hfb_sys/backend/internal/router/dependencies_test.go

package router

import (
	"context"
	"testing"

	"hfb_sys/backend/internal/database"
	"hfb_sys/backend/internal/model"

	"gorm.io/gorm"
)

func TestPrivateFileAuthorizer(t *testing.T) {
	db := openAuthorizerTestDB(t)
	if err := database.AutoMigrateIfMissing(db, &model.FileUploadOwner{}); err != nil {
		t.Fatalf("AutoMigrate() error = %v", err)
	}

	if err := db.Create(&model.FileUploadOwner{UserID: 11, ObjectKey: "listing/draft.jpg"}).Error; err != nil {
		t.Fatalf("create upload owner error = %v", err)
	}
	if err := db.Exec("INSERT INTO game_accounts (id, owner_id, server_region, login_platform, title, screenshot_urls) "+
		"VALUES (1, 21, '国服', 'steam', '测试账号', ?), (2, 23, '国服', 'steam', '测试账号', ?)", `["/api/files/object?key=listing%2Faccount.jpg"]`, `["/api/files/object?key=listing%2Fno-order.jpg"]`).Error; err != nil {
		t.Fatalf("create account error = %v", err)
	}
	if err := db.Exec("INSERT INTO rental_orders (id, order_no, listing_id, account_id, owner_id, renter_id) " +
		"VALUES (1, 'ORD-1', 1, 1, 21, 22)").Error; err != nil {
		t.Fatalf("create order error = %v", err)
	}
	if err := db.Exec("INSERT INTO chat_messages (id, conversation_id, sender_type, attachment_urls) "+
		"VALUES (1, 8, 'user', ?)", `["/api/files/object?key=chat%2Fmessage.jpg"]`).Error; err != nil {
		t.Fatalf("create chat message error = %v", err)
	}
	if err := db.Exec("INSERT INTO chat_participants (id, conversation_id, participant_type, participant_id, role) " +
		"VALUES (1, 8, 'user', 31, 'renter')").Error; err != nil {
		t.Fatalf("create chat participant error = %v", err)
	}
	if err := db.Exec("INSERT INTO user_payment_accounts (id, user_id, account_type, account_name, account_no, certificate_urls) "+
		"VALUES (1, 41, 'alipay', '测试户名', 'test@example.com', ?)", `["/api/files/object?key=payment-cert%2Fqr.jpg"]`).Error; err != nil {
		t.Fatalf("create payment account error = %v", err)
	}
	if err := db.Exec("INSERT INTO game_accounts (id, owner_id, server_region, login_platform, title, screenshot_urls) "+
		"VALUES (3, 61, '国服', 'steam', '上架商品', ?)", `["/api/files/object?key=misc%2F2026%2F09%2F16%2F984a80162e94e3b89090d1f8.webp"]`).Error; err != nil {
		t.Fatalf("create published account error = %v", err)
	}
	if err := db.Exec("INSERT INTO rental_listings (id, listing_no, account_id, owner_id, status, review_status) " +
		"VALUES (3, 'LIS-3', 3, 61, 'published', 'approved')").Error; err != nil {
		t.Fatalf("create published listing error = %v", err)
	}
	if err := db.Exec("INSERT INTO withdrawal_requests (id, withdraw_no, user_id, amount_cent, actual_amount_cent, account_type, account_name, account_no, status, payment_proof_url) " +
		"VALUES (1, 'W-1', 51, 1000, 990, 'alipay', '张三', 'test@example.com', 'paid', '/api/files/object?key=payment-proof%2Freceipt.jpg')").Error; err != nil {
		t.Fatalf("create withdrawal request error = %v", err)
	}

	authorize := privateFileAuthorizer(db)
	cases := []struct {
		name    string
		userID  uint64
		key     string
		allowed bool
	}{
		{name: "上传者可预览草稿", userID: 11, key: "listing/draft.jpg", allowed: true},
		{name: "账号所有者可读取未出租账号截图", userID: 23, key: "listing/no-order.jpg", allowed: true},
		{name: "订单参与人可读取截图", userID: 22, key: "listing/account.jpg", allowed: true},
		{name: "聊天成员可读取附件", userID: 31, key: "chat/message.jpg", allowed: true},
		{name: "收款账号所有者可读取凭证", userID: 41, key: "payment-cert/qr.jpg", allowed: true},
		{name: "无关联用户不可读取未上架商品截图", userID: 99, key: "listing/no-order.jpg", allowed: false},
		{name: "已审核上架商品截图对任意登录用户开放", userID: 99, key: "misc/2026/09/16/984a80162e94e3b89090d1f8.webp", allowed: true},
		{name: "已审核上架商品中等图变体对任意登录用户开放", userID: 99, key: "misc/2026/09/16/984a80162e94e3b89090d1f8.medium.jpg", allowed: true},
		{name: "提现申请人可读取自己的打款凭证", userID: 51, key: "payment-proof/receipt.jpg", allowed: true},
		{name: "其他用户不可读取他人的打款凭证", userID: 99, key: "payment-proof/receipt.jpg", allowed: false},
	}
	for _, tc := range cases {
		t.Run(tc.name, func(t *testing.T) {
			allowed, err := authorize(context.Background(), tc.userID, tc.key)
			if err != nil {
				t.Fatalf("authorize() error = %v", err)
			}
			if allowed != tc.allowed {
				t.Fatalf("authorize() = %v, want %v", allowed, tc.allowed)
			}
		})
	}
}

func TestRecordPrivateFileUpload(t *testing.T) {
	db := openAuthorizerTestDB(t)
	if err := database.AutoMigrateIfMissing(db, &model.FileUploadOwner{}); err != nil {
		t.Fatalf("AutoMigrate() error = %v", err)
	}
	record := recordPrivateFileUpload(db)
	keys := []string{"listing/original.jpg", "listing/original.thumb.jpg", "listing/original.medium.jpg"}
	if err := record(context.Background(), 11, keys); err != nil {
		t.Fatalf("record() error = %v", err)
	}
	if err := record(context.Background(), 11, keys); err != nil {
		t.Fatalf("duplicate record() error = %v", err)
	}
	var count int64
	if err := db.Model(&model.FileUploadOwner{}).Where("user_id = ?", 11).Count(&count).Error; err != nil {
		t.Fatalf("count records error = %v", err)
	}
	if count != int64(len(keys)) {
		t.Fatalf("record count = %d, want %d", count, len(keys))
	}
}

func openAuthorizerTestDB(t *testing.T) *gorm.DB {
	t.Helper()
	db := database.NewTestDB()
	return db
}