// 已读取AGENTS.md
import * as fs from 'fs';
import * as path from 'path';

/**
 * 第十五批回归闸门：核销码反查防枚举 + 抢单池客户名脱敏
 */
describe('第十五批核销码与抢单池加固闸门', () => {
  const rootDir = path.resolve(__dirname, '../../');
  const indexCode = fs.readFileSync(path.join(rootDir, 'server/src/index.ts'), 'utf-8');
  const repoCode = fs.readFileSync(path.join(rootDir, 'server/src/db/repository.ts'), 'utf-8');
  const apiCode = fs.readFileSync(path.join(rootDir, 'pwuniapp/common/api.js'), 'utf-8');

  const routeBlock = (marker: string, len = 1400) => {
    const start = indexCode.indexOf(marker);
    expect(start).toBeGreaterThan(-1);
    return indexCode.slice(start, start + len);
  };

  describe('1. 核销码反查不得被匿名枚举', () => {
    it('必须要求登录并按门票归属方校验', () => {
      const block = routeBlock("app.get('/api/verify/query/:code'");
      expect(block).toContain("'查询核销码'");
      expect(block).toContain('SECURE_MODE && !isVerifiedAdminRequest(req)');
      expect(block).toContain('无权查看该核销码信息');
    });
  });

  describe('2. 抢单池客户名脱敏', () => {
    it('仓储层必须对 client_name 脱敏', () => {
      const start = repoCode.indexOf('async getOrdersPool(');
      const block = repoCode.slice(start, start + 1400);
      expect(block).toContain('maskClientName');
      expect(block).not.toContain('userName: r.clientName ||');
    });
  });

  describe('3. 小程序反查携带当前用户身份', () => {
    it('queryCheckinCode 必须带 userId', () => {
      const start = apiCode.indexOf('export async function queryCheckinCode(');
      const block = apiCode.slice(start, start + 300);
      expect(block).toContain('/verify/query/${code}?userId=${normalizeUserId()}');
    });
  });
});