yml2213
85332df2bd
- 订单列表使用独立最小 DTO 并分页，号主待办提供独立接口与统计 - 用户 token 增加版本控制，冻结/改密/退出即时撤销会话 - 移除 URL token 传参，SSE 与接口统一使用 HttpOnly Cookie - 私有文件按上传归属与业务关联授权，收款凭证转私有访问并校验归属 - 公开商品接口返回最小字段，隐藏号主身份与内部状态 - 每日清理超过 30 天未关联业务的上传归属，上传归属失败时补偿删除对象
93 lines
2.7 KiB
Go
93 lines
2.7 KiB
Go
package order
|
|
|
|
import (
|
|
"encoding/json"
|
|
"strings"
|
|
"testing"
|
|
"time"
|
|
|
|
"hfb_sys/backend/internal/model"
|
|
)
|
|
|
|
func TestOrderDTOForUserHidesDepositHoldFields(t *testing.T) {
|
|
now := time.Now()
|
|
row := orderRow{
|
|
RentalOrder: model.RentalOrder{
|
|
ID: 1,
|
|
OwnerID: 10,
|
|
RenterID: 20,
|
|
DepositHoldStatus: model.DepositHoldStatusHeld,
|
|
DepositHoldAmountCent: 1000,
|
|
DepositHoldReason: "风控复核",
|
|
DepositHeldAt: &now,
|
|
DepositHoldReleasedAt: &now,
|
|
},
|
|
}
|
|
|
|
dto := row.toDTOForUser(20)
|
|
if dto.DepositHoldStatus != "" {
|
|
t.Fatalf("deposit hold status = %q, want empty", dto.DepositHoldStatus)
|
|
}
|
|
if dto.DepositHoldAmountCent != 0 {
|
|
t.Fatalf("deposit hold amount = %d, want 0", dto.DepositHoldAmountCent)
|
|
}
|
|
if dto.DepositHoldReason != "" {
|
|
t.Fatalf("deposit hold reason = %q, want empty", dto.DepositHoldReason)
|
|
}
|
|
if dto.DepositHeldAt != nil {
|
|
t.Fatalf("deposit held at = %v, want nil", dto.DepositHeldAt)
|
|
}
|
|
if dto.DepositHoldReleasedAt != nil {
|
|
t.Fatalf("deposit hold released at = %v, want nil", dto.DepositHoldReleasedAt)
|
|
}
|
|
}
|
|
|
|
func TestUserOrderListItemDoesNotSerializeDetailFields(t *testing.T) {
|
|
row := orderRow{
|
|
RentalOrder: model.RentalOrder{
|
|
ID: 1,
|
|
OrderNo: "ORD-001",
|
|
ListingID: 2,
|
|
OwnerID: 10,
|
|
RenterID: 20,
|
|
RentAmountCent: 1000,
|
|
DepositAmountCent: 2000,
|
|
DepositHoldReason: "风控复核",
|
|
DepositFreeManualQuotaCent: 5000,
|
|
Status: orderStatusPendingPayment,
|
|
},
|
|
ListingNo: "SP000002",
|
|
Title: "测试账号",
|
|
}
|
|
|
|
raw, err := json.Marshal(row.toUserListItem(20, nil))
|
|
if err != nil {
|
|
t.Fatalf("Marshal() error = %v", err)
|
|
}
|
|
text := string(raw)
|
|
for _, field := range []string{"account_snapshot", "deposit_hold_reason", "deposit_free_manual_quota_cent", "owner_id", "renter_id"} {
|
|
if strings.Contains(text, field) {
|
|
t.Fatalf("list response contains sensitive field %q: %s", field, text)
|
|
}
|
|
}
|
|
}
|
|
|
|
func TestAdminOrderListItemMasksPhonesAndOmitsSnapshot(t *testing.T) {
|
|
row := orderRow{
|
|
RentalOrder: model.RentalOrder{ID: 1, OrderNo: "ORD-001", Status: orderStatusPendingPayment},
|
|
OwnerPhone: "13800001234",
|
|
RenterPhone: "13900005678",
|
|
}
|
|
raw, err := json.Marshal(row.toAdminListItem())
|
|
if err != nil {
|
|
t.Fatalf("Marshal() error = %v", err)
|
|
}
|
|
text := string(raw)
|
|
if strings.Contains(text, "13800001234") || strings.Contains(text, "13900005678") {
|
|
t.Fatalf("list response contains full phone number: %s", text)
|
|
}
|
|
if strings.Contains(text, "account_snapshot") {
|
|
t.Fatalf("list response contains account snapshot: %s", text)
|
|
}
|
|
}
|