2599dce315
后端: 身份与归属鉴权收口; 资金安全(结算闸门/支付防篡改/报名费真实扣款/赠金/结算唯一入账/提现打款); 数据泄露与隐私; 登录与密钥安全(默认密钥闸门/登录限流); 可观测性; 启动自检. 微信: 商家转账到零钱提现打款闭环(含回调/查单/失败退回佣金); 订阅消息真实下发闭环与后台模板字段对齐. 后台: 财务/微信支付配置读取失败锁定; 看板/待办/走势去假数据; 打款与测试推送文案修正. 小程序: 请求层错误透传与登录过期提示; 多页失败反馈与乐观回滚; 帮助中心FAQ页面化. 测试: 新增 40+ 回归护栏与真实 MySQL 冒烟(75 套件/599 用例全绿).
134 行
6.7 KiB
TypeScript
134 行
6.7 KiB
TypeScript
// 已读取AGENTS.md
|
|
import * as fs from 'fs';
|
|
import * as path from 'path';
|
|
|
|
/**
|
|
* 第五批高危项回归闸门：订单生命周期越权 / 结算状态闸门 / 组局核销改价身份
|
|
* 以「源码契约断言」锁定边界，防止后续重构悄然后退。
|
|
*/
|
|
describe('第五批安全加固闸门 (订单越权结算 / 订单身份收口 / 组局核销改价)', () => {
|
|
const rootDir = path.resolve(__dirname, '../../');
|
|
const serverRepoPath = path.join(rootDir, 'server/src/db/repository.ts');
|
|
const serverIndexPath = path.join(rootDir, 'server/src/index.ts');
|
|
const apiPath = path.join(rootDir, 'pwuniapp/common/api.js');
|
|
|
|
const indexCode = fs.readFileSync(serverIndexPath, 'utf-8');
|
|
const repoCode = fs.readFileSync(serverRepoPath, 'utf-8');
|
|
const apiCode = fs.readFileSync(apiPath, 'utf-8');
|
|
|
|
const routeBlock = (marker: string, len = 1600) => {
|
|
const start = indexCode.indexOf(marker);
|
|
expect(start).toBeGreaterThan(-1);
|
|
return indexCode.slice(start, start + len);
|
|
};
|
|
|
|
describe('1. 结算状态闸门 (防前端直接结算套现)', () => {
|
|
it('completeOrderWithSettlement 必须拒绝未支付/未接单/已退款等状态结算', () => {
|
|
const start = repoCode.indexOf('async completeOrderWithSettlement(');
|
|
expect(start).toBeGreaterThan(-1);
|
|
const block = repoCode.slice(start, start + 1600);
|
|
expect(block).toContain("const settleBlocked = ['待支付', '待付款', '待接单', '已取消', '已退款', '已全额退款']");
|
|
expect(block).toContain('settleBlocked.includes(String(order.status))');
|
|
expect(block).toContain('不可结算');
|
|
expect(block).toContain('e.status = 409');
|
|
});
|
|
});
|
|
|
|
describe('2. 订单归属解析与操作者角色', () => {
|
|
it('必须提供 getOrderOwnership 并采用大神身份并集策略', () => {
|
|
expect(repoCode).toContain('async getOrderOwnership(');
|
|
const start = repoCode.indexOf('async getOrderOwnership(');
|
|
const block = repoCode.slice(start, start + 1200);
|
|
expect(block).toContain('LEFT JOIN companions c ON c.id = o.expert_id');
|
|
expect(block).toContain('companionIds');
|
|
expect(block).toContain('claimedBy');
|
|
});
|
|
|
|
it('resolveOrderActor 必须区分管理员/买家/承接大神', () => {
|
|
const start = indexCode.indexOf('function resolveOrderActor(');
|
|
expect(start).toBeGreaterThan(-1);
|
|
const block = indexCode.slice(start, start + 900);
|
|
expect(block).toContain('isVerifiedAdminRequest(req)');
|
|
expect(block).toContain('isBuyer');
|
|
expect(block).toContain('companionIds.includes(callerId)');
|
|
});
|
|
});
|
|
|
|
describe('3. 订单生命周期写接口身份收口', () => {
|
|
it('确认完成订单仅交易双方或管理员可操作', () => {
|
|
const block = routeBlock("app.post('/api/orders/:id/complete'");
|
|
expect(block).toContain("resolveOrderActor(req, own, '确认完成订单')");
|
|
expect(block).toContain('仅交易双方或平台管理员可完成该订单');
|
|
});
|
|
|
|
it('取消订单仅买家本人或管理员可操作', () => {
|
|
const block = routeBlock("app.post('/api/orders/:id/cancel'");
|
|
expect(block).toContain("resolveOrderActor(req, own, '取消订单')");
|
|
expect(block).toContain('仅买家本人或平台管理员可取消该订单');
|
|
});
|
|
|
|
it('拒单仅承接大神本人或管理员可操作', () => {
|
|
const block = routeBlock("app.post('/api/orders/:id/reject'");
|
|
expect(block).toContain("resolveOrderActor(req, own, '拒单')");
|
|
expect(block).toContain('仅承接大神本人或平台管理员可拒单');
|
|
});
|
|
|
|
it('申请完成服务仅承接大神本人或管理员可操作', () => {
|
|
const block = routeBlock("app.post('/api/orders/:id/apply-complete'");
|
|
expect(block).toContain("resolveOrderActor(req, own, '申请完成服务')");
|
|
expect(block).toContain('仅承接大神本人或平台管理员可申请完成服务');
|
|
});
|
|
|
|
it('退款申诉仅买家本人或管理员可发起', () => {
|
|
const block = routeBlock("app.post('/api/orders/:id/refund'");
|
|
expect(block).toContain("resolveOrderActor(req, own, '发起退款申诉')");
|
|
expect(block).toContain('仅买家本人或平台管理员可发起退款申诉');
|
|
});
|
|
|
|
it('创建订单必须绑定服务端解析的买家身份', () => {
|
|
const block = routeBlock("app.post('/api/orders',");
|
|
expect(block).toContain("'创建订单'");
|
|
expect(block).toContain('buyerId');
|
|
});
|
|
});
|
|
|
|
describe('4. 组局核销/改价身份以服务端会话为准', () => {
|
|
it('核销、改价、通用核销必须经 resolveSecureUserId 解析操作人', () => {
|
|
expect(indexCode).toContain("resolveSecureUserId(req, Number(operatorId || 0), '核销组局门票')");
|
|
expect(indexCode).toContain("resolveSecureUserId(req, Number(operatorId || 0), '调整组局出价')");
|
|
expect(indexCode).toContain("resolveSecureUserId(req, Number(operatorId || 0), '核销门票')");
|
|
expect(indexCode).not.toContain('Number(operatorId || 1001)');
|
|
});
|
|
|
|
it('报名/退席必须绑定服务端解析的用户身份', () => {
|
|
expect(indexCode).toContain("resolveSecureUserId(req, Number(userId || req.headers['x-user-id'] || 2008), '报名参加活动')");
|
|
expect(indexCode).toContain("resolveSecureUserId(req, Number(userId), '退出组局')");
|
|
});
|
|
|
|
it('修改个人资料必须绑定服务端解析的用户身份', () => {
|
|
expect(indexCode).toContain("resolveSecureUserId(req, Number(req.params.id), '修改个人资料')");
|
|
});
|
|
});
|
|
|
|
describe('5. 小程序端写接口携带真实身份', () => {
|
|
it('订单生命周期接口必须携带 normalizeUserId 解析出的 userId', () => {
|
|
const block = (marker: string, len = 420) => {
|
|
const start = apiCode.indexOf(marker);
|
|
expect(start).toBeGreaterThan(-1);
|
|
return apiCode.slice(start, start + len);
|
|
};
|
|
expect(block('export async function cancelOrder(')).toContain('{ userId: normalizeUserId() }');
|
|
expect(block('export async function completeOrder(')).toContain('{ userId: normalizeUserId() }');
|
|
expect(block('export async function rejectOrder(')).toContain('userId: normalizeUserId(payload.userId)');
|
|
expect(block('export async function applyCompleteOrder(')).toContain('userId: normalizeUserId(payload.userId)');
|
|
expect(block('export async function refundOrder(')).toContain('userId: normalizeUserId(data.userId)');
|
|
});
|
|
|
|
it('下单必须携带买家身份，核销/改价必须携带操作人身份', () => {
|
|
expect(apiCode).toContain('buyerId: uid');
|
|
expect(apiCode).toContain('operatorId: normalizeUserId(operatorId)');
|
|
expect(apiCode).not.toContain('operatorId = 1001');
|
|
});
|
|
});
|
|
});
|