import assert from "node:assert/strict"; import test from "node:test"; import { isDistributionOwner, isTaskOwner, ownerScopeUserid, } from "../lib/owner-scope.ts"; function captureDb(rowsByPattern) { const captured = []; const makeStatement = (sql, values) => ({ async first() { captured.push({ sql, values }); for (const [pattern, rows] of rowsByPattern) { if (pattern.test(sql)) return rows(values) ?? null; } return null; }, async all() { captured.push({ sql, values }); for (const [pattern, rows] of rowsByPattern) { if (pattern.test(sql)) return { results: rows(values) ?? [] }; } return { results: [] }; }, }); const db = { prepare(sql) { const unbound = makeStatement(sql, []); return { bind(...values) { return makeStatement(sql, values); }, first: unbound.first, all: unbound.all, }; }, }; return { db, captured }; } test("isTaskOwner union-matches task owner or project owner", async () => { const { db, captured } = captureDb([ [ /FROM tasks t\s+LEFT JOIN projects p ON p\.id = t\.project_id/, (values) => values[0] === "task-1" && values[1] === "zhangsan" && values[2] === "zhangsan" ? { id: "task-1" } : null, ], ]); assert.equal(await isTaskOwner(db, "task-1", "zhangsan"), true); assert.equal(await isTaskOwner(db, "task-2", "zhangsan"), false); assert.equal(captured.length, 2); assert.match( captured[0].sql, /t\.owner_userid = \? OR p\.owner_userid = \?/, ); assert.deepEqual(captured[0].values, ["task-1", "zhangsan", "zhangsan"]); }); test("isTaskOwner strict mode only matches task owner_userid", async () => { const { db, captured } = captureDb([ [ /FROM tasks WHERE id = \? AND owner_userid = \?/, (values) => values[0] === "task-1" && values[1] === "zhangsan" ? { id: "task-1" } : null, ], ]); assert.equal(await isTaskOwner(db, "task-1", "zhangsan", { strict: true }), true); assert.equal( await isTaskOwner(db, "task-1", "project-owner", { strict: true }), false, "strict 门不允许项目负责人代操作任务负责人的客户群", ); assert.equal(captured.length, 2); assert.ok( !/LEFT JOIN projects/.test(captured[0].sql), "strict 查询不应 JOIN projects", ); assert.deepEqual(captured[0].values, ["task-1", "zhangsan"]); }); test("isTaskOwner guards empty taskId / wecomUserId without querying", async () => { const { db, captured } = captureDb([]); assert.equal(await isTaskOwner(db, "task-1", ""), false); assert.equal(await isTaskOwner(db, "", "zhangsan"), false); assert.equal(await isTaskOwner(db, " ", "zhangsan"), false); assert.equal(captured.length, 0); }); test("isDistributionOwner union-matches via task or project owner", async () => { const { db, captured } = captureDb([ [ /FROM distributions d\s+JOIN tasks t ON t\.id = d\.task_id\s+LEFT JOIN projects p ON p\.id = t\.project_id/, (values) => values[0] === "dist-1" && values[1] === "zhangsan" && values[2] === "zhangsan" ? { id: "dist-1" } : null, ], ]); assert.equal(await isDistributionOwner(db, "dist-1", "zhangsan"), true); assert.equal(await isDistributionOwner(db, "dist-9", "zhangsan"), false); assert.equal(await isDistributionOwner(db, "dist-1", ""), false); assert.match( captured[0].sql, /t\.owner_userid = \? OR p\.owner_userid = \?/, ); assert.deepEqual(captured[0].values, ["dist-1", "zhangsan", "zhangsan"]); }); test("ownerScopeUserid maps scope kinds to filter value", () => { assert.equal(ownerScopeUserid({ kind: "full" }), undefined); assert.equal(ownerScopeUserid({ kind: "owner", wecomUserId: "zhangsan" }), "zhangsan"); assert.equal(ownerScopeUserid({ kind: "owner", wecomUserId: "" }), ""); });