449 lines
14 KiB
Rust
449 lines
14 KiB
Rust
mod common;
|
|
|
|
use common::{
|
|
add_to_cart, category_id_by_slug, checkout, client, create_product_full,
|
|
create_product_with_sku, create_product_with_sku_in_category, create_shop, login_admin,
|
|
make_shop_owner, pay, publish_product, register_customer, spawn_app,
|
|
};
|
|
use serial_test::serial;
|
|
|
|
#[tokio::test]
|
|
#[serial]
|
|
async fn customer_forbidden_on_admin_routes() {
|
|
let app = spawn_app().await;
|
|
let (customer_token, _) = register_customer(&app, "cust").await;
|
|
let res = client()
|
|
.get(app.url("/api/admin/users"))
|
|
.bearer_auth(&customer_token)
|
|
.send()
|
|
.await
|
|
.unwrap();
|
|
assert_eq!(res.status(), 403);
|
|
}
|
|
|
|
#[tokio::test]
|
|
#[serial]
|
|
async fn publish_lifecycle_and_public_visibility() {
|
|
let app = spawn_app().await;
|
|
let admin = login_admin(&app).await;
|
|
let shop_id = create_shop(&app, &admin, "shop-life").await;
|
|
let owner = make_shop_owner(&app, &admin, &shop_id).await;
|
|
|
|
// draft with no SKU cannot be published
|
|
let res = client()
|
|
.post(app.url("/api/shop/products"))
|
|
.bearer_auth(&owner)
|
|
.json(&serde_json::json!({
|
|
"slug": "nosku",
|
|
"name": {"en": "NoSku", "zh": "无SKU"},
|
|
}))
|
|
.send()
|
|
.await
|
|
.unwrap();
|
|
let no_sku_id = res.json::<serde_json::Value>().await.unwrap()["id"]
|
|
.as_str()
|
|
.unwrap()
|
|
.to_string();
|
|
let res = client()
|
|
.post(app.url(&format!("/api/shop/products/{no_sku_id}/publish")))
|
|
.bearer_auth(&owner)
|
|
.send()
|
|
.await
|
|
.unwrap();
|
|
assert_eq!(res.status(), 400);
|
|
|
|
// product with SKU: publish → listed publicly → unpublish → gone
|
|
let (product_id, mug_slug) = create_product_with_sku(&app, &owner, "mug", 1299, 10).await;
|
|
let res = client()
|
|
.post(app.url(&format!("/api/shop/products/{product_id}/publish")))
|
|
.bearer_auth(&owner)
|
|
.send()
|
|
.await
|
|
.unwrap();
|
|
assert_eq!(res.status(), 200);
|
|
assert_eq!(
|
|
res.json::<serde_json::Value>().await.unwrap()["status"],
|
|
"published"
|
|
);
|
|
|
|
let res = client().get(app.url("/api/products")).send().await.unwrap();
|
|
let list: serde_json::Value = res.json().await.unwrap();
|
|
assert!(list["items"]
|
|
.as_array()
|
|
.unwrap()
|
|
.iter()
|
|
.any(|p| p["id"] == product_id));
|
|
|
|
// detail by slug works and carries i18n fields
|
|
let res = client()
|
|
.get(app.url(&format!("/api/products/{mug_slug}")))
|
|
.send()
|
|
.await
|
|
.unwrap();
|
|
assert_eq!(res.status(), 200);
|
|
let detail: serde_json::Value = res.json().await.unwrap();
|
|
assert_eq!(detail["name"]["en"], format!("Product {mug_slug}"));
|
|
assert_eq!(detail["name"]["zh"], format!("商品 {mug_slug}"));
|
|
assert_eq!(detail["skus"][0]["price_minor"], 1299);
|
|
|
|
let res = client()
|
|
.post(app.url(&format!("/api/shop/products/{product_id}/unpublish")))
|
|
.bearer_auth(&owner)
|
|
.send()
|
|
.await
|
|
.unwrap();
|
|
assert_eq!(res.status(), 200);
|
|
let res = client()
|
|
.get(app.url(&format!("/api/products/{product_id}")))
|
|
.send()
|
|
.await
|
|
.unwrap();
|
|
assert_eq!(res.status(), 404);
|
|
}
|
|
|
|
#[tokio::test]
|
|
#[serial]
|
|
async fn shop_isolation_enforced() {
|
|
let app = spawn_app().await;
|
|
let admin = login_admin(&app).await;
|
|
let shop_a = create_shop(&app, &admin, "shop-iso-a").await;
|
|
let shop_b = create_shop(&app, &admin, "shop-iso-b").await;
|
|
let owner_a = make_shop_owner(&app, &admin, &shop_a).await;
|
|
let owner_b = make_shop_owner(&app, &admin, &shop_b).await;
|
|
|
|
let (product_b, _) = create_product_with_sku(&app, &owner_b, "b-item", 500, 3).await;
|
|
let res = client()
|
|
.get(app.url(&format!("/api/shop/products/{product_b}")))
|
|
.bearer_auth(&owner_a)
|
|
.send()
|
|
.await
|
|
.unwrap();
|
|
assert_eq!(res.status(), 404);
|
|
|
|
// owner A's product list contains none of shop B's products
|
|
let res = client()
|
|
.get(app.url("/api/shop/products"))
|
|
.bearer_auth(&owner_a)
|
|
.send()
|
|
.await
|
|
.unwrap();
|
|
let list: serde_json::Value = res.json().await.unwrap();
|
|
assert!(!list["items"]
|
|
.as_array()
|
|
.unwrap()
|
|
.iter()
|
|
.any(|p| p["id"] == product_b));
|
|
}
|
|
|
|
#[tokio::test]
|
|
#[serial]
|
|
async fn currency_conversion_math() {
|
|
let app = spawn_app().await;
|
|
// 1000 minor USD ($10.00) -> JPY at rate 150 => 1500 minor (¥1500)
|
|
let res = client()
|
|
.get(app.url("/api/currencies/convert?amount_minor=1000&from=USD&to=JPY"))
|
|
.send()
|
|
.await
|
|
.unwrap();
|
|
assert_eq!(res.status(), 200);
|
|
let body: serde_json::Value = res.json().await.unwrap();
|
|
assert_eq!(body["amount_minor"], 1500);
|
|
assert_eq!(body["currency"], "JPY");
|
|
|
|
// midpoint rounds half-up (away from zero), not banker's rounding:
|
|
// 1999 minor USD ($19.99) -> JPY at rate 150 => 2998.5 -> 2999
|
|
let res = client()
|
|
.get(app.url("/api/currencies/convert?amount_minor=1999&from=USD&to=JPY"))
|
|
.send()
|
|
.await
|
|
.unwrap();
|
|
assert_eq!(
|
|
res.json::<serde_json::Value>().await.unwrap()["amount_minor"],
|
|
2999
|
|
);
|
|
|
|
// disabled currency rejected
|
|
let admin = login_admin(&app).await;
|
|
let res = client()
|
|
.post(app.url("/api/admin/currencies"))
|
|
.bearer_auth(&admin)
|
|
.json(&serde_json::json!({
|
|
"code": "XXX",
|
|
"name": {"en": "Test", "zh": "测试"},
|
|
"symbol": "X",
|
|
"exponent": 2,
|
|
"rate_to_base": "2.0",
|
|
"enabled": false,
|
|
}))
|
|
.send()
|
|
.await
|
|
.unwrap();
|
|
assert_eq!(res.status(), 200);
|
|
let res = client()
|
|
.get(app.url("/api/currencies/convert?amount_minor=100&from=USD&to=XXX"))
|
|
.send()
|
|
.await
|
|
.unwrap();
|
|
assert_eq!(res.status(), 400);
|
|
}
|
|
|
|
#[tokio::test]
|
|
#[serial]
|
|
async fn category_subtree_listing_and_price_sort() {
|
|
let app = spawn_app().await;
|
|
let admin = login_admin(&app).await;
|
|
let shop_id = create_shop(&app, &admin, "shop-browse").await;
|
|
let owner = make_shop_owner(&app, &admin, &shop_id).await;
|
|
|
|
let electronics = category_id_by_slug(&app, "electronics").await;
|
|
let phones = category_id_by_slug(&app, "electronics-phones").await;
|
|
let flagship = category_id_by_slug(&app, "electronics-flagship").await;
|
|
let audio = category_id_by_slug(&app, "electronics-audio").await;
|
|
let fashion = category_id_by_slug(&app, "fashion").await;
|
|
|
|
// A grandchild, a sibling branch under the same root, and an unrelated root.
|
|
let (leaf, _) =
|
|
create_product_with_sku_in_category(&app, &owner, "leaf", 5000, 5, Some(&flagship)).await;
|
|
let (sibling, _) =
|
|
create_product_with_sku_in_category(&app, &owner, "sib", 1000, 5, Some(&audio)).await;
|
|
let (unrelated, _) =
|
|
create_product_with_sku_in_category(&app, &owner, "other", 3000, 5, Some(&fashion)).await;
|
|
for id in [&leaf, &sibling, &unrelated] {
|
|
publish_product(&app, &owner, id).await;
|
|
}
|
|
|
|
fn listed_ids(body: &serde_json::Value) -> Vec<String> {
|
|
body["items"]
|
|
.as_array()
|
|
.unwrap()
|
|
.iter()
|
|
.map(|p| p["id"].as_str().unwrap().to_string())
|
|
.collect()
|
|
}
|
|
|
|
// A root category must include its children's and grandchildren's products.
|
|
let res = client()
|
|
.get(app.url(&format!(
|
|
"/api/products?category_id={electronics}&shop_id={shop_id}&per_page=50"
|
|
)))
|
|
.send()
|
|
.await
|
|
.unwrap();
|
|
assert_eq!(res.status(), 200);
|
|
let body: serde_json::Value = res.json().await.unwrap();
|
|
let listed = listed_ids(&body);
|
|
assert!(
|
|
listed.contains(&leaf),
|
|
"grandchild product missing from root listing"
|
|
);
|
|
assert!(
|
|
listed.contains(&sibling),
|
|
"child product missing from root listing"
|
|
);
|
|
assert!(
|
|
!listed.contains(&unrelated),
|
|
"product from another root category leaked in"
|
|
);
|
|
assert_eq!(
|
|
body["total"], 2,
|
|
"total must count the subtree, not only the root"
|
|
);
|
|
|
|
// A mid-level category covers its own subtree and nothing else.
|
|
let res = client()
|
|
.get(app.url(&format!(
|
|
"/api/products?category_id={phones}&shop_id={shop_id}"
|
|
)))
|
|
.send()
|
|
.await
|
|
.unwrap();
|
|
let body: serde_json::Value = res.json().await.unwrap();
|
|
assert_eq!(listed_ids(&body), vec![leaf.clone()]);
|
|
|
|
// Price sort orders by the product's lowest active SKU price.
|
|
let res = client()
|
|
.get(app.url(&format!(
|
|
"/api/products?category_id={electronics}&shop_id={shop_id}&per_page=50&sort=price&order=asc"
|
|
)))
|
|
.send()
|
|
.await
|
|
.unwrap();
|
|
assert_eq!(res.status(), 200);
|
|
let body: serde_json::Value = res.json().await.unwrap();
|
|
assert_eq!(listed_ids(&body), vec![sibling.clone(), leaf.clone()]);
|
|
|
|
let res = client()
|
|
.get(app.url(&format!(
|
|
"/api/products?category_id={electronics}&shop_id={shop_id}&per_page=50&sort=price&order=desc"
|
|
)))
|
|
.send()
|
|
.await
|
|
.unwrap();
|
|
let body: serde_json::Value = res.json().await.unwrap();
|
|
assert_eq!(listed_ids(&body), vec![leaf.clone(), sibling.clone()]);
|
|
|
|
// An unsupported sort is a client error rather than being silently ignored.
|
|
let res = client()
|
|
.get(app.url("/api/products?sort=bogus"))
|
|
.send()
|
|
.await
|
|
.unwrap();
|
|
assert_eq!(res.status(), 400);
|
|
let body: serde_json::Value = res.json().await.unwrap();
|
|
assert_eq!(body["error"]["code"], "BAD_REQUEST");
|
|
}
|
|
|
|
#[tokio::test]
|
|
#[serial]
|
|
async fn brand_filter_and_real_sales() {
|
|
let app = spawn_app().await;
|
|
let admin = login_admin(&app).await;
|
|
|
|
// Brands are admin-managed reference data; replacing the list is idempotent.
|
|
let brands = serde_json::json!([
|
|
{"slug": "alpha", "name": {"en": "Alpha", "zh": "阿尔法"}},
|
|
{"slug": "beta", "name": {"en": "Beta", "zh": "贝塔"}}
|
|
]);
|
|
let res = client()
|
|
.put(app.url("/api/admin/brands"))
|
|
.bearer_auth(&admin)
|
|
.json(&brands)
|
|
.send()
|
|
.await
|
|
.unwrap();
|
|
assert_eq!(res.status(), 200, "{:?}", res.text().await);
|
|
let list: serde_json::Value = res.json().await.unwrap();
|
|
let alpha = list[0]["id"].as_str().unwrap().to_string();
|
|
let beta = list[1]["id"].as_str().unwrap().to_string();
|
|
|
|
let shop_id = create_shop(&app, &admin, "shop-brands").await;
|
|
let owner = make_shop_owner(&app, &admin, &shop_id).await;
|
|
let (p_alpha, _) =
|
|
create_product_full(&app, &owner, "branded-a", 1000, 10, None, Some(&alpha)).await;
|
|
let (p_beta, _) =
|
|
create_product_full(&app, &owner, "branded-b", 2000, 10, None, Some(&beta)).await;
|
|
publish_product(&app, &owner, &p_alpha).await;
|
|
publish_product(&app, &owner, &p_beta).await;
|
|
|
|
let ids = |body: &serde_json::Value| -> Vec<String> {
|
|
body["items"]
|
|
.as_array()
|
|
.unwrap()
|
|
.iter()
|
|
.map(|p| p["id"].as_str().unwrap().to_string())
|
|
.collect()
|
|
};
|
|
let sold = |body: &serde_json::Value, id: &str| -> i64 {
|
|
body["items"]
|
|
.as_array()
|
|
.unwrap()
|
|
.iter()
|
|
.find(|p| p["id"] == id)
|
|
.unwrap()["sold_count"]
|
|
.as_i64()
|
|
.unwrap()
|
|
};
|
|
|
|
// The brand filter narrows within the shop.
|
|
let res = client()
|
|
.get(app.url(&format!(
|
|
"/api/products?shop_id={shop_id}&brand_id={alpha}&per_page=50"
|
|
)))
|
|
.send()
|
|
.await
|
|
.unwrap();
|
|
let body: serde_json::Value = res.json().await.unwrap();
|
|
assert_eq!(ids(&body), vec![p_alpha.clone()]);
|
|
assert_eq!(body["total"], 1);
|
|
|
|
// An unpaid order is not a sale.
|
|
let sku_alpha: String =
|
|
sqlx::query_scalar("SELECT id::text FROM skus WHERE product_id = $1::uuid")
|
|
.bind(&p_alpha)
|
|
.fetch_one(&app.db)
|
|
.await
|
|
.unwrap();
|
|
let (buyer, _) = register_customer(&app, "brand-buyer").await;
|
|
add_to_cart(&app, &buyer, &sku_alpha, 3).await;
|
|
let orders = checkout(&app, &buyer).await;
|
|
|
|
let res = client()
|
|
.get(app.url(&format!("/api/products?shop_id={shop_id}&per_page=50")))
|
|
.send()
|
|
.await
|
|
.unwrap();
|
|
let body: serde_json::Value = res.json().await.unwrap();
|
|
assert_eq!(
|
|
sold(&body, &p_alpha),
|
|
0,
|
|
"pending payment must not count as sold"
|
|
);
|
|
assert_eq!(sold(&body, &p_beta), 0);
|
|
|
|
// Paying makes the units count, and the sales sort follows them.
|
|
for order in &orders {
|
|
pay(&app, &buyer, order["id"].as_str().unwrap()).await;
|
|
}
|
|
let res = client()
|
|
.get(app.url(&format!("/api/products?shop_id={shop_id}&per_page=50")))
|
|
.send()
|
|
.await
|
|
.unwrap();
|
|
let body: serde_json::Value = res.json().await.unwrap();
|
|
assert_eq!(sold(&body, &p_alpha), 3);
|
|
|
|
let res = client()
|
|
.get(app.url(&format!(
|
|
"/api/products?shop_id={shop_id}&sort=sales&order=desc&per_page=50"
|
|
)))
|
|
.send()
|
|
.await
|
|
.unwrap();
|
|
let body: serde_json::Value = res.json().await.unwrap();
|
|
assert_eq!(
|
|
ids(&body)[0],
|
|
p_alpha,
|
|
"sales sort puts the sold product first"
|
|
);
|
|
|
|
// Comments still have no model, so that sort stays refused.
|
|
let res = client()
|
|
.get(app.url("/api/products?sort=comments"))
|
|
.send()
|
|
.await
|
|
.unwrap();
|
|
assert_eq!(res.status(), 400);
|
|
}
|
|
|
|
#[tokio::test]
|
|
#[serial]
|
|
async fn suspended_shop_hidden_from_public_catalog() {
|
|
let app = spawn_app().await;
|
|
let admin = login_admin(&app).await;
|
|
let shop_id = create_shop(&app, &admin, "shop-susp").await;
|
|
let owner = make_shop_owner(&app, &admin, &shop_id).await;
|
|
let (product_id, _) = create_product_with_sku(&app, &owner, "susp-item", 100, 1).await;
|
|
client()
|
|
.post(app.url(&format!("/api/shop/products/{product_id}/publish")))
|
|
.bearer_auth(&owner)
|
|
.send()
|
|
.await
|
|
.unwrap();
|
|
|
|
client()
|
|
.put(app.url(&format!("/api/admin/shops/{shop_id}/status")))
|
|
.bearer_auth(&admin)
|
|
.json(&serde_json::json!({ "status": "suspended" }))
|
|
.send()
|
|
.await
|
|
.unwrap();
|
|
|
|
let res = client().get(app.url("/api/products")).send().await.unwrap();
|
|
let list: serde_json::Value = res.json().await.unwrap();
|
|
assert!(!list["items"]
|
|
.as_array()
|
|
.unwrap()
|
|
.iter()
|
|
.any(|p| p["id"] == product_id));
|
|
}
|