = fs.readFileSync(serverIndexPath, 'utf-8');
  const repoCode = fs.readFileSync(serverRepoPath, 'utf-8');
  const apiCode = fs.readFileSync(apiPath, 'utf-8');

  const routeBlock = (marker: string, len = 1600) => {
    const start = indexCode.indexOf(marker);
    expect(start).toBeGreaterThan(-1);
    return indexCode.slice(start, start + len);
  };

  describe('1. 结算状态闸门 (防前端直接结算套现)', () => {
    it('completeOrderWithSettlement 必须拒绝未支付/未接单/已退款等状态结算', () => {
      const start = repoCode.indexOf('async completeOrderWithSettlement(');
      expect(start).toBeGreaterThan(-1);
      const block = repoCode.slice(start, start + 1600);
      expect(block).toContain("const settleBlocked = ['待支付', '待付款', '待接单', '已取消', '已退款', '已全额退款']");
      expect(block).toContain('settleBlocked.includes(String(order.status))');
      expect(block).toContain('不可结算');
      expect(block).toContain('e.status = 409');
    });
  });

  describe('2. 订单归属解析与操作者角色', () => {
    it('必须提供 getOrderOwnership 并采用大神身份并集策略', () => {
      expect(repoCode).toContain('async getOrderOwnership(');
      const start = repoCode.indexOf('async getOrderOwnership(');
      const block = repoCode.slice(start, start + 1200);
      expect(block).toContain('LEFT JOIN companions c ON c.id = o.expert_id');
      expect(block).toContain('companionIds');
      expect(block).toContain('claimedBy');
    });

    it('resolveOrderActor 必须区分管理员/买家/承接大神', () => {
      const start = indexCode.indexOf('function resolveOrderActor(');
      expect(start).toBeGreaterThan(-1);
      const block = indexCode.slice(start, start + 900);
      expect(block).toContain('isVerifiedAdminRequest(req)');
      expect(block).toContain('isBuyer');
      expect(block).toContain('companionIds.includes(callerId)');
    });
  });

  describe('3. 订单生命周期写接口身份收口', () => {
    it('确认完成订单仅交易双方或管理员可操作', () => {
      const block = routeBlock("app.post('/api/orders/:id/complete'");
      expect(block).toContain("resolveOrderActor(req, own, '确认完成订单')");
      expect(block).toContain('仅交易双方或平台管理员可完成该订单');
    });

    it('取消订单仅买家本人或管理员可操作', () => {
      const block = routeBlock("app.post('/api/orders/:id/cancel'");
      expect(block).toContain("resolveOrderActor(req, own, '取消订单')");
      expect(block).toContain('仅买家本人或平台管理员可取消该订单');
    });

    it('拒单仅承接大神本人或管理员可操作', () => {
      const block = routeBlock("app.post('/api/orders/:id/reject'");
      expect(block).toContain("resolveOrderActor(req, own, '拒单')");
      expect(block).toContain('仅承接大神本人或平台管理员可拒单');
    });

    it('申请完成服务仅承接大神本人或管理员可操作', () => {
      const block = routeBlock("app.post('/api/orders/:id/apply-complete'");
      expect(block).toContain("resolveOrderActor(req, own, '申请完成服务')");
      expect(block).toContain('仅承接大神本人或平台管理员可申请完成服务');
    });

    it('退款申诉仅买家本人或管理员可发起', () => {
      const block = routeBlock("app.post('/api/orders/:id/refund'");
      expect(block).toContain("resolveOrderActor(req, own, '发起退款申诉')");
      expect(block).toContain('仅买家本人或平台管理员可发起退款申诉');
    });

    it('创建订单必须绑定服务端解析的买家身份', () => {
      const block = routeBlock("app.post('/api/orders',");
      expect(block).toContain("'创建订单'");
      expect(block).toContain('buyerId');
    });
  });

  describe('4. 组局核销/改价身份以服务端会话为准', () => {
    it('核销、改价、通用核销必须经 resolveSecureUserId 解析操作人', () => {
      expect(indexCode).toContain("resolveSecureUserId(req, Number(operatorId || 0), '核销组局门票')");
      expect(indexCode).toContain("resolveSecureUserId(req, Number(operatorId || 0), '调整组局出价')");
      expect(indexCode).toContain("resolveSecureUserId(req, Number(operatorId || 0), '核销门票')");
      expect(indexCode).not.toContain('Number(operatorId || 1001)');
    });

    it('报名/退席必须绑定服务端解析的用户身份', () => {
      expect(indexCode).toContain("resolveSecureUserId(req, Number(userId || req.headers['x-user-id'] || 2008), '报名参加活动')");
      expect(indexCode).toContain("resolveSecureUserId(req, Number(userId), '退出组局')");
    });

    it('修改个人资料必须绑定服务端解析的用户身份', () => {
      expect(indexCode).toContain("resolveSecureUserId(req, Number(req.params.id), '修改个人资料')");
    });
  });

  describe('5. 小程序端写接口携带真实身份', () => {
    it('订单生命周期接口必须携带 normalizeUserId 解析出的 userId', () => {
      const block = (marker: string, len = 420) => {
        const start = apiCode.indexOf(marker);
        expect(start).toBeGreaterThan(-1);
        return apiCode.slice(start, start + len);
      };
      expect(block('export async function cancelOrder(')).toContain('{ userId: normalizeUserId() }');
      expect(block('export async function completeOrder(')).toContain('{ userId: normalizeUserId() }');
      expect(block('export async function rejectOrder(')).toContain('userId: normalizeUserId(payload.userId)');
      expect(block('export async function applyCompleteOrder(')).toContain('userId: normalizeUserId(payload.userId)');
      expect(block('export async function refundOrder(')).toContain('userId: normalizeUserId(data.userId)');
    });

    it('下单必须携带买家身份，核销/改价必须携带操作人身份', () => {
      expect(apiCode).toContain('buyerId: uid');
      expect(apiCode).toContain('operatorId: normalizeUserId(operatorId)');
      expect(apiCode).not.toContain('operatorId = 1001');
    });
  });
});